Adware.ClickAlchemy - Removal

Removal Tool
Symantec Security Response has developed a removal tool for Adware.ClickAlchemy. Use this removal tool first, as it is the easiest way to remove this threat.

The tool can be found here:
http://securityresponse.symantec.com/avcenter/FixAlchm.exe

The current version of the tool is version 1.0.6. It will have a digital signature timestamp equivalent to 01/24/2005 04:20 AM PST.

Note: The date and time displayed will be adjusted to your time zone, if your computer is not set to the Pacific time zone.

It has been reported that a computer on which Adware.ClickAlchemy is installed may also have other security risks. Symantec recommends that the following steps be carried out:

1. Apply the Adware.ClickAlchemy Removal Tool.
2. Update the definitions by starting the Symantec program and running LiveUpdate.
3. Run a full system scan to detect any other security risks on the computer.
4. If the scan detects any further security risks, check for removal tools at http://securityresponse.symantec.com/avcenter/security.risks.tools.list.html.
5. If there are no removal tools for the security risks that are detected, follow the manual removal instructions listed in the threat report.

Manual Removal

The following instructions pertain to all Symantec antivirus products that support Security Risk detection.

1. Update the definitions.
2. Run a full system scan and delete all the files detected as Adware.ClickAlchemy.
3. Delete the value that was added to the registry.
   

For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. To scan for and delete the files

1. Start your Symantec antivirus program, and then run a full system scan.
2. If any files are detected as Adware.ClickAlchemy, write down the path and file name, and then click Delete.
   
   

   ---

   Note: If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file name. Then use Windows Explorer to locate and delete the file.

   ---

3. To delete the value from the registry

---

WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

---

1. Click Start, and then click Run.
2. Type regedit
   
   Then click OK.
   
   
3. Navigate to the key:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
   
4. In the right pane, delete the value:
   
   "Alchem" = "Alchem.exe"
   
   
5. Exit the Registry Editor.

Technical Details