• There has been a recent cluster of spammers accessing BARFer accounts and posting spam. To safeguard your account, please consider changing your password. It would be even better to take the additional step of enabling 2 Factor Authentication (2FA) on your BARF account. Read more here.

BlazeFind, wtf?!

Hooli

Hooli

Bonafide
Joined
Feb 10, 2002
Location
The Far East
Moto(s)
Oh yes.
Name
El Jefe
How the hell do I get this crap off my system? Uninstalling from the control panle won't do jack. Edit the registry?
 
Google is your friend... ;)



Link...
Removal using the Adware.BlazeFind Removal Tool
Symantec Security Response has developed a removal tool for Adware.BlazeFind. Use this removal tool first, as it is the easiest way to remove this threat.

The tool can be found here:
http://securityresponse.symantec.com/avcenter/FxBlzFnd.exe

The current version of the tool is 1.0.1 and will have a digital signature timestamp equivalent to 03/20/2005 10:17 PM.

Notes:

The date and time displayed will be adjusted to your time zone, if your computer is not set to the Pacific time zone.

It has been reported that a computer on which Adware.BlazeFind is installed may also have other security risks. Symantec recommends that the following steps be carried out:
Apply the Adware.BlazeFind Removal Tool.
Update the definitions by starting the Symantec program and running LiveUpdate.
Run a full system scan to detect any other security risks on the computer.
If the scan detects any further security risks, check for removal tools at http://securityresponse.symantec.com/avcenter/security.risks.tools.list.html.
If there are no removal tools for the security risks that are detected, follow the manual removal instructions listed in the threat report.

Manual Removal
The publisher of Adware.BlazeFind has instructions on how to uninstall their product using the Windows Add/Remove programs utility. Although it has not been confirmed by Security Response that this will work in all cases, this should be tried first.

BlazeFind has uninstall instructions in sections seven and eight of the following Web page:
http://blazefind.com/?section=help

The following instructions pertain to all Symantec antivirus products that support Security Risk detection.

Update the definitions.
Run a full system scan and delete all the files detected as Adware.BlazeFind.
Delete the value that was added to the registry.

For specific details on each of these steps, read the following instructions.

1. Updating the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. Scanning for and deleting the files
Start your Symantec antivirus program, and then run a full system scan.
If any files are detected as Adware.BlazeFind, click Delete.


--------------------------------------------------------------------------------
Note: If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file name. Then use Windows Explorer to locate and delete the file.
--------------------------------------------------------------------------------


3. Deleting the value from the registry

--------------------------------------------------------------------------------

WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.
--------------------------------------------------------------------------------


Click Start, and then click Run. (The Run dialog box appears.)
Type regedit

Then click OK. (The Registry Editor opens.)


Navigate to the subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


In the right pane, delete the value:

"Windows SA" = "%PROGRAMFILES%\WindowsSA\omniscient.exe"


Navigate to the subkey:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop


In the right pane, delete the values:

"Taskbar" = "[binary data]"
"TaskbarWinXp" = "[binary data]"

Note: By deleting the above values, custom created taskbars will also be removed.


Navigate to and delete the following subkeys if present:

HKEY_CLASSES_ROOT\BridgeX.Installer
HKEY_CLASSES_ROOT\WindowsSaBand.WinSaBand
HKEY_CLASSES_ROOT\WindowsSaBand.WinSaBand.1
HKEY_CLASSES_ROOT\CLSID\{83DE62E0-5805-11D8-9B25-00E04C60FAF2}
HKEY_CLASSES_ROOT\CLSID\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}
HKEY_CLASSES_ROOT\CLSID\{14D2CFFE-6656-4BEC-8D9E-DDE6F2D4EAE5}
HKEY_CLASSES_ROOT\CLSID\{C5941EE5-6DFA-11D8-86B0-0002441A9695}
HKEY_CLASSES_ROOT\Interface\{8C505A6B-124B-4768-8FD3-1A066C839848}
HKEY_CLASSES_ROOT\Typelib\{0B3569D7-1EA4-4CBA-AC13-225902619789}
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Windows SR 2.0
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Windows SA
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83DE62E0-5805-11D8-9B25-00E04C60FAF2}
HKEY_LOCAL_MACHINE\Software\microsoft\code store database\distribution units\{15ad4789-cdb4-47e1-a9da-992ee8e6bad6}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows SA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DownloadManager
HKEY_ALL_USERS\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83DE62E0-5805-11D8-9B25-00E04C60FAF2}
Click to expand...



Link...
How to remove BlazeFind manually
These registry entries should be removed (if present) [editing the windows registry can be dangerous];

HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{71ed4fba-4024-4bbe-91dc-9704c93f453e}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{c5941ee5-6dfa-11d8-86b0-0002441a9695}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{83de62e0-5805-11d8-9b25-00e04c60faf2}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{fbed6a02-71fb-11d8-86b0-0002441a9695}

These files should be removed;

%windows%\%system%\2_0_1browserhelper2.dll
%windows%\%system%\UnstSA2.exe
%windows%\%system%\key2.txt


Click to expand...
 
Gack. I hate browser hijackers.... instead of producing a search engine people actually want to use, they just detour your system to the crappy one with all the paid results... :finger
 
Err...update...

Program has apparently dug its roots deeper into my system than I thought. Looks like editing the registry may be next. :(
 
that's usually how it works, Hooli.


something else you migt find helpful is a program called HijackThis -- it allows you to compile all your startup programs and registry keys into a log, which you can then use to track down the ones you don't want. Use with care, it has no safety measures to protect you from deleting necessary reg keys or files... best practice is to run it first when the system is clean, and log what you're supposed to have, and then run it again when there's a problem, and see what's changed.
 
i had to get rid of this spyware called jimbutts or something like that..that one sucked hardcore..i would just reinstall windows xp =)
 
You must log in or register to reply here.
Back
Top