Free workaround fix for searchaweb malware virus

Searchaweb.com is new malware unleashed May 4 infecting Google, Internet Explorer, Yahoo, and probably other search engines and browsers.  It is invasive, persistent, bad, from Russia without love, and showing up everywhere.

–beginning of update—

MAY 8 UPDATE–In addition to the short term workaround fix described below, a long term solution to the searchaweb malware is download a free copy of Spyware Doctor 6 for Windows available here:   Spyware Doctor FREE Scan   (Windows Vista 64 and 32 bit, XP Home and Pro, and 2000)  Extra link for Windows 98.  Yes, there is also a paid version of Spyware Doctor for $29.95.  Protects three machines, one year support, updates, etc.  This is a global malware problem, and Spyware has instructions in French, Italian, German, Portugese, Swedish, Danish, Greek, Czech, Japanese, Chinese, Russian, and several other languages.

Be patient while the software is scanning your system.  Even on the simplest machines, there are a lot of objects to scan. 

Details of manual removal of Searchaweb here courtesy of 411-spyware.  Manual removal requires backing up your registry, working with dll files, .exe files, and other places most people seldom go on their computers.  You might have other malware files on your system now, since searchaweb can drop you to third party malware sites (myshovel.com has been found as a destination site), causing more havoc and more removal to be done.

—-end of update——-
 

• What searchaweb does in general: Searchaweb.com is a malicious virus software that redirects your search results first to searchaweb.com, then redirects again to shopping addresses, dead zones, gateway time outs, and other unrelated sites.  How it got on your computer and infected it is not important–getting it off and keeping it off is important.  We found a free workaround fix to defeat the current version of searchaweb and spell out that solution here for your convenience.
• Who made searchaweb: According to whois.com,  the domain name searchaweb.com was registered May 4, 2009 by an Ivan Petrov of Moscow.  Since Ivan Petrov is also the name of a deceased former member of the Bolshoi opera and the title character of Ivan Petrov: Russia Through a Shot Glass, don’t count on the creator of this pest to actual have Ivan Petrov on his/her/its birth certificate or drivers license.  A quick Google search for searchaweb shows it was first complained about on May 4.
• What searchaweb does–details: In its present edition, searchaweb.com attaches itself to major search engine results and throws your link to a third party site.  Click on a result link page (the top summary highlighted text in a result), and the searchaweb malware 1. redirects your search result link to searchaweb.com, 2. adds your query search terms to the searchaweb.com address string, 3. then transfers this hijacked search to a third party site.  It does no good to include your search in quotation marks.  The malware includes the quotation marks in the redirected search.  Other Boolean restrictions are also simply added to the redirected search and sent along to a random oblivion site.
• Workaround fix for searchaweb: Update your antivirus software.  If you don’t have antivirus software, discover your subscription expired about one year after you got your computer, can’t find your registration key, etc., here is the workaround fix for searchaweb malware.

1. Perform a browser search as you would normally perform a search.  For purposes of this example, we’ve chosen the search term gnivas.com
2. When you get the results, do NOT click on the top result link.  At the present time, the top result link for gnivas. com returns “Welcome to Gnivas  Gnivas.com”.  If you click that result link, you are on your way to the searchaweb redirect spiral.
3. DO go to the bottom of the result you want to access.  With the sample search, it will be “gnivas.com/ – 21k”.  The beauty of search engine results is most browsers give you two results, not just one.  There is the top result that everyone clicks on, and the bottom result that requires copying part of the bottom result and pasting that in an address bar.  At the present time, searchaweb attaches only to the top link of each returned result.  Copying and pasting part of the bottom result in an address bar should bring up the results of what the search would return if searchaweb was not lurking.
4. COPY JUST the part of the bottom result link that comes before the first dash (the first -)into the address bar.  In this case, that would be gnivas.com/.
5. PASTE that copy (gnivas.com/) into the main address bar.  Don’t worry about adding http or www to the front of the address.  Browsers take care of the front end of the web address and add what is needed.  We’ve also found that in a particularly long name that is truncated by a search engine still comes up by including the “. . .” that symbolizes the rest of the unseen address.

Going forward: Update your antivirus and internet security software, get some antivirus software (like the free Spyware version described above or the $29.95 version for three users), or use the workaround steps here until you get the software protection you need.  Comparing Spyware to the two US antivirus marke leaders, a single use license copy of Norton AntiVirus 2009 is $40.95 at Office Depot, and there is free delivery for any order of more than $50 for an address within 20 miles of a store.  Mac price is $50.95 single user.  McAfee VirusScan Plus 2009 is $39.99 for one user.  If you have the time, you can order both of these products online and wait for delivery from their respective manufacturers.

Office Depot Software

This entry was posted on Thursday, May 7th, 2009 at 12:59 pm and is filed under Computers, Frugal, Savings, Web Deals. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.