Removing SEARCHNAV

March 10, 2004 7:49 AM

F-in' SEARCHNAV! I somehow accepted a cookie from this monster, and it's annoying me beyond belief.

IE 6.0, Windows XP, PC. I've deleted it everywhere I can find it, but it makes you log on to their site to download an uninstall, which apparently has some kind of program to hide the booger better. I've checked my bookmarks, my downloads, everything. Now I think I've deleted it, and emptied my recycle bin, but it's showing up as an unmovable search toolbar under my Google toolbar. Please help me kill it!

posted by pomegranate to Computers & Internet (12 answers total)

I'd think if there's a toolbar, it's far more than a cookie.

Try running adaware or another spyware-killer.

And switch to firefox or mozilla.
posted by ROU_Xenophobe at 7:58 AM on March 10, 2004

Response by poster: I can't switch to firefox or mozilla, unfortunately, because the computer is at work. Now this insideous little thing has changed my homepage to POPNAV. Grrr....
posted by pomegranate at 8:04 AM on March 10, 2004

It isn't a "cookie" that you accepted: you accepted an ActiveX control's request to exceed its privileges by installing some crap on your machine. Not every Accept/Cancel option that pops up is a cookie; given that you're using Internet Explorer, apparently with a relatively feeble security setting, it's not out of place to say that almost any "Accept" button you click is an invitation for disaster.

Make it all go away with the help of good old AdAware. Don't, under any circumstances, go download some "uninstaller" from what is proven to be an untrustworthy source. That's a great way to make things worse!
posted by majick at 8:14 AM on March 10, 2004

can I ask this, then? Why can't you switch? Is it the access from the proxy server your on or is the PC locked down? Because for the longest time, the Mozilli didn't have NTLM support and now they do.
posted by mkelley at 8:14 AM on March 10, 2004

Response by poster: Mkay I ran AdAware, and the @#"$#@ is still there in the toolbars. Do I have to just have my IT guy reimage the computer?

(Yes, I suck that I did this, it's my fault, tisk tisk to me.)
posted by pomegranate at 8:41 AM on March 10, 2004

You have a Browser "Helper" Object. My (limited) experience with these things (don't use IE but have helped friends and family with them) is that Ad-Aware and Spybot Search and Destroy don't always catch them - some are legitimate like the Google Toolbar. Search google for BHO removal tools - can't recommend one specifically.
posted by TimeFactor at 9:01 AM on March 10, 2004

Response by poster: Okay, I downloaded and used a BHR removal tool, and upped my IE security to 11, and it's still there.

I give up. A good reimaging will just have to wash my sins away....

Thanks anyway though, y'all.
posted by pomegranate at 9:27 AM on March 10, 2004

Best answer: pomegranate, if you haven't already re-imaged, here's some more info that I tracked down: there's more to POPNAV than a BHO - there are also memory resident programs that automatically reinstall the BHO stuff whenever removed. It's apparently a bitch to eradicate. The programs are in one or more of the following files:
frsk.exe
PTWZDGJ.exe
iefeatures.exe
internetfeatures.exe
Use the task manager to kill any running processes with those names. Then search for any files with those names - they're likely in your system folder and may be hidden - be sure to search for hidden files - and delete them. You may get error messages when restarting - Windows may look to load the files and complain when it can't find them. Either ignore the messages, or use a tool like Startup Control Panel to disable loading of those files at startup, or spelunk in the registry to delete any keys referencing them (don't do the last if you aren't comfortable with modifying the registry).
posted by TimeFactor at 10:21 AM on March 10, 2004

Its probably too late, but the newest version of Spybot Search & Destroy will get rid of it. It also has a bunch of neat utilities, such as a BHO finder, startup control panel, etc.
posted by pemulis at 11:32 AM on March 10, 2004

Response by poster: I got brave and deleted it from my registry all by my little old technically illiterate self. It seems to have worked for now, and I've downloaded Spybot, Adaware, and BHODemon for future boo-boos.

Thanks!
posted by pomegranate at 11:58 AM on March 10, 2004

Okay, this just melts my noggin. You can edit your registry, download and install software, but can't use Mozilla or Firefox? If it's a policy thing, you've already violated it, so just go for the gusto and get the better browsers. If it's a proxy thing, it's easy to work around.
posted by mnology at 1:47 PM on March 10, 2004

You can also try Hijack This (use with care - no safety net).
posted by stavrosthewonderchicken at 8:41 PM on March 10, 2004