Prozac Online Buy Antabuse Cipro Online Buy Cymbalta Toprol XL Online Buy Cipro Elimite Online Buy Neurontin Nexium Online Buy Seroquel

SearchMaid is a browser hijacker that changes Internet Explorer default start and search pages to web sites on the searchmaid.com domain. SearchMaid installs as a toolbar, delivers popups, and may come bundled with other questionable programs. SearchMaid may be difficult to remove because it secretly runs on every Windows startup.

Automated Detection for SearchMaid

SearchMaid Manual Removal Instructions

Stop SearchMaid system processes:

5e60971403.exe
5e60971403.exehelper.exe
helper.exe

Unregister SearchMaid DLLs:

virtualmaid.dll
govm.dll

Remove SearchMaid files:

uninstall.bat
logo.bmp
2.bmp
1.bmp
virtualmaid.xml
govm.dll.htm
virtualmaid.dll
govm.dll
5e60971403.exe
uninstall.bathelper.exe
logo.bmp
2.bmp
1.bmp
virtual maid.xml
govm.dll.htm

Remove SearchMaid registry values:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallVirtualMaidVirtualMaid
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionguid=AA8214E9-C7E6-4b66-A049-19AD20944CBF
HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMenuExt&RSDNSearch
HKEY_CURRENT_USERSoftwareVirtualMaid
42C7653A-5834-45A1-899A-ED0DFA370D21
AB2DDE8C-CBFF-491A-9825-87B8BB4CBFE0
835BAA68-B5E5-47D5-A18D-2A4E0F5B72D5
8B0B6F79-C50D-4ea6-8F65-BDF18005DE20
77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C
HKEY_CLASSES_ROOTGoVM.ContextItem.1
HKEY_CLASSES_ROOTGoVM.ContextItem
HKEY_CLASSES_ROOTVM.VMObj.1
HKEY_CLASSES_ROOTVM.VMObj
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerSearchSearchAssistant=[siteaddress]
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerSearchCustomizeSearch=[siteaddress]
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerMainStartPage=[siteaddress]
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerMainSearchPage=[siteaddress]
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerMainSearchBar=[siteaddress]
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerMainLocalPage=[siteaddress]
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerMainDefault_Search_URL=[siteaddress]
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternetExplorerMainDefault_Page_URL=[siteaddress]
HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainStartPage=[siteaddress]
HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainSearchPage=[siteaddress]
HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainSearchBar=[siteaddress]
HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainLocalPage=[siteaddress]
HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainDefault_Search_URL=[siteaddress]
HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainDefault_Page_URL=[siteaddress]
HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerSearchUrl=[siteaddress]
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionUninstallVirtual MaidVirtual MaidHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRunwinlogon.exe=helper.exe
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionguid=AA8214E9-C7E6-4b66-A049-19AD20944CBF
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftInternet ExplorerToolbar{77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C}
HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerToolbarWebBrowser{77B2F8DE-CB3F-4B6B-839B-807DD1ADBA1C}
HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMenuExt&RSDN Search
HKEY_CURRENT_USER SoftwareVirtual Maid
HKEY_CLASSES_ROOTTypeLib{42C7653A-5834-45A1-899A-ED0DFA370D21}
HKEY_CLASSES_ROOTInterface{AB2DDE8C-CBFF-491A-9825-87B8BB4CBFE0}
HKEY_CLASSES_ROOTInterface{835BAA68-B5E5-47D5-A18D-2A4E0F5B72D5}
HKEY_CLASSES_ROOTCLSID{8B0B6F79-C50D-4ea6-8F65-BDF18005DE20}
HKEY_CLASSES_ROOTCLSID{77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C}
HKEY_CLASSES_ROOTGoVM.ContextItem.1
HKEY_CLASSES_ROOTGoVM.ContextItem
HKEY_CLASSES_ROOTVM.VMObj.1
HKEY_CLASSES_ROOTVM.VMObj
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftInternet ExplorerSearchSearchAssistant=[site address]
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftInternet ExplorerSearchCustomizeSearch=[site address]
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftInternet ExplorerMainStart Page=[site address]
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftInternet ExplorerMainSearch Page=[site address]
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftInternet ExplorerMainSearch Bar=[site address]
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftInternet ExplorerMainLocal Page=[site address]
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftInternet ExplorerMainDefault_Search_URL=[site address]
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftInternet ExplorerMainDefault_Page_URL=[site address]
HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainStart Page=[site address]
HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainSearch Page=[site address]
HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainSearch Bar=[site address]
HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainLocal Page=[site address]
HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainDefault_Search_URL=[site address]
HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainDefault_Page_URL=[site address]
HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerSearchUrl=[site address]
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionPoliciesExplorerRunwinlogon.exe=helper.exe

Important Disclaimer

What is a Browser Hijacker?

SearchMaid is a Browser Hijacker.

Browser Hijacker is a malicious application that may place additional toolbars to your browser and display unwanted advertisements on your computer screen. The hijacking technique enables the attacker to have controll over your browser. Browser hijacker may also be known as search hijacker and have an ability to change your search page and redirect your search queries. Browser hijackers are also reported to install addtional malicious ActiveX controls. Once a browser hijacker is inside your system, it may be difficult to uninstall because it tends to re-install on every Windows startup.

SearchMaid is related to:

  » VirtualMaid

This entry was posted on Monday, June 26th, 2006 at 11:34 am and is filed under Browser Hijackers. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.