Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Adware.maxsearch


  • Please log in to reply
9 replies to this topic

#1 j_a_m_i_e

j_a_m_i_e

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:07:52 PM

Posted 14 April 2007 - 03:12 PM

Hi i'm using windows xp media center edition. Everytime i startup windows i get a message saying something about a program named tcinstall.exe. Also my home page has been changed to norton and won't let me access it, or any other norton page. Norton picks up the virus as adware.maxsearch and deletes it however i still can't get into any norton/symantec webpage and whenever i reboot the computer it picks it up again. The virus i believe came from msn messenger as i clicked on a link sent to me. The virus opens msn messenger randomly and sends the same link to all of my contacts. I dont have a clue what to do, any help would be much appreciated :thumbsup:

thnx

BC AdBot (Login to Remove)

 


#2 fozzie

fozzie

    aut viam inveniam aut faciam


  • Members
  • 3,516 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ossendrecht/The Netherlands
  • Local time:07:52 PM

Posted 14 April 2007 - 03:21 PM

Posted Image

To uninstall the security risk
This security risk includes an uninstallation applet. In order to uninstall this security risk, complete the following instructions:

1. Click Start > Settings > Control Panel or Start > Control Panel (this varies with the operating system).

2. In the Control Panel window, double-click Add/Remove Programs.

Windows Me only: If you do not see the Add/Remove Programs icon, click ...view all Control Panel options.

3. Click MaxiFiles.

Note: You may need to use the scroll bar to view the whole list.

4. Click Add/Remove, Change/Remove, or Remove (this varies with the operating system). Follow the prompts.

Note: After running the Add/Remove programs applet, all the files may have been removed.

Download and scan with SUPERAntiSypware Free for Home Users

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Udates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
* When done, select "Scan for Harmful Software".
* There are three scanning options. Choose "Perform Complete Scan" and click "Next".
* When done, a Scan Summary will appear with potentially harmful items that were detected. Click "OK".
* Make sure they all have a checkmark next to them and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* Click Preferences and then click the statistics/logs tab.
* Click the dated log and press View log. A text file will appear so you can see the results.
* Select close to exit the program.
* Scan in SAFE MODE

After that, download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in SAFE MODE using the F8 method.

Scan with DrWeb-CureIt as follows:

* Double-click on drweb-cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
* Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
* Once the short scan has finished, Click Options > Change settings
* Choose the "Scan tab" and UNcheck "Heuristic analysis"
* Back at the main window, click "Select drives" (a red dot will show which drives have been chosen)
* Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
* When done, a message will be displayed at the bottom advising if any viruses were found.
* Click "Yes to all" if it asks if you want to cure/move the file.
* When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable".
(This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
* Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
* Save the DrWeb.csv report to your desktop.
* Exit Dr.Web Cureit when done.
* Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

#3 j_a_m_i_e

j_a_m_i_e
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:07:52 PM

Posted 14 April 2007 - 03:59 PM

hi, i have opened the add or remove programs bit but there is no Maxifiles file there. Should i just continue with the rest of the steps?
thnx again

#4 fozzie

fozzie

    aut viam inveniam aut faciam


  • Members
  • 3,516 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ossendrecht/The Netherlands
  • Local time:07:52 PM

Posted 14 April 2007 - 04:50 PM

yes please post back if any improvement..

#5 j_a_m_i_e

j_a_m_i_e
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:07:52 PM

Posted 16 April 2007 - 12:42 PM

hi, the virus seems to have gone as norton no longer picks it up. The only thing is that my homepage is still set as 'http://securityresponse.symantec.com/avcenter/fix_homepage/' and wont let me change it??

#6 fozzie

fozzie

    aut viam inveniam aut faciam


  • Members
  • 3,516 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ossendrecht/The Netherlands
  • Local time:07:52 PM

Posted 16 April 2007 - 12:49 PM

To reset the Internet Explorer home page

1. Start Microsoft Internet Explorer, a second window displaying the same content will open.
2. In the new window, browse to the site that you want as your home page.
3. On the menu, click Tools > Internet Options.
4. In the Home page section of the General tab, click Use Current. You will now see the chosen URL appear in the Address textbox.
5. Click OK to finish.
6. Close all browser windows and then restart Internet Explorer.


For users of Norton AntiVirus 2006, Norton Internet Security 2006, or Norton SystemWorks 2006
If you have Norton AntiVirus 2006, Norton Internet Security 2006, or Norton SystemWorks 2006, when you see the alert, select the second menu choice and then click OK.

In the following example, the home page was changed to www.symantec.com.

Posted Image

#7 j_a_m_i_e

j_a_m_i_e
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:07:52 PM

Posted 21 April 2007 - 05:58 AM

Hi,
I've tried what u told me to do but the homepage still hasnt changed :S

#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,140 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:52 PM

Posted 21 April 2007 - 07:00 AM

1. Start Norton Antivirus. (If Norton Antivirus is a part of Norton Internet Security or Norton System Works, then start that program.)
2. Left click on Options then click on Norton Antivirus
3. Under the bold Internet section, left click on "Home Page Protection"
4. Make sure that "Turn Home Page Protection" is on (or off here to reset home page)
5. Make sure that "Block all attempts to my home page" is checked (here to disable long enough to reset home page)
6. Make sure that "Alert me when my home page loads" is checked (uncheck this to reset home page)
7. Close your internet browser then re-open

After your home page is set, go back and change security settings to "Enable Protection against Home Page changes".

For additional information, or if this procedure does not work, read the Microsoft Knowledge Base article: Home page setting changes unexpectedly, or you cannot change your home page setting.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 j_a_m_i_e

j_a_m_i_e
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:07:52 PM

Posted 21 April 2007 - 12:40 PM

Thanks alot, virus gone, internet homepage back to normall. This site is the best :thumbsup:

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,140 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:52 PM

Posted 21 April 2007 - 04:32 PM

Your welcome and thank you for the kind words. :thumbsup:

Now don't forget to Set a New Restore Point to enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then go to Start > Run and type: Cleanmgr
  • Click "OK".
  • Click the "More Options" Tab.
  • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users