About eUniverse
Also known as: eUniverse Flowgo toolbar, eUniverse
SirSearch, KeenValue.MyFreeCursors, PerfectNav
Adware supplied by eUniverse.com. KeenValue/v1 runs at
startup, generates popup ads, and is the original version.
KeenValue/Incredifind adds capability, via a second process:
- monitors web sites visited, so that ads may be targeted;
- hijacks the hosts file and redirects Netscape searches
to incredifind.com;
- hijacks error pages and address bar searches to
incredifind.com, which is then redirected to sirsearch.com;
- adds an Internet Explorer toolbar providing a search
field directed to sirsearch.com.
'PerfectNav is designed to redirect your URL typing errors
to PerfectNav's web page. This software helps keep Kazaa Media
Desktop free.' -- http://www.kazaa.com/us/terms.htm
Variants:
Removal Instructions
Automatic Removal:
eUniverse can be detected and removed Automatically
by Spyware Doctor, also SpyEraser.
Manual Removal:
There is no uninstaller listed in "Add/Remove
Programs" for EUniverse.PerfectNav. For other variants,
begin by choosing "KeenValue", then
"Remove" in Control Panel's Add/Remove Programs.
Repeat for "PowerSearch toolbar for IE" This will
not fully remove KeenValue, but its a start.
After removing files, directories, and registry entries as
described below, restore your search settings (Internet
Options->Programs->Reset Web Settings), and remove the
Hosts file hijack: open the System folder (which is inside the
Windows folder, and called 'System32' on Windows NT, 2000 and
XP), go to 'drivers'->'etc', and load the file 'hosts'
(with no file extension) into a text editor. Delete the
following line and save.
12.129.205.209 search.netscape.com
An uninstaller may be found at http://www.incredifind.com/downloads/incredifinduninstall.exe
If you have KeenValue/Incredifind, you might have
RealPlayer installed, along with the RealPlayer SearchBar.
Here is advice from Real about how to remove this:
To Remove RealOne Player:
1. Click the Start button, point to Search, and click Find
Files or Folders.
2. Type .r1pclean.exe (r1(one)pclean) in the search box and
click Search Now.
2a. This may be found at C:\Program Files\Real\RealOne
Player\Setup\.r1pclean.exe
3. When Windows locates the file, double-click it. A MS-DOS
window appears with a warning.
4. Press the Y key and then press ENTER to uninstall.
5. You will be asked if you want to keep your media database
or not; for a complete uninstall press the N key to delete the
media database. See Deleting the Database below for more
information.
6. If RealOne Music software is also installed, you will be
asked if you want to leave all the registry keys associated
with RealOne Music and leave the MCS database files. Press the
N key to delete them.
RealOne Player will now uninstall from your computer.
Deleting the Database
The media database keeps track of all your music files and
playlists. Deleting it will not delete your music files, but
you will have to recreate all your playlists again. You should
only delete the database if it is corrupt and the cause of the
problem.
7. Go to the C:\Program Files\Common Files\ and delete the
Real folder.
Reinstall your RealNetworks Programs.
- Kill these running processes with Task Manager:
programfilesdir+\common files\keenvalue\keenvalue.exe
programfilesdir+\common files\keenvalue\killkeenvalue.exe
programfilesdir+\common files\keenvalue\kwm.exe
programfilesdir+\common files\keenvalue\senduninstallinfo.exe
programfilesdir+\common files\keenvalue\uninstall.exe
programfilesdir+\common files\keenware\wupdater.exe
programfilesdir+\common files\updater\delupdat.exe
programfilesdir+\common files\updater\sui.exe
programfilesdir+\common files\updater\wupdater.exe
programfilesdir+\common files\updmgr\rvupdmgr.exe
programfilesdir+\common files\updmgr\simgr.exe
programfilesdir+\common files\updmgr\updmgr.exe
programfilesdir+\incredifind\bho\tipb.exe
programfilesdir+\kazaa\perfectnavuninstall.exe
programfilesdir+\perfectnav\bho\tipb.exedefault.exe
ribbon_wave_animated.exe
- Go to the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.
If you find the value updater, delete it and reboot
the machine immediately. If you find the value updmgr,
delete it and reboot the machine immediately.
- Unregister these DLLs with Regsvr32, then reboot:
programfilesdir+\bho\perfectnav.dll
programfilesdir+\common files\keenvalue\iesliderwin32.dll
programfilesdir+\common files\keenvalue\kvlhookwin.dll
programfilesdir+\incredifind\bho\bho.dll
programfilesdir+\perfectnav\bho\perfectnav150.dll
programfilesdir+\perfectnav\bho\perfectnavbho.dll
programfilesdir+\perfectnav\bho\perfec~1.dll
programfilesdir+\perfec~1\bho\perfectnav150.dll
programfilesdir+\perfec~1\bho\perfec~1.dll
systemroot+\system32\flgobar.dll
systemroot+\system32\incfindbho.dll
systemroot+\system32\infobar.dll
systemroot+\system32\perfectnavbho.dll
systemroot+\system32\searchbr.dll
systemroot+\system\flgobar.dll
systemroot+\system\incfindbho.dll
systemroot+\system\infobar.dll
systemroot+\system\perfectnavbho.dll
systemroot+\system\searchbr.dllpwrs0108.dll
- Remove these registry items (if present) with RegEdit:
HKEY_CLASSES_ROOT\bho.incredifindbho
HKEY_CLASSES_ROOT\bho.incredifindbho.1
HKEY_CLASSES_ROOT\bho.perfectnavbho
HKEY_CLASSES_ROOT\bho.perfectnavbho.1
HKEY_CLASSES_ROOT\clsid\{00d6a7e7-4a97-456f-848a-3b75bf7554d7}
HKEY_CLASSES_ROOT\clsid\{03fde7ea-c8c4-413f-bea1-f8c1b8b39ea6}
HKEY_CLASSES_ROOT\interface\{8b8f6968-2f24-41e3-b653-e9613226f14d}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer
\browser helper objects\{00d6a7e7-4a97-456f-848a-3b75bf7554d7}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer
\browser helper objects\{269b6797-664e-48aa-b283-b012bdf6e525}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer
\browser helper objects\{4e7bd74f-2b8d-469e-c0fc-f76fa694bf2e}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer
\browser helper objects\{4fc95edd-4796-4966-9049-29649c80111d}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer
\browser helper objects\{5d60ff48-95be-4956-b4c6-6bb168a70310}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer
\browser helper objects\{a045dc85-fc44-45be-8a50-e4f9c62c9a84}
HKEY_CLASSES_ROOT\typelib\{dcb709b4-4142-411a-8e9f-f265ae2b7bde}
HKEY_CLASSES_ROOT\typelib\{de289bfa-737b-4abb-a4ec-f8753551b875}
HKEY_CLASSES_ROOT\typelib\{dfaba77c-f8bb-4ab9-bed7-7d48ae103e24}
HKEY_CURRENT_USER\software\visicom media
HKEY_LOCAL_MACHINE\clsid\{00d6a7e7-4a97-456f-848a-3b75bf7554d7}
HKEY_LOCAL_MACHINE\clsid\{269b6797-664e-48aa-b283-b012bdf6e525}
HKEY_LOCAL_MACHINE\clsid\{4e7bd74f-2b8d-469e-c0fc-f76fa694bf2e}
HKEY_LOCAL_MACHINE\clsid\{4e7bd74f-2b8d-469e-c0ff-fd63b29bb37d}
HKEY_LOCAL_MACHINE\clsid\{4e7bd74f-2b8d-469e-c0ff-fd63b399bc7d}
HKEY_LOCAL_MACHINE\clsid\{4fc95edd-4796-4966-9049-29649c80111d}
HKEY_LOCAL_MACHINE\clsid\{5d60ff48-95be-4956-b4c6-6bb168a70310}
HKEY_LOCAL_MACHINE\clsid\{a045dc85-fc44-45be-8a50-e4f9c62c9a84}
HKEY_LOCAL_MACHINE\software\classes\clsid\{00d6a7e7-4a97-456f-848a-3b75bf7554d7}
HKEY_LOCAL_MACHINE\software\euniverse
HKEY_LOCAL_MACHINE\software\incredifind
HKEY_LOCAL_MACHINE\software\keenvalue
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{4e7bd74f-2b8d-469e-c0fc-f76fa694bf2e}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{4e7bd74f-2b8d-469e-c0ff-fd63b29bb37d}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{4e7bd74f-2b8d-469e-c0ff-fd63b399bc7d}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer
\browser helper objects\{00d6a7e7-4a97-456f-848a-3b75bf7554d7}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer
\browser helper objects\{0428ffc7-1931-45b7-95cb-3cbb919777e1}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer
\browser helper objects\{269b6797-664e-48aa-b283-b012bdf6e525}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer
\browser helper objects\{4e7bd74f-2b8d-469e-c0fc-f76fa694bf2e}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer
\browser helper objects\{4fc95edd-4796-4966-9049-29649c80111d}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer
\browser helper objects\{5d60ff48-95be-4956-b4c6-6bb168a70310}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer
\browser helper objects\{a045dc85-fc44-45be-8a50-e4f9c62c9a84}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
\keenvalue
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
\updater
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
\updmgr
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall
\keenvalue
HKEY_LOCAL_MACHINE\software\perfectnav
HKEY_LOCAL_MACHINE\software\updater
HKEY_LOCAL_MACHINE\software\updmgr
HKEY_LOCAL_MACHINE\software\{f08555af-9cc3-11d2-aa8e-000000000000}
HKEY_USERS\s-1-5-21-1409082233-1390067357-1801674531-500\software\microsoft\internet
explorer\urlsearchhooks\{269b6797-664e-48aa-b283-b012bdf6e525}
HKEY_USERS\s-1-5-21-1409082233-1390067357-1801674531-500\software\microsoft\internet
explorer\urlsearchhooks\{a045dc85-fc44-45be-8a50-e4f9c62c9a84}
HKEY_USERS\s-1-5-21-343818398-1035525444-682003330-1003\software\microsoft\internet
explorer\urlsearchhooks\{a045dc85-fc44-45be-8a50-e4f9c62c9a84}
- Remove these files (if present) with Windows Explorer:
programfilesdir+\bho\perfectnav.dll
programfilesdir+\incredifind\bho\bho.dll
programfilesdir+\incredifind\bho\tipb.exe
programfilesdir+\kazaa\perfectnavuninstall.exe
programfilesdir+\perfectnav\bho\perfectnav150.dll
programfilesdir+\perfectnav\bho\perfectnavbho.dll
programfilesdir+\perfectnav\bho\perfec~1.dll
programfilesdir+\perfectnav\bho\tipb.exe
programfilesdir+\perfec~1\bho\perfectnav150.dll
programfilesdir+\perfec~1\bho\perfec~1.dll
systemroot+\system32\flgobar.dll
systemroot+\system32\incfindbho.dll
systemroot+\system32\infobar.dll
systemroot+\system32\perfectnavbho.dll
systemroot+\system32\searchbr.dll
systemroot+\system\flgobar.dll
systemroot+\system\incfindbho.dll
systemroot+\system\infobar.dll
systemroot+\system\perfectnavbho.dll
systemroot+\system\searchbr.dlldata1.dat
data2.dat
default.exe
default.inf
keenvaluelog.txt
pwrs0108.dll
pwrs0108tb0.cfg
ribbon_wave_animated.exe
template.nsi
- Remove these directories (if present) with Windows
Explorer:
programfilesdir+\bho
programfilesdir+\common files\keenvalue
programfilesdir+\common files\updater
programfilesdir+\common files\updmgr
programfilesdir+\dynamic toolbar
programfilesdir+\perfectnav\bho
programfilesdir+\perfec~1\bho
- After
following the instructions above, you will still need to
restore your original settings and prevent this from happening
again. Here's how.
Sponsored Links:
Removal Instructions for Other Adwares &
Spywares
| 
