Adware.SuperSpider (http://sarc.com/avcenter/venc/data/pf/adware.superspider.html)
If Windows reports that it cannot delete the file, this indicates that the file is in use. In this situation, complete the rest of the instructions on this page, restart the computer in Safe mode, and then delete the file using Windows Explorer
It is a CWS
When Adware.SuperSpider is executed, it performs the following actions:
1. Adds the value:
"Network Security Guard" = <Path to file>
to the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
so that the Adware runs when you start Windows.
2. Adds the following registry keys:
HKEY_CLASSES_ROOT\bjmwk.iaoi
HKEY_CLASSES_ROOT\bjmwk.iaoi.328
HKEY_LOCAL_MACHINE\SOFTWARE\Melcosoft
HKEY_CLASSES_ROOT\hwohn.cdddwx.579
HKEY_CLASSES_ROOT\hwohn.cdddwx
HKEY_CLASSES_ROOT\redalert.here.1
HKEY_CLASSES_ROOT\redalert.here
HKEY_CLASSES_ROOT\CLSID\{467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E}
HKEY_CLASSES_ROOT\TypeLib\{444A5674-FF85-45D4-9AE2-4199D8D70C85}
HKEY_CLASSES_ROOT\Plugin6.DNSErrObj
HKEY_CLASSES_ROOT\Plugin6.DNSErrObj.1
3. Adds the value:
"{467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E}" = ""
to the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects
so that the Adware loads with the browser.
4. Modifies Internet Explorer settings, such as the home page and search page, to point to super-spider.com.
5. May download and execute files from t34rulit.com.
6. May display ads.
7. Modifies search behavior if it finds one of the following keywords in the domain:
o *my-finder.com*
etc...
The link again for the Symantec removal page (http://sarc.com/avcenter/venc/data/pf/adware.superspider.html)
Anytime you cannot delete a process or file because it is in use, boot to safe mode and delete it.
And remember to shut off system restore as well.