IGetNet Description:

IGetNet is a keyword-search service implemented as an IE Browser Helper Object and a process run at Windows start-up.

When you enter something into the address bar, IGetNet checks to see whether it includes keyword they have sold to one of their advertisers. If so, it redirects you to that site; if not it forwards you to a search engine using an IGetNet affiliate code. searchresult.net, qcksearch.com (which is apps.webservicehost.com) and overture.com have been seen to be used.

IGetNet/v4 : original variant, installs files 'BHO.DLL', 'rsp.dll' and 'Winstart.exe' into the 'System' folder in the Windows folder. 'Winstart.exe', run at start-up, writes entries to the Hosts file to redirect all access to MSN or Netscape search sites through to IGetNet's servers instead. (ignkeywords.com, rspsearch.com.)

IGetNet/v5 : works the same as v4, but the files are now called 'BHO001.DLL', 'rsp001.dll' and 'Winstart001.exe' and they use new class IDs internally. You can tell if you have v5 as new IE windows will show the text 'Enter Keyword or Web Address here' in the address bar.

IGetNet/v6 : same as v5 but has extra files.

IGetNet/ClearSearch: largely rewritten from the previous variants, this version will, every time the computer is started, remove older IGetNet variants, and any competitor search tool it finds. This includes the search-hijacking part of the parasites Xupiter, HuntBar/MSLink, CommonName, NewDotNet, and the iWon toolbar/search assistant and Netword, which are not currently known to be unsolicited commercial software.

Also known as: ClearSearch, ign

IGetNet Automatic Removal:

Using BPS Adware & Spyware Remover to detect and remove IGetNet AUTOMATICALLY!

IGetNet Manual Removal:

Before you can delete the software you must deregister its DLLs and stop it running at startup. Open a DOS command window (from Start->Programs->Accessories) and enter the commands (v4 variant):

Or for the v5 or v6 variants:

Or for the ClearSearch variant:

Then open the registry (Start->Run->regedit), find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Run and delete the 'WinStart' (v4), 'WinStart002' (v5), 'WinStart001.exe' (v6) or 'ClrSrcLoader' (ClearSearch) entry.

Reboot the machine and you can delete the BHO, rsp and Winstart files from the Windows\System folder, or in the ClearSearch variant, just delete the 'ClearSearch' folder in Program Files.

v5 may also leave behind an installer called Install_All.dll in this folder, which you can delete. This attempts to remove the v4 variant of IGetNet before installing, but also disables the address-bar-search features of other programs, including NewDotNet , Xupiter and TargetWord .

v6 may also leave behind files Update_Hosts.DLL, Update_com.DLL, Update_BHO.DLL, Update_RSP.DLL, Update_RemoveOld.DLL and rules.dat, which can also be deleted.

You can also delete the registry key HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Ie Rsp, (v4-v6 variants), or HKEY_LOCAL_MACHINE\SOFTWARE\CLRSCH (ClearSearch variant) to clean up if you like.

Next, find the Hosts file. This is called 'HOSTS' without a file extension (not Hosts.SAM); it is in the Windows folder on Windows 95/98/Me, or Windows\System32\drivers\etc\ on Windows NT/2000/XP. Open the file with a text editor (such as Notepad); if you have, or have previously had the v4-v6 variants, you will have these entries, which should be removed:

then save. (Sometimes the IP address on the left may be slightly different.)

More Removal Instructions for Adware/Spyware Programs - 'I'