KeenValue Description:

KeenValue is adware operated by eUniverse.com.

KeenValue/v1 , original version, consisting of a single process (keenvalue.exe) run at startup, which spawns pop-ups. This variant cannot

KeenValue/Incredifind adds a second process, kwm.exe, to monitor web sites viewed for ad targeting. It also includes a hosts-file hijacker redirecting Netscape Search to incredifind.com, an address-bar-search and error-page hijacker pointed at incredifind.com (redirecting to sirsearch.com), and an Internet Explorer toolbar providing a search field pointed at sirsearch.com.

(The PowerSearch toolbar is a customised version of Visicom Media's 慏ynamic Toolbar', other variants of which are not known to be parasitic.)

The software's terms claim it may send all URLs viewed to its controllers. This behaviour has not been observed to happen in current versions of the software. In the Incredifind variant, the error hijack feature does leak some trackable information on pages viewed.

Also known as: EUniverse, IncrediFind

KeenValue Automatic Removal:

Using Spyware Doctor to detect and remove KeenValue AUTOMATICALLY!

KeenValue Manual Removal:

The v1 variant may be removed from the Control Panel's Add/Remove Programs feature. Choose 'KeenValue' and click 'Remove'.

The Incredifind variant can be partially removed using the 'KeenValue' and 'PowerSearch toolbar for IE' entries in Add/Remove Programs, if an internet connection is present.

For the Incredifind variant, open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands:

Next, for either variant, open the registry (click 'Start', choose 'Run' and enter 'regedit') and find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Remove the 'KeenValue' entry. You can also delete the following keys to clean up, if you wish:

(Also the 'KeenValue' and 'PowerSearch' keys from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall can be deleted if you still have them.)

Next, restart your computer and you should be able to delete the 'KeenValue' folder inside the Program Files\Common Files folder. For the Incredifind variant you can also delete the Program Files folders 'PowerSearch', 'Incredifind' and 'Dynamic Toolbar\PWRS0RBI'.

Finally, restore your search settings (Internet Options->Programs->Reset Web Settings), and remove the Hosts file hijack: open the System folder (which is inside the Windows folder, and called 'System32' on Windows NT, 2000 and XP), go to 'drivers'->'etc', and load the file 'hosts' (with no file extension) into a text editor. Delete the following line and save.

More Removal Instructions for Adware/Spyware Programs - 'K'