NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Smiley Central Removal

Overview:
This provides you with various smilies that you can add to your emails and IM's. This is a part of the Fun Web Products line which includes Cursor Mania, My Mail Stationary, My Mail Signature, PopSwatter, and Popular Screensavers.

They are installed through Internet Explorer. After installing it I found these lines added in HijackThis:

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - D:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - D:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - D:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - Startup: MyWebSearch Email Plugin.lnk = D:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = D:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/SmileyCentralFWBInitialSetup1.0.0.8-2.cab

I believe this application should always be removed since they can noticeably slow your system down and they track your usage.

Removal:
In add/remove programs you'll find an item called My Web Search (Smiley Central) and it seems to do a good job of removing itself. The main thing the uninstaller misses is a couple of folders. Program Files/FunWebProducts and Program Files/MyWebSearch. After that doublecheck using HJT to make sure all of the items listed above have been cleared.

Search your registry for any items that say Fun Web Products and remove them. The combination of spybot and adaware should catch most of them if you'd like something a bit easier.

End Processes (may or may not exist):
mwsoemon.exe

Unregister DLLs:
Tip: this is only a list of known files/locations. You will want to do a search by the name of the file to see if they're on your system.
A while back I wrote a guide to Register/remove DLL or AX files which you will need if you don't know how to unregister these files.

Each file is in several locations so you'll need to search for them and unregister + delete them in every location you find.

MWSSRCAS.DLL
MWSBAR.DLL

Clean your Registry:

You should be back to normal IF this was your only problem. I suggest you post in our HJT forum since its not likely that this is your only bug. Read this first