MyWebSearch

[knightranger1]

i had a brain fart & let my sister download this progam called Zwinky well smiley central & mywebsearch toolbar came with it

last night i ran spybot & it found over 50 entries for MWS alone
so it had to go & i have it almost gone but everytime the computer starts up i get this
[IMG]http://img76.imageshack.us/img76/2001/untitled8pw.png[/IMG]

how do i get rid of it??
it didn't have an add/remove entry, or an unistall but, it did have a folder in program files(that i couldn't manually delete
spybot got rid of everything even the folder after a restart & doing autorun

Logfile of HijackThis v1.99.1
Scan saved at 4:33:15 PM, on 6/24/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\2Wire\Gateway\2PortalMon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe
C:\ITunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\NoAds\NoAds.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400005&utm_content=leftnav&utm_source=wdz&utm_medium=bund&utm_campaign=wdz0605
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.accoona.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.will-powered.com/rangerhood/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400005&utm_content=leftnav&utm_source=wdz&utm_medium=bund&utm_campaign=wdz0605
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.accoona.com/search?q=%s
R3 - Default URLSearchHook is missing
O2 - BHO: Zango Search Assistant Helper /fleok=1D8A83A5C5E315789FA575760EA83FA5EF80752B94E3D8765C794E2A3DC5 - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\program files\zango\zangohook.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Accoona Search Assistant - {944864A5-3916-46E2-96A9-A2E84F3F1208} - C:\Program Files\Accoona\ASearchAssist.dll
O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire\Gateway\2PortalMon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\ITunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\4.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [UserFaultCheck] C:\WINDOWS\system32\dumprep 0 -u
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\4.bin\mwsoemon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NoAds] "C:\Program Files\NoAds\NoAds.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\4.bin\mwsoemon.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJ
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ\ICQLite.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/244eb260f668147a5e18/netzip/RdxIE601.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab32651.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[tayspen]

First go to Start>Control Panel>Add\Remove programs, and uninstall any of the following.

1. smiley central
2. mywebsearch

Then Download HijackThis (current verison is v1.99.1)

or here (Alternate 1, a self-extracting zip file)
or here (Alternate 2, an *.exe file)

Make a new folder to put your HijackThis.exe into.

(Anywhere on your hard drive is fine other than your Desktop or the Temp folder. Suitable examples are:

• C:HijackThis
• C:Programshijackthis
• C:WindowsMy DocumentsHJT

but feel free to use any name.)

Extract and save the HijackThis download to the new folder you made. Then navigate to it and run HijackThis from there. (This is to ensure it makes the necessary backups for recovery if fixes are made) Then, doubleclick HijackThis.exe, and click Scan.

When the scan is finished, the "Scan" button will change into a "Save Log" button. Press that and copy & paste its contents in your reply. Most of what it lists will be harmless or even essential, don't try to fix anything yourself.

Thanks.

[klawrence]

Hello Knightranger1,

One of our engineers found this and forwarded it to me. For the record: The software is not adware or spyware. You don’t HAVE to uninstall it. That said, if you want to uninstall it, then here’s some advice which is derived from my personal experience with Spybot and our products:

Tayspen has the right idea - the best way to uninstall the application is through add/remove control panel. Using Spybot (as you have experienced) only causes further problems and prevents uninstalling completely.

The best way to handle this is to go back into Spybot, choose "Recovery" and recover only the following items:

FunWeb
FunWebProducts
Myway.MyWebSearch
MyWebSearch

Once it has completed recovering, go to the add/remove programs control panel, and select MyWebSearch (Zwinky), and click on remove. Then reboot - which will take care of everything (including registry entries that Spybot doesn't get).

Go ahead and run Spybot if you like to make sure, or use something a little better. I see Zango and a few other things in your log file, and while I'm no expert, a better program will help get rid of some of the other bits and pieces Spybot left behind (that have nothing to do with us).

Hope this helps,

Regards,
-Kirk

Kirk Lawrence
IAC Search & Media (owners of MyWebSearch/Zwinky/etc)

[computer_love]

Eh, I don't agree with that Kirk guy. It slowed my computer and made it retarded. So, after it "claimed" it had gotten rid of it, Spybot kept bringing up 4 Types of it in the registry keys. SO I got rid of it manually.

Pay CLOSE attention to this.

You know when you run Spybot? And it brings up those, like... 4 FunWebProducts?

Click it! And then it should bring up something that looks like.. "HKCU..." Remember the number that's by it something like, "S-1-5-19"
Go to run, type in "regedit"
Click the "HKCU.." or whatever.
Then click the numbers.
Click Microsoft. Then software.
Find FunWebProducts. DELETE IT. And.. find the rest of them and keep going. Okay?

It's completely off of my computer. My bad if I didn't explain it that well. =/

I explain things retarded, because i'm just a teenager. xD!

[klawrence]

Just to be clear (and I will only say this one more time), Spybot does not do a good job of removing our software. The best (and only) way to accurately remove our software is by using the Add/Remove Programs control panel.

-K

Kirk Lawrence
Director of Product Management
IAC Search & Media

[computer_love]

Yes, I know. And I did remove FunWebProducts by using Add/Remove Programs. But I still had some leftover things from it. And this is before I got Spybot. This had to be about.. 2 or 3 years ago, before I knew about Spybot. So, I understand where you're coming from, I just don't understand why there was things still left over, that I had to manually take off of my computer. I didn't know that they were still on here until I ran Spybot, about a month ago, and saw that it still wasn't off of my computer. I also ran HiJackThis along with Spybot, and it said that I still had it on my computer, though it wasn't on my browser. Can you explain that?

I had to write down where Spybot said it was at on my computer, go to the Registry Editor, and take all of it off myself.

[klawrence]

I'm not real familiar with the product from 2 or 3 years ago. But I can say with certainty that the uninstaller works as expected now. The only possible issue is that if files are still in use (e.g. a browser window is open) during the uninstall process, then the O/S cannot delete the file, and it is marked for deletion upon reboot. If you run a scan before rebooting in this case, then it might still detect the files that are marked for deletion. After rebooting, these files will be deleted.

-K

[kjranger]

Hello,
My daughter downloaded this Zwinky awhile back and while I thought it was cute and something for her to play with, I was being bombarded with Trojan viruses and Adware. It all pointed to this Websearch. I then got this message after rebooting saying something about m3skplay was missing and I probably needed to reinstall the program. At this time, I had not unstalled anything. I searched the web and found out that it was connected to websearch. I then got Ad-Aware and found like over a 1000 spyware all conected someway or another to websearch. Only about less than half were just cookies from other websites. This set me on this quest to unistall websearch which has now turned into an obsession.

My first attempt was thru the add/remove programs. I got a message that it was missing C:Progra~1\mywebs~1\bar|4.bin|mwsbar.dll. After searching the web agian, I found the HiJackThis program. Now I have the the message gone after rebooting but I still have the Zwinky still in the add/remove program and I can't seem to get rid of it no matter what I do.

Other that reinstalling the program, does anybody have any ideas how to get zwinky out of the add/remove program. I am also trying to avoid hacking the registry cause I don't really know what I am doing in there. Not a beginner, but I'm not a guru either.

[klawrence]

Other that reinstalling the program, does anybody have any ideas how to get zwinky out of the add/remove program. I am also trying to avoid hacking the registry cause I don't really know what I am doing in there. Not a beginner, but I'm not a guru either.

Actually, the cleanest way to uninstall (assuming your Anti-virus software doesn't interfere) is to reinstall the software, and then uninstall again. That will make sure all the little bits and pieces are cleaned up.

Alternatively, if you want to use our uninstall utility, it can be found here on our help pages:

http://smileycentral.custhelp.com/cgi-bin/smileycentral.cfg/php/enduser/std_adp.php?p_faqid=1417

Either way should work for you.

By the way, Zwinky is part of the MyWebSearch toolbar, which is *not* the "websearch" adware (although it is frequently confused as such). It's not adware nor spyware, and it doesn't pop ads or track online usage. It's a harmless browser toolbar that enables content such as Zwinky, SmileyCentral, Webfetti, and others.

Let me know if you have any problems with the above.

Regards,
-Kirk

[kjranger]

Hey klawrence,
I have tried that one. I'm thinking behind trying to get rid of this websearch, I now have a dirty registry with broken and orpan links and other bad stuff. I may reload zwinky just so I can get a cleaner unistall. Then look for a reg cleaner.

I did not know that. I knew that Zwinky was part of MyWebsearch, but I did not know that I have been dealing with 2 seperate things. I just assumed that since everytime my daughter got on Zwinky and my anti-virus went crazy, that everything was tied together. I feel like whatever I got was thru the Chat room with Zwinky. Spyware just pointed to funware and websearch.

[twisted99]

Just to be clear (and I will only say this one more time), Spybot does not do a good job of removing our software. The best (and only) way to accurately remove our software is by using the Add/Remove Programs control panel.

-K

Kirk Lawrence
Director of Product Management
IAC Search & Media

Tried it your way and it says "mycrapsearchblahblahblah removed" but it is still there.
You are a liar.

[jimmyooooo]

Just to be clear (and I will only say this one more time), Spybot does not do a good job of removing our software. The best (and only) way to accurately remove our software is by using the Add/Remove Programs control panel.

-K

Kirk Lawrence
Director of Product Management
IAC Search & Media

Kirk,

As an IT Professional that spends a significant amount of time dealing with your CRAPware, I respectfully ask you to stop lying. MyWebSearch/FunWebProducts/Zwinky/SmileyCentral are well documented as AdWare/MalWare (i.e. CRAPware). It's no coincidence that people who install your MyWebSearch based products start experiencing problems shortly thereafter.

Your uninstaller DOES NOT in fact do a complete uninstall, and as another poster stated, leaves a significant amount of garbage behind in the registry.

[Dragonf1re]

This MyWebsearch stuff also screwed up my PC and I did not download zwinky or any thing else mentioned - I also struggled to get rid of it, through add remove and all that but one thing that did help was MalwareBytes Antimalware. You get it from majorgeeks.com, it also removes a load of other junk that slows down and corrupts pcs.

[jholland1964]

While this thread is very old, 2 years in fact, I see that folks continue to post here. I will totally agree with Dragonf1re on MBA-M. We have a link right HERE on this very forum for this program.
It can also be downloaded directly from HERE which is the link given on the website of Malwarebytes.org the developer of this program.

[Virus Expert]

You are obviously lying Kirk because i have scanned all of your software and it found unwanted files potentially spyware all of your software is bad and quit posting ads there getting on my nerves

[Virus Expert]

mcafee found all files viruses/spyware ect.