CLEAN INSTRUCTION

1. Restart the computer in Safe Mode.

2. Open Windows Explorer, locate the C:\Program Files\MyWebSearch folder and delete it, along with its contents.

3. Locate and delete the following file: C:\Windows\system32\f3PSSavr.scr.

4. Go to Start > Run, type regedit and press OK.

5. Go to Edit > Find... and type:

{07B18EA9-A523-4961-B6BB-170DE4475CCA}

then press Find Next. Delete every entry that appeares with the above value.

Repeat the same step for the following values:

{07B18EA1-A523-4961-B6BB-170DE4475CCA} and
{00A6FAF1-072E-44cf-8957-5838F569A31D}

6. Also, locate and delete the following registry keys:

HKEY_LOCAL_MACHINE\Software\MyWebSearch and

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MWSOEMON
(and any other key that has a refference to the C:\Program Files\MyWebSearch folder)

7. Restart the system and run a full scan with BullGuard.

SYMPTOMS

1. Increased network traffic.

2. Browser settings are modified.

3. Increased number of pop-ups may appear.

DESCRIPTION

1. This is a browser toolbar for Internet Explorer.

2. When it is run, a process named mwsoemon.exe will appear in the Task Manager process list.

3. It will create several registry keys and it will also set itself to automatically run at startup.

Author:
The BullGuard Team