OptionUnloadShell

ProcessKill \MWSOEMON.EXE|1 
ProcessKill \MWSSETUP.EXE|1 
ProcessKill \MWSSRCSP.EXE|1 
ProcessKill \TeaTimer.exe|1
ProcessKill \sgmain.exe|1
ProcessKill \SGBHP.EXE|1
ProcessKill \WINPATROL.EXE|1
ProcessKill \AAWService.exe|1
ProcessKill \AAWTray.exe|1
ProcessKill \MSASCui.exe|1
ProcessKill \pctsTray.exe|1
ProcessKill \pctsAuxs.exe|1
ProcessKill \pctsSvc.exe|1
ProcessKill \mbamgui.exe|1
ProcessKill \mbamservice.exe|1
ProcessKill \mbam.exe|1
ProcessKill \SUPERAntiSpyware.exe|1
ProcessKill \firefox.exe|1
ProcessKill \iexplore.exe|1

# Services to be deleted

ServiceStop MyWebSearchService
ServiceDelete MyWebSearchService


# Unregister Dlls

DllUnregister \ebkp.dll|1
DllUnregister \mwsbar.dll|1
DllUnregister \toolbar.dll|1
DllUnregister \s4ezsetp.dll|1
DllUnregister \pagerevisor.dll|1
DllUnregister \mybar.dll|1
DllUnregister \mysrchas.dll|1
DllUnregister \npmysrch.dll|1
DllUnregister \s4bar.dll|1
DllUnregister \s4plugin.dll|1
DllUnregister \s4popswt.dll|1
DllUnregister \s4ezsetp.dll|1
DllUnregister \msimg32.dll|1
DllUnregister \f3brovly.dll|1
DllUnregister %PROGRAMFILES%\wingames\iehelper.dll|1
DllUnregister %PROGRAMFILES%\wingames\iehelper.dll|1
DllUnregister %PROGRAMFILES%\mozilla firefox\plugins\NPMyWebS.dll
DllUnregister %PROGRAMFILES%\MSN Messenger\msimg32.dll 
DllUnregister %PROGRAMFILES%\MSN Messenger\riched20.dll
DllUnregister %PROGRAMFILES%\Internet Explorer\msimg32.dll


# Files and folders to be deleted

FolderDelete %APPDATA%\FunWebProducts
FileDelete %SYSDIR%\f3PSSavr.scr
FileDelete %ProgramFiles%\Uninstall Fun Web Products.dll 
FileDelete %ProgramFiles%\Internet Explorer\msimg32.dll 
FolderDelete %PROGRAMFILES%\MyWebSearch
FolderDelete %PROGRAMFILES%\MYWEBS~1
FileDelete \f3PSSavr.scr
FolderDelete %PROGRAMFILES%\toolbar
FileDelete \9bb71.exe
FileDelete \ebkp.dll
FileDelete \m3slsrch.exe
FileDelete \m3srchmn.exe
FileDelete \mgssetp.exe
FileDelete \mwsbar.dll
FileDelete \soref_rgbndl.exe
FileDelete \toolbar.dll
FolderDelete %PROGRAMFILES%\MySearch
FileDelete \s4ezsetp.dll
FileDelete \pagerevisor.dll
FileDelete \mybar.dll
FileDelete \adinstalle.exe
FileDelete \aj[1].exe
FileDelete \files.ini
FileDelete \mybar.dll
FileDelete \mysearchpluginproxy.class
FileDelete \mysrchas.dll
FileDelete \npmysrch.dll
FileDelete \pagerevisor.dll
FileDelete \partner.dat
FileDelete \s42ns.exe
FileDelete \s4bar.dll
FileDelete \s4ezsetp.dll
FileDelete \s4plugin.dll
FileDelete \s4popswt.dll
FileDelete \s4sept.exe
FileDelete \soproc.exe
FileDelete \vt.adware.toolbar.myway.f-f62d8517208d03dc2e890fc97c0122e7.exe
FileDelete \s4ezsetp.dll
FileDelete \pagerevisor.dll
FileDelete \mybar.dll
FileDelete \aj[1].exe
FileDelete \adinstalle.exe
FileDelete \vt.adware.toolbar.myway.f-f62d8517208d03dc2e890fc97c0122e7.exe
FileDelete \soproc.exe
FileDelete \s4sept.exe
FileDelete \S4PLUGIN.DLL
FileDelete \S4BAR.DLL
FileDelete \S4EZSETP.DLL
FileDelete \NPMYSRCH.DLL
FolderDelete %PROGRAMFILES%\FunWebProducts
FileDelete \f3brovly.dll
FileDelete %PROGRAMFILES%\wingames\iehelper.dll
FileDelete %PROGRAMFILES%\wingames\wingames.dll
FileDelete %PROGRAMFILES%\mozilla firefox\plugins\NPMyWebS.dll
FileDelete %PROGRAMFILES%\MSN Messenger\msimg32.dll 
FileDelete %PROGRAMFILES%\MSN Messenger\riched20.dll
FileDelete %PROGRAMFILES%\Internet Explorer\msimg32.dll

# Registry keys to be deleted


RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.DataControl.1
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.DataControl
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.HistoryKillerScheduler.1
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.HistoryKillerScheduler
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.HistorySwatterControlBar.1
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.HistorySwatterControlBar
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.HTMLMenu.1
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.HTMLMenu.2
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.HTMLMenu
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.IECookiesManager.1
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.IECookiesManager
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.KillerObjManager.1
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.KillerObjManager
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterBarButton.1
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterBarButton
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterSettingsControl.1
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterSettingsControl
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.ShellViewControl.1
RegDeleteKey HKLM\SOFTWARE\Classes\FunWebProducts.ShellViewControl
RegDeleteKey HKLM\SOFTWARE\Classes\MyWebSearch.HTMLPanel.1
RegDeleteKey HKLM\SOFTWARE\Classes\MyWebSearch.HTMLPanel
RegDeleteKey HKLM\SOFTWARE\Classes\MyWebSearch.OutlookAddin.1
RegDeleteKey HKLM\SOFTWARE\Classes\MyWebSearch.OutlookAddin
RegDeleteKey HKLM\SOFTWARE\Classes\MyWebSearch.PseudoTransparentPlugin.1
RegDeleteKey HKLM\SOFTWARE\Classes\MyWebSearch.PseudoTransparentPlugin
RegDeleteKey HKLM\SOFTWARE\FocusInteractive
RegDeleteKey HKLM\SOFTWARE\Fun Web Products
RegDeleteKey HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin
RegDeleteKey HKLM\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall
RegDeleteKey HKLM\SOFTWARE\MyWebSearch
RegDeleteKey HKLM\SYSTEM\CurrentControlSet\Services\MyWebSearchService
RegDeleteKey HKLM\SOFTWARE\MySearch
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows Media\WMSDK\sources\f3PopularScreensavers
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall
RegDeleteKey HKLM\software\microsoft\code store database\distribution units\{58f0b492-a42e-435a-bcbf-c6b2608077ba}\contains 
RegDeleteKey HKLM\software\microsoft\internet explorer\toolbar {014da6c9-189f-421a-88cd-07cfe51cff10}
RegDeleteKey HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{014da6c1-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKLM\software\microsoft\windows\currentversion\uninstall\my search uninstall 
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{2EFF3CF7-99C1-4c29-BC2B-68E057E22340}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
RegDeleteKey HKLM\SOFTWARE\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
RegDeleteKey HKCR\MyWebSearchToolBar.ToolbarPlugin.1
RegDeleteKey HKCR\MyWebSearchToolBar.ToolbarPlugin
RegDeleteKey HKCR\clsid\{014da6ca-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKCR\clsid\{014da6cc-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKCR\clsid\{014da6c0-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKCR\clsid\{85204a50-6997-4543-9ff8-d9bbcb9108f5} 
RegDeleteKey HKCR\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
RegDeleteKey HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
RegDeleteKey HKCR\clsid\{014da6c1-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKCR\clsid\{014da6c5-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKCR\clsid\{014da6c7-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKCR\clsid\{014da6cb-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKCR\clsid\{014da6ce-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKCR\clsid\{04079856-5845-4dea-848c-3ecd647aa554} 
RegDeleteKey HKCR\clsid\{2cb71122-a917-44c1-ad6c-0573fb63803e} 
RegDeleteKey HKCR\clsid\{fac94900-96d9-47fa-ba33-7ef1bbfbbcec} 
RegDeleteKey HKCR\interface\{014da6ca-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKCR\interface\{014da6cc-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKCR\mysearch.popswatterbarbutton 
RegDeleteKey HKCR\mysearch.popswatterbarbutton.1 
RegDeleteKey HKCR\mysearch.popswatterbarbutton.1\clsid 
RegDeleteKey HKCR\mysearch.popswatterbarbutton\clsid 
RegDeleteKey HKCR\mysearch.popswatterbarbutton\curver 
RegDeleteKey HKCR\mysearch.popswattersettingscontrol 
RegDeleteKey HKCR\mysearch.popswattersettingscontrol.1 
RegDeleteKey HKCR\mysearchtoolbar.netscapeshutdown 
RegDeleteKey HKCR\mysearchtoolbar.netscapeshutdown.1 
RegDeleteKey HKCR\mysearchtoolbar.netscapestartup 
RegDeleteKey HKCR\mysearchtoolbar.netscapestartup.1 
RegDeleteKey HKCR\mysearchtoolbar.netscapestartup\curver 
RegDeleteKey HKCR\mysearchtoolbar.settingsplugin 
RegDeleteKey HKCR\mysearchtoolbar.settingsplugin.1 
RegDeleteKey HKCR\mysearchtoolbar.settingsplugin\clsid 
RegDeleteKey HKCR\typelib\{014da6c0-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKCR\typelib\{85204a50-6997-4543-9ff8-d9bbcb9108f5} 
RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Run|MyWebSearch Email Plugin
RegDeleteKey HKCU\software\microsoft\internet explorer\menuext\web rebates. 
RegDeleteKey HKCU\software\microsoft\internet explorer\new windows\allow www.mysearch.com
RegDeleteKey HKCU\software\microsoft\internet explorer\toolbar\webbrowser {014da6c9-189f-421a-88cd-07cfe51cff10}
RegDeleteKey HKCU\software\microsoft\internet explorer\urlsearchhooks {04079856-5845-4dea-848c-3ecd647aa554}
RegDeleteKey HKCU\software\microsoft\windows\currentversion\ext\stats\{014da6c1-189f-421a-88cd-07cfe51cff10} 
RegDeleteKey HKCU\software\microsoft\windows\currentversion\ext\stats\{58f0b492-a42e-435a-bcbf-c6b2608077ba} 
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|My Web Search Bar
RegDeleteKey HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Search
RegDeleteKey HKCR\FunWebProducts.DataControl.1
RegDeleteKey HKCR\FunWebProducts.DataControl
RegDeleteKey HKCR\FunWebProducts.HistoryKillerScheduler.1
RegDeleteKey HKCR\FunWebProducts.HistoryKillerScheduler
RegDeleteKey HKCR\FunWebProducts.HistorySwatterControlBar.1
RegDeleteKey HKCR\FunWebProducts.HistorySwatterControlBar
RegDeleteKey HKCR\FunWebProducts.HTMLMenu.1
RegDeleteKey HKCR\FunWebProducts.HTMLMenu
RegDeleteKey HKCR\FunWebProducts.HTMLMenu.2
RegDeleteKey HKCR\FunWebProducts.IECookiesManager.1
RegDeleteKey HKCR\FunWebProducts.IECookiesManager
RegDeleteKey HKCR\FunWebProducts.KillerObjManager.1
RegDeleteKey HKCR\FunWebProducts.KillerObjManager
RegDeleteKey HKCR\FunWebProducts.KillerObjManager
RegDeleteKey HKCR\FunWebProducts.PopSwatterBarButton.1
RegDeleteKey HKCR\FunWebProducts.PopSwatterBarButton
RegDeleteKey HKCR\FunWebProducts.PopSwatterSettingsControl.1
RegDeleteKey HKCR\FunWebProducts.PopSwatterSettingsControl
RegDeleteKey HKCR\FunWebProducts.ShellViewControl.1
RegDeleteKey HKCR\FunWebProducts.ShellViewControl
RegDeleteKey HKCR\ScreenSaverControl.ScreenSaverInstaller.1
RegDeleteKey HKCR\ScreenSaverControl.ScreenSaverInstaller
RegDeleteKey HKLM\SOFTWARE\Fun Web Products
RegDeleteKey HKLM\SOFTWARE\FunWebProducts
RegSetStringValue HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.dat|ReplaceApps|*.*
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.dat|Permissions|00000001
RegSetDwordValue HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.dat|Runtime|00000007
RegDelValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|MyWebSearch Email Plugin
RegDelValue HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{00A6FAF6-072E-44cf-8957-5838F569A31D}
RegDeleteKey HKCR\Interface\{2763e333-b168-41a0-a112-d35f96f410c0}
RegDeleteKey HKCR\clsid\{2763e333-b168-41a0-a112-d35f96f410c0} 
RegDeleteKey HKCR\MIME\Database\Content Type\application/x-f3embed
RegDeleteKey HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
RegDeleteKey HKCU\SOFTWARE\MyWebSearch
RegDeleteKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts 



# Heuristics

FileMoveIfContainsText \MyWeb*.exe
FileMoveIfContainsText \FunWeb*.exe
FileMoveIfContainsText \MyWeb*.dll
FileMoveIfContainsText \FunWeb*.dll


# Miscellaneous

OptionUseRecycleBin
SystemEmptyInternetCache
SystemEmptyTempFolder
SystemEmptyRecycleBin
OptionOnDeleteFailUseReboot
OptionSaveLog %DESKTOP%\BFUlog.txt
SystemRestartIfNeeded