Category Archives: Identification

For any given product, listings of autoplays and startupware entries.

SmileyCentral review

Identification

Product Review–SmileyCentral (Ask Jeeves, Inc.)

Test run July 21, 2005, default settings on clean install of Windows XP Home, OEM edition. Unpatched, no service packs, antivirus, or blocking software. Hardware firewall was the only security in place.

Version tested: No version number, but copyright date in the license is June 1, 2005. Also known as FunWebProducts.

Summary: Claims not to be adware or spyware, and I saw no indications to indicate that this is anything more than some cute buttons and icons, plus lots of settings changes relating to search functions. The apparent revenue model for the free product is that it directs your searches to AskJeeves.com, where they make money on sponsored ads.

Recommendation, Business systems: Remove–serves no business purpose, has no warranty, and may add to network traffic.

Recommendation, Personal systems: Mostly harmless.

LICENSE
=======
Under section 2, License conditions–the program phones home for updates:

“We may require the updating of the Software on your computer when we release a new version of the Software, or when we make new features available. This update may occur automatically or through other means and may occur all at once or over multiple sessions.”

INSTALLATION
============

Added to running files:
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

System settings changes, according to HijackThis:

R3 – URLSearchHook: (no name) – {00A6FAF6-072E-44cf-8957-5838F569A31D} – C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

O2 – BHO: MyWebSearch Search Assistant BHO – {00A6FAF1-072E-44cf-8957-5838F569A31D} – C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

O2 – BHO: mwsBar BHO – {07B18EA1-A523-4961-B6BB-170DE4475CCA} – C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL

O4 – HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

O4 – HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

O4 – Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O4 – Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O8 – Extra context menu item: &Search – http://bar.mywebsearch.com/menusearch.html?p=ZNxdm824YYUS

O16 – DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} – http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/SmileyCentralFWBInitialSetup1.0.0.8-2.cab

UNINSTALL
=========

Listed in Add/Remove programs as “My Web Search (SmileyCentral). Uninstall requires reboot.

These settings were left behind:

O16 – DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} – http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/SmileyCentralFWBInitialSetup1.0.0.8-2.cab

Left behind read-only folder C:\Program Files\FunWebProducts, containing 2 files, 3 folders. The custom icon selected as a cursor was also left behind.

No shortcuts were left behind.

REINSTALL TEST
==============

No problems. Worked same as the first install. The second uninstall failed at reboot, with a ‘RUNDLL’ error box: “Error loading C:\PROGRA~1\UNINST~1.DLL. The specified module could not be found.” Message did not appear on subsequent reboot.

POST-MORTEM
===========

Surprise, surprise. There are so many ads for this product that I just expected the worst. But it’s clearly not that. Definitely a lightweight, and some home users may enjoy it.

You have been Updated

Identification

Yup, that’s what’s on screen this morning. I’ve been Updated, and there is this always-on-top message asking me to click on “Update”. Somehow or another, Viewpoint Media Player slipped past a fully-patched Win 2000 Pro setup with blocking in place on the autoplay settings. The product claims to send non-personally-identifiable information back to a server in order to run a toolbar, and online research claims that it hijacks search results. There’s no toolbar here, so I’ll guess I saw the very first message. AdAware and SpybotSD don’t identify it as a threat.

It doesn’t play fair. I can highlight the license agreement, but it won’t let me copy it. Same on a ‘Who is viewpoint?’ entry. Well, I did capture the main window as a jpg. As adware goes (if that’s all it is), it’s pretty tame. I had no trouble removing it by killing the process viewmgr.exe, running the Viewpoint uninstall, and cleaning out two related files from the temporary files folder. I’m curious how it got past my blocks.

Virgin Windows Report–Win XP Home, SP2 OEM

Definitions, Identification

Just finished building a new box for a client. Took the opportunity to grab the task list. The list below is what Windows Task Manager reported as running processes immediately after installation, after hardware detection, but before any drivers were installed. No patches, no antivirus, no software installs of any kind, no exposure to the internet, or even to a CDROM other than Windows itself.

OS version: Windows XP, Service Pack 2, OEM edition
Motherboard: MSI M8M Neo-V, with AMD Sempron 2800+ processor.
Any hardware support below, if any, was autodetected during install–no software or driver installs had been run when this process list was captured:

alg.exe
csr.exe
Explorer.EXE
lsass.EXE
msiexec.exe
services.exe
smss.exe
svchost.exe (5 instances running)
System
System Idle Process
taskmgr.exe
winlogon.exe
wmiprvse.exe
wpabaln.exe
wuaudit.exe

As I (or others), build more systems, we’ll post more of these “Virgin Windows Task Lists”.

I didn’t have a chance to grab a HijackThis log of the box in this condition, but that I will next time, and get a more complete picture of just what is part of the default configuration.