smartsearch removal

[Pieter_Arntz]

Research and fixes by Mosaic1 (http://www.wilderssecurity.com/index.php?board=;action=viewprofile;user=Mosaic1).

These will remove the startup for the file which is putting this back in place.

Windows 2000 and XP

Copy the contents of the Quote Box to Notepad. Name the file go away.reg
Save as all files.
Double click on go away.reg to enter into the registry.

{QUOTE->
Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\CLSID\{3F143C3A-1457-6CCA-03A7-7AA23B61E40F}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{3F143C3A-1457-6CCA-03A7-7AA 23B61E40F}"=-
<-QUOTE}

Restart the Computer
Once back in Windows.
Delete these two files from system32.
mtwirl32.dll and mtwcnl32.dll


Windows 95, 98 and ME

Copy the contents of the Quote Box to Notepad.
Name the file go away.reg
Save as all files.
Double click on go away.reg to enter into the registry.

{QUOTE->
REGEDIT4

[-HKEY_CLASSES_ROOT\CLSID\{3F143C3A-1457-6CCA-03A7-7AA23B61E40F}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

"DDE Control Module"=-
<-QUOTE}

Restart the Computer
Once back in Windows delete these two files from the Windows\system Folder

mtwirl32.dll and mtwcnl32.dll

In HijackThis 1.98.0 these will be shown as:

O21 - SSODL: DDE Control Module - {3F143C3A-1457-6CCA-03A7-7AA23B61E40F} - (no file)

Fixing that entry will have the same effect as using the regfiles I posted above.