1. TechSpot is dedicated to computer enthusiasts and power users. Ask a question and give support. Join the community here.
    TechSpot is dedicated to computer enthusiasts and power users.
    Ask a question and give support.
    Join the community here, it only takes a minute.
    Dismiss Notice

MyWebSearch has me  :-(

By scaffer
Oct 28, 2005
  1. Hello, Guru!

    MyWebSearch is living in my computer.
    Please, help me to turn out of house and home this infection.

    Thanks and best regards,
  2. Tedster

    Tedster Techspot old timer..... Posts: 6,000   +15

    MWSOEMON.EXE - MyWebSearch Spyware

    Mwsoemon.exe installs with a newer variant of the MyWebSearch spyware program. Generally, a browser helper object called mwsbar.dll will install at the same time.The toolbar does add search features but the search results you see will be hijacked to mywebsearch.com. WebSearch Toolbar is an Internet Explorer search toolbar that installs adware and spyware. WebSearch Toolbar changes your browser settings. This is a very high risk threat and should be removed immediately as to prevent harm to your computer or your privacy. Browser hijackers are malicious programs that change a user's web browser settings, usually altering designated default start and search pages. In addtion a browser hijacker can modify nearly every aspect of a web browser including adding bookmarks, and redirecting search traffic to alternative sites.

    * mwsoemon.exe - My Web Search Bar for Internet Explorer, email clients, and messenger clients.
    * mwsoestb.dll - My Web Search Plugin Loader

    MWSOEMON shown on the task manager ( Press Ctrl-Alt-Del ), then try to end the task of the process mwsoemon.

    Typical infected files locations:

    * c:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
    * c:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
    * c:\program files\mywebsearch\bar\2.bin\mwsbar.dll
    * c:\program files\mywebsearch\srchastt\2.bin\mwssrcas.dll

    Typical Infected folders:

    * c:\program files\mywebsearch
    * c:\program files\mywebsearch\bar
    * c:\program files\mywebsearch\srchastt
    * c:\program files\mywebsearch\bar\2.bin
    * c:\program files\mywebsearch\srchastt\2.bin

    Uninstall Myway MySpeedbar from Start Button : Control Panel > Add/Remove programs. It might be called 'My Search Bar', 'MyWay Speed Bar' or 'My Web Search Bar', Click 'Remove' for what you find. Also remove 'Fun Web Products Easy Installer' if it is present.

    Registry (Hijackthis analsysis) Entries made by MWSOEMON:

    * O2 - BHO: Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\PROGRAM FILES\HOTBAR\BIN\\HBHOSTIE.DLL
    * O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
    * O3 - Toolbar: &Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\PROGRAM FILES\HOTBAR\BIN\\HBHOSTIE.DLL
    * O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
    * O4 - HKLM\..\Run: [Hotbar] C:\PROGRAM FILES\HOTBAR\BIN\\HBINST.EXE /Upgrade

    If not you can remove them manually by running Regedit and find MWSOEMON and delete the key. Try searching for LSvr; LTDMgr; websearch; WebSearch Email Plugin. Or 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run' and delete the values called 'WebSavingsfromEbates', 'websearch' and 'couponsandoffers'.

    Restart computer.

    Use the Find (Start Button : Search) and locate file MWSOEMON.EXE and delete it. Try to locate and delete websearch1.exe; MWSOEMON.EXE; MWSSRCAS.DLL; Toolbar.dll.

    Browse your computer c: drive "Program Files\mywebsearch\" folder and remove it.

    HijackThis is a useful tool, that lists all installed browser add-on, buttons, startup items and allows you to inspect, and optionally remove selected items. The program can create a backup of your original settings and also ignore selected items. Additional features include a simple list of all startup items, default start page, online updates and more. Intended for advanced users.

    Download HijackThis

    Background : WebSavings is installed from the vendors site or when installing other applications, such as the Morpheus file sharing program. Installation of Web Savings From Ebates Software. WebSavings is a shopping tool that open pop-up windows. It can also uninstall other software components that interfere with WebSavings.
  3. scaffer

    scaffer TS Rookie Topic Starter

    Thanks a lot!
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...