I have this entry: O4 – HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S

It makes rundll32.exe “look and run” this dll at windows startup. This my web search bar was malicious and so I deleted it. Then I came into hijackthis to complete the removal and it won’t remove.  It also gives me a weird error message on start up that won’t go away.  How do I remove this?!

This problem is pretty simple and can be fixed with a couple tools and built in features of Windows.  HijackThis cannot completely remove it on its own as the infection has some files stored in a folder on your computer that keep it coming back.  Try the proposed fix below and you should be free of the error message and infection soon!

Please click on Start > Control Panel > Add/Remove Programs and uninstall the following programs(if present): MyWebSearch, MyWebSA or MyWebs*

Next,

Please set your system to show all files; please see here if you’re unsure how to do this.

Please delete these folders (if present) using Windows Explorer:

C:\PROGRA~1\MYWEBS~1\

You can reopen HijackThis and remove the O4 – HKLM\..\Run: [MY WEB SEARCH BAR] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S key and then run a program like CCleaner.

I recommend after you do this, do a scan with Malwarebytes’ Anti-Malware .

  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select “Perform Quick Scan”, then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. (You may need this for a later post on the forums!)

Reboot and you should be free of this infection and should not see any error message at startup!

Related Posts