Posted by Hemal in Security
I have this entry: O4 – HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
It makes rundll32.exe “look and run” this dll at windows startup. This my web search bar was malicious and so I deleted it. Then I came into hijackthis to complete the removal and it won’t remove.? It also gives me a weird error message on start up that won’t go away.? How do I remove this?!
This problem is pretty simple and can be fixed with a couple tools and built in features of Windows.? HijackThis cannot completely remove it on its own as the infection has some files stored in a folder on your computer that keep it coming back.? Try the proposed fix below and you should be free of the error message and infection soon!
Please click on Start > Control Panel > Add/Remove Programs and uninstall the following programs(if present): MyWebSearch, MyWebSA or MyWebs*
Please set your system to show all files; please see here if you’re unsure how to do this.
Please delete these folders (if present) using Windows Explorer:
You can reopen HijackThis and remove the O4 – HKLM\..\Run: [MY WEB SEARCH BAR] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S key and then run a program like CCleaner.
I recommend after you do this, do a scan with Malwarebytes? Anti-Malware .
Reboot and you should be free of this infection and should not see any error message at startup!