Nosta Solutions – Hardware, Gaming, News, Reviews

What exactly is MyWebSearch?  It is categorized as a Spyware/Adware/Trojan.  Basically, it installs 3rd party software such as Smiley Central (software which installs lots of different emoticons), PopSwatter (A weak pop-up blocker), “Fun Tools” (????), My Info, My Button, Games, Cursor Mania (software which installs a lot of different cursors), My Mail Signature, WebFetti, Popular ScreenSavers, and more to your computer.  Maybe you are thinking, hey thats neat, I can spice up my work PC a little bit…  And that is exactly how it has spread faster than most other malicious programs in the workplace.  In fact, I have had to remove this from over 10 clients office PC’s within the last 5 business days.  The average number of infected files on the victims PC is around 150-400, depending on how long it has been installed, and how often it is used.  Obviously the more infected files, the more of a performance decrease the victim will see.  In most cases based on my experience with this nasty little piece of software, the user continued to use their PC even with a large performance hit until it became so bad that it starts freezing up their Outlook and they can no longer access their work email.  In these cases, it will cause Outlook to freeze up completely, and if you try to launch it again Outlook forces itself into safe-mode and winds up hanging up and not starting at all, rendering the PC basically useless.

What does MyWebSearch claim to be?  Here is a quote from their website:

“What is the My Web Search toolbar?
The My Web Search toolbar is a tremendously powerful and totally customizable toolbar that installs directly onto your Web browser. Its design allows you to:

• Search from anywhere on the Web using the Internet’s leading search providers (Google, Yahoo!, Ask.com and LookSmart)
• Add free “cool tools” such as PopSwatter (pop-up blocker), Smiley Central (10,000+ smileys), Popular Screensavers (7,000+ photos) and Cursor Mania (7,500+ cursors)
• Get personalized news, sports, weather, money and daily tidbits via the My Info button

You also have the ability to create your own toolbar buttons and add up to 200 of your own personalized links, while enjoying one-click access to the many areas of the My Way site – all with no banner ads, pop-ups or privacy concerns.

The My Web Search toolbar is free to download and free to use.”

—–

The underlined feature above is third party software which is one of the ways this company gets paid, in case you were wondering.

The following is an exclusive test in which I installed a Windows XP Pro Virtual Machine specifically to infect with MyWebSearch to see the extent of the damage caused by it.  After infecting my clean OS with this malicious software, I will explain in detail what their threat ratings are, and how to completely remove this nasty software from your computer.

So if you have this BHO/adware/Trojan here is what you will need:

1. MalwareBytes
2. CCleaner (During install you may want to uncheck Yahoo Toolbar)
   
3. HiJack This (option for more advanced users)

First I started with a Completely fresh install of Windows XP Pro x64.  The operating system isnt important with tools 1 and 2.  For kicks I ran a scan with updated MalwareBytes before installing any software on this Virtual Machine, and 1 threat was detected, which was a false positive called “Hijack.Display.Properties”, which is nothing to worry about, usually some sort of active desktop configuration.  If that comes up as a result, you can simply uncheck it when being asked to remove checked items.

—–

Installation of MyWebSearch Toolbar (NOT RECOMMENDED lol)

Once I clicked to download/install the toolbar, the license terms and privacy policy window appeared.  At the bottom of this Agreement is a checkbox to give you the option to make Ask.com your default search providerand have the latest product updates installed on your computer automatically (I DONT LIKE IT ALREADY!).

I agree to the terms and continue to the next step, and at the top of IE I get the yellow bar explaining that I have to install an ActiveX control to install the toolbar (ActiveX controls can be bad).  I click the bar and select install ActiveX control.  Next I get a dialog box asking me if I want to install the My Web Search, Search Assistant, and Easy Installe… from the publisher Fun Web Products.  I select Install.

Next I get a progress bar with installation progress.  It reaches 100% and I get a webpage that says “That’s it! Click the button below to get started.”

I click the button…

I get a thank you webpage (thanks for letting us use you to make money) and a notification that I should see my new shiny toolbar below the address bar in IE.

Keep in mind, I had NOTHING installed on this computer before installing this toolbar.

At this point, I am in your shoes if you are reading this to find out how to remove it.

—–

REMOVAL INSTRUCTIONS

At this point, you should have downloaded, installed, and updated the tools I mentioned earlier.

1. Launch MalwareBytes.
2. Make sure no other programs are running.
3. Perform a Full System Scan. (This could take a while depending on how long you have had your computer and how many programs / users are on your computer)
4. Once the scan is complete you will see how many infected files you have, which will vary from user to user. (Feel free to post a reply with how many infected files your computer had!)
5. Click Show Results at the bottom right of MalwareBytes window.
6. Amongst these results you will definitely see Adware.MyWebSearch registry keys and files, Adware.MyWeb registry keys and files, Adware.MyWay registry keys and files, Adware.Hotbar registry values, Adware.FunWeb files, and a nasty little one that infects your memory called Trojan.Vundo registry keys.  These are all associated with MyWebSearch toolbar.
7. Make sure they are all selected, by default they will be.
8. Click remove selected.
9. A log file will pop up as a text document giving detailed information about what malicious software was installed and removed, what it affected, etc.  Close the log file.
10. You will be prompted with a dialog box stating “All items removed successfully.” and that a restart is required to complete the removal process.
11. Restart your computer. (It might take slightly longer to restart this time)
12. Once your computer is back into windows, you might get an error message that reads something like this: “Error loading C:\PROGRA~2\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL.  The specified module could not be found.”  Don’t worry, this is a good error message.  Click OK as many times as an error message appears.
13. Now launch tool #2 from earlier, CCleaner.
14. On the left side of the CCleaner window you will see Cleaner, Registry, and Tools above the Options.  Click on Registry first.
15. Leaving everything checked, click Scan for Issues.
16. You will see numerous objects after scanning for issues.  If you are somewhat knowledgable of computers, you can uncheck things you know are not problems.  If you are not sure, dont uncheck things.
17. DO NOT SKIP THE NEXT STEP!
18. IMPORTANT:  Once you click Fix selected issues you will be prompted with a dialog box asking if you would like to create a backup of your registry.  PLEASE CLICK YES!!!
19. It will save the backup to your “My Documents” folder, you can leave the name it automatically fills out, just click OK.
20. Now you will get a blue and white window come up, click Fix All Selected Issues.  Are you sure?  OK.
21. Issues Fixed, click close.
22. Now you can click on Cleaner to the left of CCleaner to clear out all the tracking information the toolbar put on your PC.
23. Just leave the defaults checked and click Analyze and Run Cleaner.
24. BOOM!  MyWebSearch and Fun Software from hell have been removed.

Please, be cautios of what you download everyone.  If you dont NEED it, dont download it.

NOTE: When I ran my full scan, I went from 0 to 244 infected files just by installing this toolbar.

I give this software a threat rating of 7/10 because of how many files it infects, how many people have downloaded and installed it not knowing the consequences, the fact that it installs a known Trojan and can steal personal information and possibly a key-logger on your system, how much of a performance decrease I have experienced with it, and the overall frustration it has caused users.  I would have given it an 8 if it wasnt for the fact that it is pretty simple to get rid of using the right tools.

The replies are open for discussion.  Enjoy!

Popularity: 4% [?]