Can't remove / uninstall MyWebSearch?, Part 2

Last week, Infopackets Reader Cospul warned me of a problem he had with a browser enhancement, called MyWebSearch:

" I downloaded and installed [the browser plug-in] only to find out that it hijacked my Internet Explorer ... Whatever [web site I visit, MyWebSearch either displays their site or an error message].

... I emailed the Mywebsearch [support many times], but they have not [provided any useful technical advice]. I even hired a certified Microsoft technician to fix the problem -- but after a week, all they could tell me was that Mywebsearch acts like a virus (no kidding!). I can't [seem to] find any capable technical help! Please warn your subscribers before it is too late! "

After publishing the article, I received over 65 emails within the last few days with many great helpful comments and suggestions from Readers. Infopackets Reader Stephen E. and many others were so beaten by MyWebSearch, that they reinstalled Windows just to get rid of it.

" I'm sorry to say that the only way I've found to safely remove MyWebSearch from the computer is by doing a clean install of windows. I know that this is extreme but the program lodges itself so deeply in the system [and like Cospul mentioned], it's virtually impossible to clean it off. I hope that this helps those that have been stumped. PS: Keep up the good work with infopackets: I look forward to it all the time."

If you recall, we discovered that MyWebSearch contains something called a Browser Helper Object.

To recap, a "Browser Helper Object is a [.DLL file] that allows developers to customize and control Internet Explorer (IE). When IE 4.x and higher starts, it [scans the System Registry for BHO's and then inserts the objects into Internet Explorer]. Created BHO's then have access to all the events and properties of that [browser Window]." (Source: Spywareinfo.com)

On that note, Infopackets Reader Don F. writes:

" I use a program called BHODemon [picture to right] to remove unwanted Browser Helper Objects from my machine. It lets you disable any BHO programs installed and also tells you where the offending file is at, and usually what company the BHO object came from. I have also used it to remove Mywebsearch Bar, and several other Nasty toolbars that [some how or another ended up on my machine].

The only toolbar that I use is the Google Bar that you can download from the Google homepage: it lets you choose to send info to google or not when you install, and it also stops popups and there are several other features that are really good. Hope this one helps. "

http://www.definitivesolutions.com/bhodemon.htm

Side note: Aside from the BHODemon download link, the above page has a wonderful description how Browser Helper Objects work (in great detail) It's simple to read, too.

And, Robert B. from Africa had this to say:

" Hi there Dennis, thanks for Infopackets Newsletter -- most interesting! I had that same problem with MyWebSearch ... [It is] true: Ad-Aware and SpyBot S & D did not pick it up [even though I run it on a daily basis], and [so] I didn't know my PC was infected. When I installed Webroot's Spy Sweeper, it found and removed 537 [additional] traces of Spyware, including hundreds [of files from] MyWebSearch (including the main program) ... [Spy Sweeper was the only one that could] remove the whole stinking lot. "

Side note: A review was written on Spy Sweeper. Click to read it online (I personally use it on my own machine and it comes highly recommended).

Infopackets Reader Nancy B. and many others recommended a program called "HiJack This!" which can be used to identify Spyware. But, as Nancy points out, it is a bit of an advanced program. She writes:

" [This is sort of off topic, but I was recently infected with the] 'CoolWebSearch' Spyware/BHO. It came onto my system after I downloaded a WallPaper file for my Desktop. I spent 3+ days searching and gathering information [on how to remove this program]. I then used a program called 'HiJack This'. It's free and is a wonderful tool for removing BHOs and their messes they leave behind ... the only drawback is [that this program is slightly technical one has to know what they are looking for in the Registry]. "

http://www.spywareinfo.com/~merijn/cwschronicles.html

And, Infopackets Reader 'Pippie' provided step-by-step instructions for manual removal, plus a recommended freeware pick to stop future BHO attacks:

" [Identify the BHO installed on your machine, and then write down the list of .DLL files it is associated with -- most likely listed in same directory the BHO is installed to, or possibly in the c:\windows\system32 folder]. Reboot your computer into Safe Mode, and delete the BHO's .DLL files from the system. Next, search the registry for the name MyWebSearch and delete every entry. Finally: search the hard drive for the program, delete it, and reboot.

By the way, Browser HiJack Blaster (free) is a great anti-BHO program which runs silently in the background ... it only springs into action when an attempt [to inject a BHO] is made. It watches and protects the following items: IE Homepage, IE Default Page, IE Search Page, and BHOs. "

http://www.wilderssecurity.com/bhblaster.html

Infopackets Reader Scott J. briefly writes:

" I just used [a freeware program called ToolBarCop] to remove the MyWebSearch toolbar from IE on a client's computer. " http://www.mvps.org/sramesh2k/toolbarcop.htm

Quite a few users recommended a program called Spyware Blaster, which prevents Spyware from being installed on your machine. Note: it doesn't not *remove* Spyware. From the web site:

" By setting a 'kill bit' for Spyware ActiveX controls, SpywareBlaster can prevent the installation of any Spyware ActiveX controls from a webpage. It does this while not interfering with 'friendly' ActiveX controls - so your browser can work correctly and you can have peace of mind! "

http://www.javacoolsoftware.com/spywareblaster.html

A number of users also recommended visiting "ComputerCops". Jim P. writes:

" You can go to one of several volunteer pro/semi-pro sites for help in getting rid of these things. I used ComputerCops when I was infected with a similar (or perhaps the same) BHO called CoolWebSearch. Go to the site, scroll down the left to 'Security Central' and click 'Forums.' Scroll down Forums to 'Privacy' then click 'Spyware - HijackThis.' This is the forum that deals with supposedly unremovable BHOs. "

http://www.computercops.biz/index.php

Thanks to the many, many people who write in with wonderful suggestions.