MyWay.MyWebSearch

[clrk11]

Hi everyone,

I got infected with MyWebSearch and cannot eliminate it using Spybot Search & Destroy.

I run Spybot Search & Destroy and it finds a MyWay.MyWebSearch entry in HKEY_LOCAL_MACHINE. It seems it deletes the entry, but, when I reboot, I run Spybot Search & Destroy again and that MyWay.MyWebSearch entry is still there!!

I've tried to delete this MyWay.MyWebSearch entry using Spybot Search & Destroy, at least four times, but it is still there everytime I run Spybot Search & Destroy.

I also tried to delete the entry manually. It desappeas, but it's back again when I reboot!

I have used other tools, such as SuperAntiSpyware or Malwarebytes, but they don't find anything. It's just that entry that Spybot Search & Destroy finds.

Please, I would really appreciate if you could help me out.

Thanks a lot.

[spybotsandra]

Hello,

Which operating system do you have?

Best regards
Sandra
Team Spybot

[clrk11]

Hi Amanda,

Sorry, I forgot to mention, Windows Vista. Any special recommendations to get rid of this??

Thanks a lot,

David

[spybotsandra]

Hello,

Did you open Spybot with a right click and choose "run as administrator/take ownership" (http://www.safer-networking.org/en/faq/42.html)?

Best regards
Sandra
Team Spybot

[clrk11]

Hi again Sandra,

I called you Amanda in my previous email. Sorry about that.

Yes, I opened it all the time as an administrator. I did not do it the first time. Then, I realized I had to run Spybot S&D as an administrator. So, I did that at least three more times, as well as rebooting after scanning.

It makes no difference the way you run it, I keep getting MyWay.MyWebSearch entry in HKEY_LOCAL_MACHINE.

Thank you so much.

[spybotsandra]

Hello,

No problem. ;)
Can you post what was found?

Best regards
Sandra
Team Spybot

[clrk11]

Hello Sandra,

Sure, this is exactly what it says:

Myway.MyWebSearch

(SBI $11334F10)IE toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}


"Myway.MyWebSearch" is in red color. When I expand it, I get the information down below ((SBI $11334F10)IE toolbar + HKEY_LOCAL_MACHINE... etc).

Thank you so much.

[spybotsandra]

Hello,

Please delete the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}

Open the registry editor by:
(a)
press windowskey + r then enter "regedit" (without quotation marks)
or
(b)
click on "start" , then "run" and enter "regedit" (without quotation marks)

(a+b)
and then browse to the path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA}

Best regards
Sandra
Team Spybot

[clrk11]

Hi Sandra,

Well, I've already done that. I said that in my first post ("I also tried to delete the entry manually. It desappeas, but it's back again when I reboot!"). Sorry, I should have clarified that I had tried to do it manually through regedit.

Anyway, as I said in my first post, it reappears even if I deleted manually. The registry entry desappears, but Spybot finds again such entry. It says what I wrote in my previous message.

Thanks.

[spybotsandra]

Hello,

Have you also tried to remove it in safe mode (http://www.computerhope.com/issues/chsafe.htm)?

Best regards
Sandra
Team Spybot