Help with removing mywebsearch

waddler_8

Download AdwCleaner from HERE & save it to your desktop.

• Right click AdwCleaner.exe & chosse "Run as Administrator" to run it.
• Click Search.
• A logfile will automatically open after the scan has finished.
• Close the adwCleaner window, click ok to the prompt.
• Post the contents of that logfile with your next reply.

Crispy_Ambulance

Hi. It only gave me search as an option which I did. I haven't deleted anything.


# AdwCleaner v2.100 - Logfile created 12/15/2012 at 14:12:04
# Updated 09/12/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Elizabeth - TAMMY
# Boot Mode : Normal
# Running from : C:\Users\Elizabeth\Documents\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\ProgramData\Partner

***** [Registry] *****

Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\SOFTWARE\Software
Key Found : HKU\S-1-5-21-708466495-1334651087-2902899843-1000\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Mozilla Firefox v17.0.1 (en-US)

Profile name : default
File : C:\Users\Elizabeth\AppData\Roaming\Mozilla\Firefox\Profiles\hnidvlib.default\prefs.js

Found : user_pref("keyword.URL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=87E56982[...]

-\\ Google Chrome v23.0.1271.97

File : C:\Users\Elizabeth\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1476 octets] - [15/12/2012 14:12:05]

########## EOF - C:\AdwCleaner[R1].txt - [1536 octets] ##########

waddler_8

Now run it and choose delete. Agree to the prompt and let it reboot.

Crispy_Ambulance

Thanks. Should I try again with Firefox now? I don't want to keep waking it up.

# AdwCleaner v2.100 - Logfile created 12/15/2012 at 15:09:38
# Updated 09/12/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Elizabeth - TAMMY
# Boot Mode : Normal
# Running from : C:\Users\Elizabeth\Documents\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\ProgramData\Partner

***** [Registry] *****

Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Software

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Mozilla Firefox v17.0.1 (en-US)

Profile name : default
File : C:\Users\Elizabeth\AppData\Roaming\Mozilla\Firefox\Profiles\hnidvlib.default\prefs.js

C:\Users\Elizabeth\AppData\Roaming\Mozilla\Firefox\Profiles\hnidvlib.default\user.js ... Deleted !

Deleted : user_pref("keyword.URL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=87E56982[...]

-\\ Google Chrome v23.0.1271.97

File : C:\Users\Elizabeth\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1605 octets] - [15/12/2012 14:12:05]
AdwCleaner[S1].txt - [1500 octets] - [15/12/2012 15:09:39]

########## EOF - C:\AdwCleaner[S1].txt - [1560 octets] ##########

waddler_8

Yes, try again.

Crispy_Ambulance

Huzzah! It has now disappeared from the list of search engines! Is there are programme I should run now to double check that it has all gone? thanks so much for your help.

waddler_8

There's no sign of it elsewhere - it was the keyword.url entry in your preferences file that was proving to be the stubborn entry.

Update & run a quick scan with MBAM, but you should be good to go.Run adwCleaner once more and choose the uninstall function.

Then, all being well, flush system restore.

http://windows.microsoft.com/en-GB/windows-vista/Delete-a-restore-point

Crispy_Ambulance

Thanks - really appreciate all your help.

waddler_8

No problem.

Uninstall these

Adobe Reader 8.1.3

Java(TM) 6 Update 6
Java(TM) 6 Update 7
Java(TM) 6 Update 37
Java Auto Updater

Get the latest for both here:

http://get.adobe.com/uk/reader/ (Uncheck the Mcafee security scan - you don't need it)

http://www.java.com/getjava/


Reason: http://www.securelist.com/en/analysis/204792239/IT_Threat_Evolution_Q2_2012#10

Vulnerable applications targeted by malicious users

Most online attacks are launched using exploits that take advantage of software errors, allowing malicious users to execute malicious programs without the victim suspecting a thing.