Member Avatar for jjemphoung

hey please help me! i cant able to delete a registry entry in my startup [HKLM/Microsoft/Windows/CurrentVersion/Run]. this results to an error which pops up during the startup of my windows. when i delete it, it will gone and when i press F5, it will still be there. the registry entry name is My Web Search Bar type is REG_SZ value is rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
is this a virus? it is not detected by my kaspersky internet security 2010. pls help. replies are appreciated.

  • 3 Contributors
  • 3 Replies
  • 222 Views
  • 17 Hours Discussion Span
  • Latest Post Latest Post by gerbil

Dani AI

Generated

Short, practical plan that builds on what , and have already tried.

If a Run entry disappears when you edit it but reappears later, something on the system is re-creating it at boot (a service, scheduled task, another Run/Startup location, or a running process that writes the key). That persistence pattern is a common technique used by unwanted programs to survive simple deletions. (mitre.ptsecurity.com)

Work in this order so the component can’t repair itself while you remove it. First boot to Safe Mode so third‑party autostarts won’t run. Then use Autoruns (Sysinternals) to show every autostart location — Run keys, RunOnce, services, Scheduled Tasks, BHOs, AppInit DLLs, startup folders, etc. Disable suspected items first (uncheck) and export the list, then delete entries once you confirm the right items. Export a copy before changes so you can recover if you remove the wrong thing. (support.microsoft.com)

If a file refuses to be deleted because it’s in use, find the locking process with Process Explorer (Find → Find Handle or DLL), close the handle or stop the process, then remove the file. If Windows blocks deletion for permissions reasons, take ownership and grant administrators full control before deleting. Example commands (run elevated and substitute the actual folder name): 

takeown /f "C:\Program Files\<suspect-folder>" /r /d Y
icacls "C:\Program Files\<suspect-folder>" /grant Administrators:F /t

Use Process Explorer to locate handles before force‑closing and consult the command docs first; these changes affect file ownership and ACLs so back up important data and proceed with caution. (learn.microsoft.com)

After manual removal rerun an up‑to‑date anti‑malware scanner (as suggested), remove unwanted browser add‑ons and reset search/home settings, scrub Scheduled Tasks and Services for any leftover entries, then reboot normally and re‑check with Autoruns. Finally create a fresh restore point or system backup once the system is clean.

Recommended Answers

All 3 Replies

Member Avatar for jjemphoung

sparkax thanks for the reply but it didn't answer my question. i tried running spybot many times it is being flagged but when i delete it, it just comes back as if nothing happened. any thoughts experts? replies are greatly appreciated.

Member Avatar for gerbil

MyWebSearch is not a virus, merely malware for advertising. It contains files for recreating itself when parts are deleted. I do not think there is a better tool for removing MyWebSearch than this:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you when it completes... do not click the Save Logfile button.
Examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Copy and post that log [it is also saved under Logs tab in MBAM].

Edited by gerbil because: n/a
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.