Help - Search - Members - Calendar
Full Version: My Web Search Module - Can't Find
BleepingComputer.com > Security > Am I infected? What do I do?
   
Winkie
eMachine T3410 bought March, 2006. Used lightly for email and web sites. Windows XP-Home w/SP2. 2.0Ghz, 256KB K2 Cache, 1024MB DDR SDRAM, Hard Drive 160GB ATA.

Did routine maintenance: ran Lavasoft's Ad-Aware SE Personal. Downloaded SPYWAREBOT's free scan which found 15 parasites but would not remove them unless I bought and registered the full version. Downloaded and ran MS Defender (Beta 2) which found nothing wrong. Bought and registered and ran SPYWAREBOT and cleaned out 15 parasites. After which, on Restart I get this message:

RUNDLL
Error loading C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL
The specified module could not be found.

Went to MSCONFIG, clicked on Startup tab, found and unchecked box for:
mwsoemon C:\PROGRA~1\MYWE...
clicked Apply box
clicked General tab
clicked Normal Startup
clicked Apply and then Close
clicked Exit without restart
went to Control Panel, opened Add/Remove Programs
went to: My Web Search (My Fun Cards) and highlighted it
clicked on Change/Remove
get the exact same RUNDLL error loading message I get on startup.
Restart and nothing has changed. Box is still checked in MSCONFIG Startup, program is still in Control Panel list of Add/Remove Programs.
Did search for missing module. Get message .....1.bin refers to a location that is unavailable.

I've done the above several times - no change.
Bootup stops and waits for me to click OK on the RUNDLL error loading message.

Now what should I do?
rigel
Hi Winkie,

I would suggest following our malware guide. It has detailed instructions for disinfecting your computer.

If you have any problems or questions, just ask.

rigel
Orange Blossom
SpywareBot is on the list of rogue and suspect Anti-Spyware products and websites, which means that SpywareBot itself is a kind of spyware or malware. You can read about the baddies here

You can trust everything on the guide rigel has provided the link for.

Orange Blossom fruits_cherry.gif
Enthusiast
The first thing to do to resolve your immediate problem is use Windows System Restore to return your system state to before you used Spywarebot to remove what seems to be a necessary item from your computer.

To access System Restore:

Click on start/programs/accessories/system tools/system restore

Pick a highlighted date from before you installed Spywarebot.

That should resolve your immediate problem.

If it doesn't, open Spywarebot and see if it has an "undo" function. If so, use it. Reboot the computer.

After that I suggest you do the following:

Run both Adaware and Spybot Search and Destroy from safe mode, updating each program’s malware definitions before you scan and allowing both to fix what they find.

If you do not already have these freeware aps installed on your computer, you can get them at the following sites:

*AdAware SE: http://www.majorgeeks.com/download506.html

*Spybot S&D: http://www.safer-networking.org/en/index.html

Following that that I suggest you post a “HijackThis” log for expert assistance with your malware infection.

Read the pinned post in our “HijackThis” forum,
here
http://www.bleepingcomputer.com/forums/topic34773.html
Carefully read and follow all directions explicitly.

Following instructions create a HJT log, and POST THE HJT LOG YOU CREATED IN OUR HJT FORUM – not in this forum,
at this link.
http://www.bleepingcomputer.com/forums/posthjtlog.html
Include the specs for your computer (ie, processor, amount of RAM, brand or motherboard, etc, and briefly describe the problem you are experiencing.)

Unless you are expert at editing the registry, Do not use the Hijack This program to try to fix anything by yourself as even what may seem to be a small mistake can render your operating system inoperable.
Some files when in the correct folder for them may be fine while in another may be malware hiding.


A member of our expert HJT Team will analyze your log, make recommendations and offer assistance, walking you through the complete repair process.

It may take a period of time to get a response to the log you posted because the members of our HJT Team are kept very busy.
Please be patient as this team is manned by volunteers. They will help you in order received as soon as possible.

NOTE
Once you have posted your HJT log, please DO NOT make any additional posts in the HJT forum thread you created until you get a response from a member of our HJT expert team, and do not make any changes to your system (changes, including any attempted repairs, will make your computer to be different than displayed in the log you posted and therefore make your log inaccurate).

The first criteria the HJT Team has when looking for logs that need replies are posts showing 0 replies. If you make an additional post, it will show as having 1 reply.
A team member, looking for a new log that requires help might well assume another HJT Team member is already assisting you and might not open the thread to respond.

So, post your HJT Log in our HJT Forum (not here in this forum) and wait for a response from a HJT team member.

After you post your log, please do not make any changes to your computer. Discontinue trying to delete anything with any program as changes will make your HJT log obsolete and waste valuable time spent by our HJT experts analyzing the log made innacurate by changes and therefore their plan formulated to address the problems will also be obsolete.

If after 5 days you still have gotten no response, then post a re-request and a link to your HJT log HERE.
http://www.bleepingcomputer.com/forums/topic14717.html
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.