Jump to content

Search the Community

Showing results for tags 'mywebsearch'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


  • Announcements
    • Malwarebytes News
    • Beta Testing Program
  • Malware Removal Help
    • Windows Malware Removal Help & Support
    • Mac Malware Removal Help & Support
    • Mobile Malware Removal Help & Support
    • Malware Removal Self-Help Guides
  • Malwarebytes for Home Support
    • Malwarebytes for Windows Support Forum
    • Malwarebytes for Mac Support Forum
    • Malwarebytes for Android Support Forum
    • Malwarebytes for iOS Support
    • Malwarebytes Privacy
    • Malwarebytes Browser Guard
    • False Positives
    • Comments and Suggestions
  • Malwarebytes for Business Support
    • Malwarebytes Endpoint Protection
    • Malwarebytes Incident Response (includes Breach Remediation)
    • Malwarebytes Endpoint Security
    • Malwarebytes Business Products Comments and Suggestions
  • Malwarebytes Tools and Other Products
    • Malwarebytes AdwCleaner
    • Malwarebytes Junkware Removal Tool Support
    • Malwarebytes Anti-Rootkit BETA Support
    • Malwarebytes Techbench USB (Legacy)
    • Malwarebytes Secure Backup discontinued
    • Other Tools
    • Malwarebytes Tools Comments and Suggestions
  • General Computer Help and Security Updates
    • BSOD, Crashes, Kernel Debugging
    • General Windows PC Help
  • Research Center
    • Newest Rogue-Ransomware Threats
    • Newest Malware Threats
    • Newest Mobile Threats
    • Newest IP or URL Threats
    • Newest Mac Threats
    • Report Scam Phone Numbers
  • General
    • General Chat
    • Forums Announcements & Feedback

Find results in...

Find results that contain...

Date Created

  • Start


Last Updated

  • Start


Filter by number of...


  • Start





Website URL






Found 4 results

  1. Windows Vista 64 bit | 4GB of RAM | AMD Athlon™ 7750 Dual Core Processor 2.71 GHz | My PC started getting slower 4 months ago, and programs were being downloaded by themselves. thought my brother downloaded them, so I didn't do anything. When I asked him and he said "no", I immediately downloaded MalwareBytes (Free Version). So I scanned and there was about 450 infections, and about 96% of it was "pup.mywebsearch", the rest were Trojans and adware. I removed them,and when I restarted the computer it got WAYY WORSE, even a right click took forever to load. Then, Windows Explorer wasnt responding, so I holded the power button to start on Safe Mode, and it wasn't so slow. So I don't know what to do, so I'm posting the DDS.txt here. If you need the MalwareBytes log, please ask me. ----------------------------------------------------------------------------------------------------------------------------- dds.txt attach.txt
  2. I recently used Malwarebytes to remove PUP "MyWebSearch" after noticing my browser was behaving strangely. However, the I.E. toolbar (AKA QuotationCafe_45) is still showing up in the I.E. Add-Ons. I also ran a HijackThis scan but when I clicked the “Analyze This” button I got an error "No Internet Connection Available." I tried turning off the Windows firewall and tried again with the same result. I have removed various other bugs before and I would just like some help verifying I have sufficiently eradicated everything. The most recent Malwarebytes and HijackThis logs are below. I appreciate any help you can offer. Thanks in advance, Pepper ============================================= Malwarebytes Anti-Malware www.malwarebytes.org Database version: v2012.11.25.02 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Owner :: FAMILYROOM [administrator] 11/25/2012 9:25:15 AM mbam-log-2012-11-25 (09-25-15).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 224652 Time elapsed: 8 minute(s), 19 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 18 HKLM\SYSTEM\CurrentControlSet\Services\QuotationCafe_45Service (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\CLSID\{3b069953-cf59-4926-9d28-a4589c462859} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\TypeLib\{7abc0217-276f-4940-840e-2a0acbeb4249} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\Interface\{1D63CC1B-2217-4EEB-B89C-0C3BB3C46D7A} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\QuotationCafe_45.SettingsPlugin.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\QuotationCafe_45.SettingsPlugin (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B069953-CF59-4926-9D28-A4589C462859} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B069953-CF59-4926-9D28-A4589C462859} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuotationCafe_45bar Uninstall (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\CLSID\{8619595f-4eef-4164-b040-fb7436301a06} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8619595F-4EEF-4164-B040-FB7436301A06} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{8619595F-4EEF-4164-B040-FB7436301A06} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8619595F-4EEF-4164-B040-FB7436301A06} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\CLSID\{6ab96dd7-6e0c-4a7f-93e0-a8a47a685d81} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\CLSID\{8561f2a1-d885-4852-8289-81ae4ad0ad99} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8561F2A1-D885-4852-8289-81AE4AD0AD99} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{8561F2A1-D885-4852-8289-81AE4AD0AD99} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8561F2A1-D885-4852-8289-81AE4AD0AD99} (PUP.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Detected: 3 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|QuotationCafe Search Scope Monitor (PUP.MyWebSearch) -> Data: "C:\PROGRA~1\QUOTAT~2\bar\1.bin\45srchmn.exe" /m=2 /w /h -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|QuotationCafe_45 Browser Plugin Loader (PUP.MyWebSearch) -> Data: C:\PROGRA~1\QUOTAT~2\bar\1.bin\45brmon.exe -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks|{6AB96DD7-6E0C-4A7F-93E0-A8A47A685D81} (PUP.MyWebSearch) -> Data: -> Quarantined and deleted successfully. Registry Data Items Detected: 1 HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.MyWebsearch) -> Bad: (http://home.mywebsea...CFegWMgodxwIAaA) Good: (http://www.google.com) -> Quarantined and repaired successfully. Folders Detected: 0 (No malicious items detected) Files Detected: 7 C:\Program Files\QuotationCafe_45\bar\1.bin\45hkstub.dll (PUP.MyWebSearch) -> Delete on reboot. C:\Program Files\QuotationCafe_45\bar\1.bin\45brstub.dll (PUP.MyWebSearch) -> Delete on reboot. C:\Program Files\QuotationCafe_45\bar\1.bin\45SrchMn.exe (PUP.MyWebSearch) -> Delete on reboot. C:\Program Files\QuotationCafe_45\bar\1.bin\45brmon.exe (PUP.MyWebSearch) -> Delete on reboot. C:\Program Files\QuotationCafe_45\bar\1.bin\45barsvc.exe (PUP.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\QuotationCafe_45\bar\1.bin\45bar.dll (PUP.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\QuotationCafe_45\bar\1.bin\45SrcAs.dll (PUP.MyWebSearch) -> Quarantined and deleted successfully. (end) =========================================== Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 11:56:17 AM, on 11/25/2012 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe c:\Program Files\Microsoft Security Client\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Java\jre7\bin\jqs.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE C:\Program Files\PrintKey2000\Printkey2000.exe C:\Shared\Backup\Programs\Windows Utilities\Zoomit\ZoomIt.exe C:\Program Files\MediaMonkey\MediaMonkey.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Microsoft Office\Office14\EXCEL.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157 O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll O3 - Toolbar: QuotationCafe - {99bced2f-1db3-4ecd-8e35-8906428a6cfe} - C:\Program Files\QuotationCafe_45\bar\1.bin\45bar.dll (file missing) O4 - HKLM\..\Run: [ATIPTA] C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [OfficeSyncProcess] "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe -update activex O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - Startup: Printkey2000.lnk = C:\Program Files\PrintKey2000\Printkey2000.exe O4 - Startup: Shortcut to ZoomIt.exe.lnk = Backup\Programs\Windows Utilities\Zoomit\ZoomIt.exe O4 - Global Startup: AutorunsDisabled O4 - Global Startup: VPN Client.lnk = ? O8 - Extra context menu item: &Search - http://tbedits.quota...2012112118&cv=2 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000 O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105 O9 - Extra button: (no name) - AutorunsDisabled - (no file) O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: Garmin Communicator Plug-In - https://static.garmi...inAxControl.CAB O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus....k_sys_ctrl3.cab O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlcdnet.asus....vex- O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1285451521765 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1341341445343 O16 - DPF: {83A4D5A6-E2C1-4EDD-AD48-1A1C50BD06EF} (Image Uploader Control) - http://www.mejuba.co...geUploader6.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.ad...Plus/1.6/gp.cab O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logme...trl.cab?lmi=724 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: ASUS System Control Service (AsSysCtrlService) - ASUSTeK Computer Inc. - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe O23 - Service: UMVPFSrv - Logitech Inc. - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- End of file - 9098 bytes
  3. I have a Win 7, 64-bit HP Pavilion dv8t 1000 machine, running IE 8. I use Symantec NORTON 360 as my AV. I ran MalwareBytes as a precaution after I got roped into trying to win something online by answering a survey. (DUH!!!!) (I work on an IT Help Desk so I should've known better!!!). Malware logs has 100 detected files, including registry settings, etc. etc. HELP!!!! I want to make CERTAIN that I clean my PC the right way, as I am going to Seminary 100% ONLINE and need my computer to work. Attached, you will find my DDS.txt and Attach.txt files. I did not find a Send Email immediately option so I am including my email address on this post. RitaJP rjpresser@comcast.net DDS.txt Attach.txt
  4. Hi, I would really appreciate your help as having a nightmare getting rid of this PUP.MyWebSearch registry value. I have been having serious issues with the PC not allowing me to launch the web browser, intermittent login and shutdown success and generally slow PC performance. I have McAee Total Protection which did not detect anything. However, MalwareBytes was great and found 2 infected registry values and deletes them successfully BUT after a reboot, I experience same symptoms and, after doing another scan (usually can only do this in safe mode), find the 2 culprits again! I have searched Program files/control panel Add/Remove and can't find anything relating to 'MyWebSearch'. Please help! I have attached the 'dds' and 'attach' files. Thanks in advance for any help you can give. Kam dds.txt attach.txt
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.