why does this happen? Help!

Open ‘Add/Remove Programs’ in the Control Panel. Select the ‘My Search Bar’ (MySearch variant), ‘MyWay Speed Bar’ (MyWay) or ‘My Web Search Bar’ (MyWeb) entry and click ‘Remove’. For the MyWeb variant, be sure to also remove ‘Fun Web Products Easy Installer’.

For more information - http://www.doxdesk.com/parasite/MySearch.html

You could start by downloading Hijackthis from http://hijackthis.de/downloads/hijackthis_199.zip and copy paste the results at this adress : http://hijackthis.de/

Look at the results and do whatever is suggested to deal with dangerous entries

>>MySearch is a search bar<<
MySearch is spyware. Kill it with Microsoft AntiSpyware...it's free.

Microsoft AntiSpyware
http://www.microsoft.com/downloads/details.aspx?FamilyId=321CD7A2-6A57-4C57-A8BD-DBF62EDA9671&displaylang=en

I've had pretty good luck removing Adware/Spyware/etc with a combination of Ad-Aware and Spybot-Search & Destroy.  What one doesn't get, the other usually does...

http://www.lavasoftusa.com/

http://www.safer-networking.org/en/index.html

Of course, MySearch is a spyware. Remove it immediately.

See the instructions to remove it manually here :
http://www.scanspyware.net/info/MySearch.htm
http://www.spywareremove.com/removal_mysearch.shtml

You have to manually kill the dropper of that spyware.

The droppers hide in the _restore folder and even though shutting off xp system restore is suppose to delete
the restore points...the spyware alters Windows so the restore points remain.
The _restore folder in Windows XP is behind a double protected hidden area of Windows XP.

Open a Windows Explorer and in the menu
Tools
Folder Options
View(tab)
uncheck "Hide protected operating system files (Recommended)"
put a check on "Show hidden files and folders"
click OK

Now to access the C:\System Volume Information folder you two-click it if your Windows XP was installed
selecting FAT32 as the file system format. If your Windows XP was installed selecting NTFS file system
format then there are more steps to be able to two-click, and access, the C:\System Volume Information
folder...these steps for NTFS are...

Start
Run...
type cmd hit enter
type cd\ hit enter
type
cacls "c:\system volume information" /E /G username:F
(username= your actual username you log on to XP with)
hit enter

...you can now two-click and access that folder via Windows Explorer and inside there is a folder named _restore*****.
***** = a bunch of numbers and letters, two-click that folder and you'll see a bunch of folders named RP*, delete
them all...and all files in there as well. When your done deleting all the files and folders in there (the actual restore points)
you MUST re-enable the permissions you shut off. You type the command...
cacls "c:\system volume information" /E /R username
...to turn it back on.

In Windows Explorer delete contents of
C:\Documents and Settings\{username}\Local Settings\Temporary Internet Files
C:\Documents and Settings\{username}\Local Settings\Temp
C:\Windows\Temp (if exists)

Once this is done you reboot back into "Safe Mode with Networking" and then run Microsoft AntiSpyware

Go to Panda online scanner, it doesn't kill spyware but it will show the path to the files.

http://www.pandasoftware.com/activescan/com/activescan_principal.htm
("Scan your PC" button)

Also, jltari pointed to HijackThis. You can scan with that after you re-cleared the "system volume information"
folder and the cache (temp files). HJT will show the exploit files and they will be removed from the registry
when checked and removed with HJT.

I should have added...Shut off XP System Restore...

right-click My Computer
click Properties
click the System Restore(tab)
select "Turn off System Restore" or "Turn off System Restore on all drives"
click Apply
you'll get a popup warning about restore points being deleted and system restore being turned off
click Yes

...to kill this stuff the basic idea is you sit in "Safe Mode with Networking" throwing everything but the Sun
at it until AntiSpyware, Panda, and HJT tell you it's gone as well as a triple check the "system volume information"
folder and the cache are clear.

Don't forget every username on the computer has it's own cache folders.

MySearch must still be residing in your Registry, you'll need to remove it from there do the following;
first backup your registry and then remove the following Registry entries

Open the registry (click ‘Start’, choose ‘Run’, enter ‘regedit’) and open the key HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {014DA6C1-189F-421a-88CD-07CFE51CFF10}
HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {014DA6C9-189F-421a-88CD-07CFE51CFF10}
HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID\ {0494D0D1-F8E0-41ad-92A3-14154ECE70AC}
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ {014DA6C1-189F-421a-88CD-07CFE51CFF10}
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ {014DA6C9-189F-421a-88CD-07CFE51CFF10}
'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ {0494D0D1-F8E0-41ad-92A3-14154ECE70AC}
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ My Search Uninstall \ DisplayName'
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ My Way Speedbar Uninstall \ DisplayName
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ MyWaySearchAssistant \ DisplayName
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ Toolbar\{014DA6C9-189F-421a-88CD-07CFE51CFF10}
HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Internet Explorer \ Toolbar \ WebBrowser\{014DA6C9-189F-421a-88CD-07CFE51CFF10}

This might not actually fix your situation, but is a good thing to do anyway with these stupid search bars... Internet Properties > Advanced > Enable third-party browser extensions > uncheck this box.

Hmmmmm... dump IE ;)

If spyware removal tools/tips don't work, neither do other things like BHO (http://www.definitivesolutions.com/bhodemon.htm, I don't think you have tried it yet), then you should consider uninstalling IE6.

Boot in to safe mode without networking and run Adaware and Spybot with latest defs and then run hijack this.  Save the log and post it.  I have run into some spyware where you have to deny rights to a folder(to stop processes from running at startup) and reboot then take ownership of the folder and delete it and the programs registry entires.    

conime.exe is a back door trojan
http://www.liutilities.com/products/wintaskspro/processlibrary/conime/
you may have to boot in to command line to remove this file.

O10 - Broken Internet access because of LSP provider 'c:\windows\system32\ws2_64.dll' missing
This is a bad file also.
http://computercops.biz/lsp-103.html

Try running this to fix the 010 problem
http://download.softpedia.ro/software/SYSTEM/WinsockXPFix.exe

Open Task Manager and end process on conime.exe
Go to C:\WINDOWS\system32\ and delete conime.exe

Start
Run...
msconfig
Startup(tab)
uncheck conime.exe (or C:\WINDOWS\system32\conime.exe)

Remove these with HijackThis:

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\ws2_64.dll' missing
O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\pkmcdo.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ic32pp - {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - C:\WINDOWS\wc98pp.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll
O18 - Filter: text/html - {65CBAF77-19CA-4B81-86D5-7835D59BEA85} - C:\WINDOWS\system32\SoMp3.dll