Error loading MWSBAR.dll

Each time user logs in, error message pops up saying "error loading MWSBAR.dll". Started appearing following a download of the latest Flashplayer software.

I know its to do with MyWebSearch. It is not listed in Add/remove programs to remove. I ran SpyBot and it picked up MyWebSearch and said it fixed the problem. But it appears again once the system is rebooted. I then ran hijacthis log and fixed the entry for mwsbar.dll, but still appears when you log on.

i then went into regedit and removed any traces of mwsbar.dll as per some instructions i found. The error still persists. The current hijackthis log of the user is attached.
hijackthisAS.txt
NCGPIICTAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
cfusitsConnect With a Mentor Commented:
start msconfig from start / run and check i MWSBAR.dll is mentioned in start. if it is then you have not removed all parts from regeistry.
You could try and run a search in regedit on mwsbar, if it shows up then you can either delete or first export it and then delete. it prefer the latter, htne you can always restore it.
0
 
slam69Commented:
go to tool manage add ins in IE

find mywebsearch addi and un tick

shoudl sort it
0
The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

 
NCGPIICTAuthor Commented:
i have already tried fixing it through hijackthis but it appears again when you log in. I also deleted the entry in regedit but still reappears
0
 
slam69Commented:
did you check teh manage add-ins in IE tools?
0
 
warturtleConnect With a Mentor Commented:
Download SuperAntiSpyware (www.superantispyware.com) and do a full scan with that in safe mode. It will remove the MyWebSearch files as well as registry entries which point to it.

Hope it helps.
0
 
warturtleCommented:
Just to add:

Its quilte likely that you have a Vundo infection and just removing the MyWebSearch entries wouldn't remove the whole bunch.
0
 
cfusitsCommented:
If you look in msconfig in the label 'start' you will see that Mywebstart is set to startup, in you hijack file this line says it,
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
0
 
rpggamergirlCommented:
Also fix the below entry, it could be your registry monitoring apps e.g., Spybot's Tea timer that is putting the 04 entry back in, make sure you disable tea timer first before fixing hijackthis entries.

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Me69ZMbubcD3RW7BXlKjvdD7FxAQluLAp1thBnmF2AFvVzIG9vJtuOflVlt7R9QX7vok1ZNaAvmsC8
0
All Courses

From novice to tech pro — start learning today.