My Web Search RUNDLL error

[F2kSel]

Hi I did a daft thing and installed SmileyCentralPFSetup2.1.50.3-3.ZNfox000 which I belive installed "my Web Search Bar.

I don't want this so removed mileyCentral from Add Remove Programs and also deleted the file MYWEBS in the C folder.

Since then when I start my PC I get the following RUNDLL Error C:\\PROGRA~1\\MYWEBS~1\\bar\\1.bin\\MWSBAR.DLL,S MODULE COULD NOT BE FOUND.

I have run HJT and see the following line O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S

I have ticked to remove this and on the next reboot everyting is fine however the following reboot and it's back again.

I've done a registry search for both MyWebSearch and My Web Search and see the following :-

REGEDIT4

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0

; Results at 26/09/2006 09:15:57 for strings:
; 'my web search'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"My Web Search Bar"="rundll32 C:\\PROGRA~1\\MYWEBS~1\\bar\\1.bin\\MWSBAR.DLL,S"

; End Of The Log...

I've deleted this but it still comes back again.

Logfile of HijackThis v1.99.1
Scan saved at 11:02:16, on 26/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
d:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
d:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
d:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
d:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
D:\Program Files\DU Meter\DUMeter.exe
C:\WINDOWS\system32\GSICON.EXE
C:\WINDOWS\system32\dslagent.exe
D:\Program Files\Spy Emergency 2005\SpyEmergency.exe
d:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\Program Files\Self Contained\hIjACKtHIS\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Anonymizer Proxy - {0DB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - d:\Program Files\NetConceal Anonymizer\ProxyNew.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O4 - HKLM\..\Run: [AVG7_CC] "d:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [DU Meter] "D:\Program Files\DU Meter\DUMeter.exe"
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] "dslagent.exe" USB
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
O4 - HKCU\..\Run: [SpyEmergency] "D:\Program Files\Spy Emergency 2005\SpyEmergency.exe"
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{C1F9D6E4-D77F-4950-9F43-34D5E4839A04}: NameServer = 194.72.9.34 194.72.0.114
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - d:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - d:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - d:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - d:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

And Misc Tools Unistall Manager

3DMark06
7-Zip 4.42
Ad-Aware SE Professional
Adobe Flash Player 9 ActiveX
AMD Dual-Core Optimizer
Asmw PC-Optimizer Pro
ATI - Software Uninstall Utility
ATI Display Driver
AVG Anti-Rootkit Beta
AVG Free Edition
Bandwidth Monitor Pro
Barbarian Invasion
Battlefield 2(TM)
Battlefield 2: Special Forces
BHODemon 2.0.0.23
Brothers In Arms EiB
BT Voyager ADSL Modem
Call of Duty(R) 2
DivX
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
Driver Cleaner 3
EA downloader
Fraps
GT Legends 1.0.0.0
HijackThis 1.99.1
iDT FunCup modification for rFactor
Logitech Gaming Software
Microsoft Excel 97
Mozilla Firefox (1.5.0.7)
Nero 6 Ultra Edition
NetConceal Anonymizer
NoAdware v4.0
NVIDIA Drivers
PowerQuest PartitionMagic 8.0
ProStroke Golf
Ray Adams ATI Tray Tools
Real Alternative 1.30
Realtek AC'97 Audio
rFactor (remove only)
Rome - Total War - Alexander
Rome - Total War(TM)
Rome Total War - patch 1.3
Security Task Manager 1.6f
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Spy Emergency 2005
Spy Sweeper
Spybot - Search & Destroy 1.4
TeamSpeak 2 Server RC2
Unlocker 1.7.4
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
V8Factor Season 2006
WinAce Archiver 2.0
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
Windows Installer 3.1 (KB893803)
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinRAR archiver
XP Codec Pack
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger

Apart From the Anoying error message There isn't any problem though but I would like to get ride of it.
I've tried to do a System Restore but it just keeps saying that it cannot restore and no changes have been made.

If you could help with this one I would be Grateful.

[Theadmiral]

It sounds as though you may just have a leftover invalid registry entry.

Try downloading ccleaner from www.download.com and cleaning up temp files, unused file extensions and invalid registry entries. Use the "issues" button for registry problems.

-Kev

[F2kSel]

Yes I've tried that and it does find an entry and if I fix it the next time I reboot I don't get the error but after that on reboot it's back again.

[Theadmiral]

Have you tried turning off system restore? Sometimes these nasties can locate themselves in restore files where scanners cannot remove them.

[gerbil]

i could write this up myself, but if i give you the link, then those folks get the credit.... and the stuff there applies to you. go get it, and be safe[r].

http://www.pchell.com/support/mywebsearch.shtml

[kylethedarkn]

There is also a fix in the stickys so you should look at that.

[F2kSel]

I've turned Restore off and that didn't help.

I did remove My Web Search as http://www.pchell.com/support/mywebsearch.shtml describes but I'm still left with O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S

No amount of reg cleaning and spyware searching is finding anything.

Even when I do remove it the thing comes back on the second reboot.

It's really begining to bug me now.

[F2kSel]

Thanks for trying to Help I seem to be free of it now.

I had to unistall SpySweeper and SpyEmergency, I've since reloaded SpySweeper and it's still fine, I'll reinstall SpyEmergency in a few days.

I've never had a problem with either of them in the past.