My Way Search Assistant Removal

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by RookieGirl, Jul 4, 2005.

  1. RookieGirl

    RookieGirl Private E-2

    Happy 4th of July Everyone!

    Somehow I got this little bugger... can't figure out how to get rid of it.
    You can't remove it from the "Add/Remove Hardware" screen.

    I have a HijackThis log if you want to see it.
    I ran AdawareSE but for some reason I don't think it's updating correctly.

    Any help would be appreciated!
    Thanks
    :)
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You should be looking at Add/Remove Programs not Hardware.

    If you still have problems, follow the steps below. HijackThis is far from the first step. What version of Ad-Aware SE do you have. Make sure you compare to the one in the links below.

    Please follow the steps below:

    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    Make sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


    After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     
  3. RookieGirl

    RookieGirl Private E-2

    The problem with this Assistant is that when viewed in Add/Remove Programs there is no change/remove option. It is listed, but there is nothing you can do to it. I don't think you can remove it from that location.

    I have Ad-Aware SE and have run that. The only thing that it comes up with are tracking cookies, which I then delete.

    This is a new laptop, so it came with McAfee. That has Antivirus, Antiabuse, Antihacker, Antispam, and a Firewall. All are up to date and run continually.

    I also have CC-Cleaner, which I run frequently.

    Attached is my HijackThis log, I hope you can help me!

    Thanks so much
    :)
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    As I said in my last message (and these are required steps)


    And you did not install HijackThis properly as requested. And ALL browsers ( C:\Program Files\Internet Explorer\IEXPLORE.EXE ) must be closed before using HJT.



    Also, uninstall WeatherBug. That is where you got MyWay from.

    Also uninstall anything that says WildTangent

    Notice the below in your log:
    O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)



    You also have R0 & R1 lines from Dell that contain myway. Some people consider these problems and some do not. As far as I'm concerned they are no big deal but they are a poor choice for Dell to be giving for their home pages.
     
    Last edited: Jul 5, 2005
  5. RookieGirl

    RookieGirl Private E-2

    I have followed all of your steps

    here is the hjt log
    hopefully it is alright now
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You are still running HijackThis directly from the ZIP file:

    C:\DOCUME~1\LAUREN~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

    You must extract the hijackthis.exe from the zip file. You are not doing that. What you are doing is running it from within the ZIP file. You need to extract the hijackthis.exe file and put it into a folder you create (as suggested C:\Program Files\HJT ).

    However, at this point a can tell you that your HJT log is clean. You just have one item left over from run HSremove. So you can have HJT fix the below:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm


    Do you still have problems? Is MyWay still in Add/Remove programs? If so, follow the steps below.

    Open HijackThis, click Config, click Misc Tools
    Click "Open Uninstall Manager"
    Click "Save List" (generates uninstall_list.txt)
    Click Save, copy and paste (or attach) the results into your next post
     
  7. RookieGirl

    RookieGirl Private E-2

    My Way Search Assistant is still in my Add/Remove Programs.

    Here is the uninstall list.
     

    Attached Files:

  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Well it is not there according to HijackThis's Uninstall program list.

    Run regedit and do a searrch for it. Tell me what registry key it is in.

    As an alternative you could use a RegSrchTool (below) but in either case, you really need to use the proper search string (what it file is actually called in the registry) to locate it.


    Please unzip and run the RegSrchTool
    Please make sure that your Anti-Virus app does not have Script Blocking enabled. If so, disable it to allow the tool to run.

    Please enter the following into the Search Box: My Way

    or try Search Assistant or MyWay

    Please save the results of this search and attach them.
     
  9. RookieGirl

    RookieGirl Private E-2

    I ran the RegSrchTool and searched "My Way" and "Search Assistant" attached are the results...
     

    Attached Files:

  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Try this!

    Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file delmyay.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the delmyay.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.
     
  11. RookieGirl

    RookieGirl Private E-2

    It's gone from add/remove programs :)

    so can i delete that new desktop delmyay.reg icon or should i just move it to another location?

    also is it ok to hide some of my files again?
     
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes you can delete the .reg file from your desktop.

    It is not necessary to hide your files again. It will only make it easier for stuff to hide from you again. The only thing that hiding the file does is make it harder for you to delete protected (hidden) system files by mistake. The problem with this is that malware knows this is the default and uses it to their advantage to hide from you. The first thing I do on every PC I use (especially new PCs or newly formatted) is to unhide evrything. I never set it back. But this is up to you. If you feel that you or anyone else using the PC, would be safer (from yourself) by hiding files then go ahead and hide them. Just remember that any malware that sneaks in will now be hiding too.

    To help keep you clean, make sure you complete the steps in the below:

    How to Protect yourself from malware!
     
  13. RookieGirl

    RookieGirl Private E-2

    thanks for all of your help

    :)
     
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds