MWSOEMON.EXE - MyWebSearch Spyware

Mwsoemon.exe installs with a newer variant of the MyWebSearch spyware program. Generally, a browser helper object called mwsbar.dll will install at the same time.The toolbar does add search features but the search results you see will be hijacked to mywebsearch.com. WebSearch Toolbar is an Internet Explorer search toolbar that installs adware and spyware. WebSearch Toolbar changes your browser settings. This is a very high risk threat and should be removed immediately as to prevent harm to your computer or your privacy. Browser hijackers are malicious programs that change a user’s web browser settings, usually altering designated default start and search pages. In addtion a browser hijacker can modify nearly every aspect of a web browser including adding bookmarks, and redirecting search traffic to alternative sites.

  • mwsoemon.exe - My Web Search Bar for Internet Explorer, email clients, and messenger clients.
  • mwsoestb.dll - My Web Search Plugin Loader

MWSOEMON shown on the task manager ( Press Ctrl-Alt-Del ), then try to end the task of the process mwsoemon.

Typical infected files locations:

  • c:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
  • c:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
  • c:\program files\mywebsearch\bar\2.bin\mwsbar.dll
  • c:\program files\mywebsearch\srchastt\2.bin\mwssrcas.dll

Typical Infected folders:

  • c:\program files\mywebsearch
  • c:\program files\mywebsearch\bar
  • c:\program files\mywebsearch\srchastt
  • c:\program files\mywebsearch\bar\2.bin
  • c:\program files\mywebsearch\srchastt\2.bin

Uninstall Myway MySpeedbar from Start Button : Control Panel > Add/Remove programs. It might be called ’My Search Bar’, ’MyWay Speed Bar’ or ’My Web Search Bar’, Click ’Remove’ for what you find. Also remove ’Fun Web Products Easy Installer’ if it is present.

Registry (Hijackthis analsysis) Entries made by MWSOEMON:

  • O2 - BHO: Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBHOSTIE.DLL
  • O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
  • O3 - Toolbar: &Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBHOSTIE.DLL
  • O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
  • O4 - HKLM\..\Run: [Hotbar] C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBINST.EXE /Upgrade

If not you can remove them manually by running Regedit and find MWSOEMON and delete the key. Try searching for LSvr; LTDMgr; websearch; WebSearch Email Plugin. Or ’HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run’ and delete the values called ’WebSavingsfromEbates’, ’websearch’ and ’couponsandoffers’.

Restart computer.

Use the Find (Start Button : Search) and locate file MWSOEMON.EXE and delete it. Try to locate and delete websearch1.exe; MWSOEMON.EXE; MWSSRCAS.DLL; Toolbar.dll.

Browse your computer c: drive "Program Files\mywebsearch\" folder and remove it.


HijackThis is a useful tool, that lists all installed browser add-on, buttons, startup items and allows you to inspect, and optionally remove selected items. The program can create a backup of your original settings and also ignore selected items. Additional features include a simple list of all startup items, default start page, online updates and more. Intended for advanced users.

Download HijackThis


Background : WebSavings is installed from the vendors site or when installing other applications, such as the Morpheus file sharing program. Installation of Web Savings From Ebates Software. WebSavings is a shopping tool that open pop-up windows. It can also uninstall other software components that interfere with WebSavings.


  1. On 02-Sep-2007, Maksimil wrote: 
    All Greetings !...
    You want to buy a mobile phone?...Nothing think !...
    You look at Mobile telephone!
    Your reply to Maksimil

  2. On 31-Aug-2007, Timurchin wrote: 
    Hey All ! ! !
    You have health problems, you have difficulty in choosing medicines,
    visit DoctorTabs,
    and your problems instantly disappear!
    Your reply to Timurchin

  3. On 30-Aug-2007, Alextoss wrote: 
    Hey All ! ! !
    Want to spend your vacation to be remembered for long?
    Tourism ...
    help you carry out your wishes !
    Your reply to Alextoss

  4. On 10-Sep-2006, Welshexport wrote: 
    My son has managed to get a virus which seems to have infected the bios at first I couldn´t get into the hard drive I tried booting from a floopy disc at first I was just getting streams of letter a´s and then it booted into the A drive and I used fdisk to access the disk now I have formatted the hard drive I can load windows back on but the bios have lines like the matrix going through them I could type more but before I do has anybody got any ideas,,,,when I load windows back on that also looks like the matix just loads of vertical lines.....before I used fdisk I did write down the virus responsible Mywebsearch bar 1.bin mwsbar.dll as i have said my son did not have his antivirus enabled in the bios although he is running avast 4.7 which updates every day I can,t understand why this has happened....He now has a clean but empty hard drive but every time I load windows on it looks the same as the bios and will only start in safe mode I have tried running msconfig and this doesn´t achieve anything can anybody help is there a small programme that I can use on a floppy to destroy this virus as I can access the floppy drive any help woud be appreciated

    Thanks Richard

    Your reply to Welshexport

  5. On 05-Aug-2006, Jc wrote: 
    I don´t want to remove it, I already know how to do that, I want the name and address of the author or company, that invaded my privacy. In this state it is legal to shot uninvited guests.
    Your reply to Jc

  6. On 14-Dec-2005, Anonymous wrote: 
    When I try to remove it, it pops into a window that claims to be from sybot.
    Your reply to Anonymous

  7. On 27-Oct-2005, Kirk wrote: 
    The safest way to remove MyWebSearch is to go to your control panel, and select Add/Remove Programs and find "My Web Search", click on it and then "Change/Remove" to initiate the uninstall process. After a reboot, all the files will be removed from your system. That´s all you have to do.

    Contrary to this article, the software is not spyware/malware, and full information on it can be found here:

    http://help.funwebproducts.com/ns/myway-websearch.html

    Looking at their Registry Entries, I can see that they have us mixed in with Hotbar, which is a known adware vendor with a similar product to our Smiley Central.

    Ask Jeeves
    (Owner of FunWebProducts and MyWebSearch)

    Your reply to Kirk
    • On 03-Feb-2007, Kirk replied: 
      i have avast 14.7 and i tryed to down load smiley centrel funweb and smiley centrel and a warning comes up and says it may contain a virus i tryed to uninstole smiley centrel and than restole it again it still wont let me tell me what i can do to fix this problem i really like funweb and smiley centrel tell me what i can do to fix this problem thank you
      Your reply to Kirk

  8. On 24-Aug-2005, Nimporte wrote: 
    Is this something an individual put on my computer or was it put ther by a company or someone I do not know?
    Your reply to Nimporte
    • On 18-Dec-2005, Rosedeam replied: 
      I want the s attention off of my computer and the rose arrow
      Your reply to Rosedeam

  9. On 14-Jul-2005, Pissed Offed wrote: 
    some one put up a link or something on how to remove this thing its buggen me...or any other ideas how to remove it?
    thnx a bunch
    Your reply to Pissed Offed

  10. On 24-Mar-2005, Anonymous wrote: 
    wana right the way to remove it in english please? meaning i cant really understand wt to do
    Your reply to Anonymous

Leave your message, comment or feedback:
Your Name (shown) & Your E-mail (hidden) is used only to alert you when someone reply your message.