{
  "family": "mywebsearch",
  "sample_count": 223,
  "category": "adware",
  "description": "Adware:Win32/MyWebSearch is one of the most historically prevalent and intrusive browser hijackers and adware networks, notorious for forcefully installing toolbars, altering search settings, and relentlessly tracking user browsing behavior.<br><br><b>What is MyWebSearch?</b><br>To the average user, MyWebSearch renders the browsing experience infuriating, replacing their default homepage and search engine with affiliate-branded portals (often riddled with sponsored ads) and injecting a bulky toolbar into the browser UI. For IT security teams, it represents a significant compliance and privacy risk. MyWebSearch acts as a persistent Man-in-the-Browser, intercepting all search queries to harvest marketing data and generate illicit ad revenue.<br><br><b>Infection Vectors & Threat Hunting</b><br>MyWebSearch is primarily distributed via aggressive software bundling. It employs deceptive installation wizards attached to freeware (like screensavers, cursors, or media converters). Once executed, it drops malicious extensions, BHOs (Browser Helper Objects), and toolbars across all installed browsers (Internet Explorer, Chrome, Firefox). To evade removal, MyWebSearch deeply embeds itself in the Windows Registry (<code>HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar</code>) and frequently modifies Windows shortcut files (<code>.lnk</code>) to append its URL to the browser execution path.<br><br><b>Forensic Analysis & Impact</b><br>Threat hunters can easily identify MyWebSearch by inspecting the properties of browser shortcuts for appended URLs. The Windows Registry will contain numerous unauthorized modifications, often utilizing Group Policy to prevent the user from disabling the malicious extensions. Network traffic will show all search queries being funneled through the MyWebSearch tracking infrastructure before reaching legitimate engines. The impact is a severely degraded user experience and a massive loss of privacy.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.009",
    "T1112",
    "T1176",
    "T1189",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1547.009",
      "name": "Boot or Logon Autostart Execution: Shortcut Modification",
      "tactic": "Persistence"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Deploy specialized adware removal utilities (like AdwCleaner or Malwarebytes) to locate and strip the forced Group Policies, BHOs, and deep registry hooks.",
    "Manually audit every web browser shortcut (<code>.lnk</code>) on the system and remove the appended MyWebSearch URL from the 'Target' field.",
    "Reset all web browsers to their factory defaults to completely purge the rogue extensions and toolbars.",
    "Audit the 'Add/Remove Programs' list to uninstall the core MyWebSearch application and any bundled screensavers or cursors."
  ],
  "what_to_avoid": [
    "Do not trust the browser's built-in extension manager for removal, as MyWebSearch frequently uses Group Policy to gray out the 'Remove' option.",
    "Avoid ignoring the infection; the tracking infrastructure actively harvests browsing habits, presenting a significant privacy violation."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}