MYWeb Watch is a hijacker app that uses stealthy and misleading ways to embed itself inside browsers like Chrome, Edge, and Brave in order to redirect users to various pages.
At first glance, MYWeb Watch may look like a regular app, but it’s actually rogue platform designed to make money by collecting your data and promoting various other sites, some of which might be harmful. My research suggests MYWeb Watch is currently set to redirect users through a series of questionable pages before landing them on a rogue search engine called potterfun.
OFFEROne way it gains access to the browser is by tricking you into giving it notification and redirect permissions. To do this, it uses fake captchas and site access prompts. The other way it could take over the browser is with the help of a hijacker extension that gets installed through file bundles.
No matter how you got MYWeb Watch inside your browser, I strongly recommend to get rid of it. The following tutorial will explain how.
MYWeb Watch Removal Guide
I always recommend that you first try the regular uninstallation method, even when trying to remove a rogue app like MYWeb Watch. Sometimes this could work, and if it does, you won’t need to spend upwards of an hour to complete the more detailed guide below:
- Open “Apps & Features” from the Start Menu and sort the list by installation date
- Look for programs added around the time MYWeb Watch appeared. Obviously, look for MYWeb Watch too.
- If you see MYWeb Watch there or another strange app, uninstall it by clicking on it, then selecting “Uninstall”, and following any prompts.
- If you know the location where the removed apps were installed, go there and check for remaining files and folders. If you find anything, delete it.
I won’t lie to you, this will most likely not work. Restart your PC and see if MYWeb Watch is gone, and if it is, great, no need to go any further.
Video walkthrough for this step:
However, if you are still noticing the signs of its presence, you’ll have to resort to the more advanced steps I’ve prepared for you below. Don’t worry, they’ll help you get rid of the hijacker – you just need to follow them carefully.
SUMMARY:
Important! Read Before Continuing
You may spend anywhere between half an hour to an hour and a half removing this adware with the following steps. Also, I recommend having at least some base level of technical experience when performing this guide.
If you think you lack the necessary experience or if you don’t have the time, the alternative that I recommend is using a specialized removal tool. The anti-malware program that I recommend is called SpyHunter and it will take care of the adware in no time. You can find the tool linked on this page.
How to Remove the MYWeb Watch Virus
There are two preparatory steps you must complete before starting the actual removal:
- Install LockHunter – This is a small free utility that unlocks files that you can’t delete normally. I know some of you prefer not to download third-party tools, but this one is essential for the completion of some of the following steps, so you’ll need to get it if you want to successfully get rid of MYWeb Watch.
- Reveal hidden files and folders visible – Open “Folder Options” using the Start Menu. In the View section, choose “Show hidden files, folders, and drives”. Click “Appl”, then “OK”. This will make hidden files and folders on your PC appear transparent.
How to Show Hidden Files and Folders
Now we can move on to the removal itself, starting with the files MYWeb Watch has created in your system.
How to Delete MYWeb Watch Virus Files
There are several locations where you might find files that the adware has created. You must go to each of them and delete any rogue data present there.
First, go to C:\Users\YourUsername\AppData\Roaming.
Look for folders named MYWeb Watch or something similar and delete them. Also delete any other folders with strange, unfamiliar names that you suspect of being linked to the adware.
Most adware I encounter these days comes from the same person or group of people who always go under a different name that’s supposed to be their (fake) company. Look for strangely-named folders and you’ll easily notice the odd one out.
For example, two adware apps I recently encountered were developed by “Yusiq Axo S” and “Trix Winqz Ro” respectively. These are the same people, only under different fake names. Look for similarly-named folders in your system and if you find any, delete them.
It’s possible that you get blocked from deleting the adware folder because one or more files in it are in use. That’s why you need LockHunter.
If you already have it installed on your PC, right-click the undeletable folder, select the “What’s locking it?” option, and choose “Delete it” in the next window. Do this for every file or folder that you can’t delete normally.
How to Delete Persistent Files with Lock Hunter
The next location you must go to is your Temp folder:
- C:\Users\*Your Username*\AppData\Local\Temp
Remove everything in it – all files and folders – to eliminate hidden malware traces.
The next two locations you should check are:
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
- C:\Users\YourUsername\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
As before, look for strangely-named folders or folders named MYWeb Watch and delete them, using LockHunter if needed.
The last two locations you need to visit are the Program Files and Program (x86) folders in the C: drive. Search them for anything weird or unfamiliar and delete what you think might be from the malware.
Get Rid of MYWeb Watch Scheduled Tasks
MYWeb Watch can use scheduled tasks to reinstall itself after you delete it or to automatically run rogue processes without your permission. You must, therefore, carefully search the Task Scheduler for adware/malware tasks and delete them.
Access the Task Scheduler through the Start Menu search.
Open the Task Scheduler Library at the top-left corner and examine the listed tasks.
Double-click each task go to “Actions”, and see what it’s set to do.
If any tasks are set to run a suspicious file (especially executables), download something, visit an unfamiliar site, or run a suspicious script, you’d best delete that task.
Inspect all of them carefully – don’t miss any of the tasks. It takes a bit of time but prevents MYWeb Watch from reappearing.
Video walkthrough for this step:
Remove the MYWeb Watch Malware From the Registry
MYWeb Watch has made changes to your Windows Registry. It has added its settings there and you must find and delete them.
Open the Registry Editor with admin permissions. You’ll find the Editor by typing “regedit” in the Start Menu.
Use Ctrl + F, search for entries labeled “MYWeb Watch”, and delete the first found registry key. You’ll then need to search because there are probably more related keys.
Then also search for the name of the adware’s developer – the weird folder name that you may have found when looking for MYWeb Watch data in your system.
Search for it too and delete any related items.
Then, in the left panel of the Editor, manually go to the following locations, select each one, and inspect its contents to the right.
See if any values to the right seem linked to MYWeb Watch and delete them. However, do not delete the key that contains those values. These keys must stay intact.
Video walkthrough for this step:
Delete MYWeb Watch Malware Policies
Many adware programs embed themselves in browsers. There, they set policies that let them take over while also limiting your control of the browser’s settings.
One sign of MYWeb Watch’s presence in the browser is the “Managed by your organization” message in the program’s menu and settings page.
Here’s how to remove that policy to regain control of the browser:
Search for the Group Policy Editor in the Start Menu and open it.
Navigate to Computer Configuration > Administrative Templates and right-click the latter.
Select “Add/Remove,” and delete any items in the next window.
If this doesn’t solve everything, I’ve got an extra solution, but only if you are using Google Chrome:
Download a free tool called Chrome Policy Remover offers a convenient solution. Windows Security and your AV (if you have one) might warn you about the app, but it’s perfectly safe, so ignore the warnings and launch the Chrome Policy Remover with Admin rights.
The tool will then automatically do its job and remove any Chrome policies without needing further input from you.
Video walkthrough for this step:
Manual Group Policy Removal
Automatic Group Policy Removal
Uninstall MYWeb Watch From Your Browser
Once you delete the rogue policies, you’ll regain control of your browser settings and you’ll be able to perform a full browser cleanup:
First, check the Extensions section (browser menu > Extensions/Extensions Manager). Uninstall any extensions you do not recognize.
Go to Privacy and Security to clear your browsing data. Delete everything except saved passwords. I recommend choosing “All Time” as a deletion range to make sure there’s nothing left that could be linked to the adware.
Next, find the Site Settings. Chrome users have it under Privacy and Security. Microsoft Edge has it as a separate section – Cookies and Site Permissions.
Go there and check all permission types for unfamiliar or suspicious URLs. Delete or block any such URLs you may come across.
Next, you need to ensure your browser’s default search provider is set to something reliable. Go to the Search Engine settings, see if your search engine has been modified without your permission, and change it back.
Then open Manage Search Engines to see if the list includes any sketchy providers/URLs and delete those.
Video walkthrough for this step:
Chrome
Microsoft Edge
Mozilla Firefox
Check the On Startup settings tab for weird addresses and delete them. Then do the same in the Appearance settings.
Leave a Comment