Help with unwanted toolbar

[the_saint]

i have a toolbar that i didn't install and wont go away, iv tried many spywayre progs and none have found it, and i carnt even opposite click on it and not show it or even go to view, toolbars to disable it, how can i get rid of it???

[puff-m-d]

Hi the_saint,

Welcome to Widers!!!

I have moved your thread to a more appropiate forum (privacy problems) where it will get more attention.

The first thing that I would check is to see if you have an entry for it in add/remove programs as a lot of toolbars will put an entry there.....

[Huwge]

Can you tell us the name of the bar and which anti spyware youve tried please?

[the_saint]

iv check the add/remove already and there is nothing there
iv used ad-aware se, spysweeper,spybot S&D, counterspy, spydoctor, CWS shredder and spy subtract and none have found anything

here is a link what it looks like
http://img.photobucket.com/albums/v201/the_saint_matt/bar.jpg

[siliconman01]

Can you turn it off by opening IE, going to TOOLS--MANAGE ADD-ONS, locating the toolbar and disabling it?

[the_saint]

there is no manage add ons under tools

[Infinity]

you should install sp2 then :) cause it will offer a lot against spyware and security in general

[the_saint]

i have automatic updates on and have the latest

[Pieter_Arntz]

Click Start > Run > type or copy&paste regedit /e c:\toolbars.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar" > OK

This will create the file c:\toolbars.txt
Post the content of that file please.

Regards,

Pieter

[the_saint]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{8E718888-423F-11D2-876E-00A0C9082467}"=hex:00
"{08BEC6AA-49FC-4379-3587-4B21E286C19E}"="SearchToolbar"

[Pieter_Arntz]

Hi the_saint,

Good job. Could you please find a file called ie2cltr.dll (probably in your System(32) folder) and mail it to me?

You can find the address in my profile (left bottom corner).

Then copy the part in bold below into notepad and save the file as tlbrem.reg

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{08BEC6AA-49FC-4379-3587-4B21E286C19E}"=-

Close all IE windows and doubleclick that file we made. Confirm that you want to merge it with the registry.

That should get it out of IE.

Let me know,

Pieter

[Pieter_Arntz]

Glad to hear by mail that the fix worked and thanks for the file.

{QUOTE-> well i did what you said and it worked thanks very much, could you explain
what that was? did it attach itself to IE somehow so the spyware couldn't
find it? <-QUOTE}

I am not quite sure where you got it, but the file you sent me was identified as:
ie2cltr.dll - infected by not-a-virus:AdWare.ToolBar.SBSoft.h

I'll take the file apart and if I find out how you might have been infected, I'll let you know.

Regards,

Pieter

[the_saint]

think it got on my pc when i was redirected to some dogy site

[nadirah]

the_saint, I see in your screenshot in one of your posts in this thread that you're using Internet Explorer. IE is vrey dangerous, it is the most common avenue of spyware and malware attacks. Try using an alternative browser like Firefox. Also, use XP SP2. Visit Microsoft's site for more detalis.

[nadirah]

{QUOTE-> iv check the add/remove already and there is nothing there
iv used ad-aware se, spysweeper,spybot S&D, counterspy, spydoctor, CWS shredder and spy subtract and none have found anything

here is a link what it looks like
http://img.photobucket.com/albums/v201/the_saint_matt/bar.jpg <-QUOTE}

Did you notice that there is a pornography *thing* on the taskbar in the screenshot at the link above!? :o

[the_saint]

i find other browsers too restrictive, anyway the prob has been fixed thx to Pieter_Arntz and that site on the bottom there is http://www.faceparty.com/ where you can make a profile and meet people online of you age for free

[Pieter_Arntz]

the_saint,

If you haven't already, please download and install BHODemon (http://www.definitivesolutions.com/bhodemon.htm)
I have found during my research that this file also installs itself as a BHO.
BHODemon will help you disable it.

If you need any help in doing so, you know where to post. ;)

Regards,

Pieter

[Stephanos G.]

Have you tried the CounterSpy? It can remove the BHO's.
Try here (http://www.sunbelt-software.com/CounterSpy.cfm)
Free Evaluation Download

[Pieter_Arntz]

If Counterspy recognizes this file as spyware, it will have exceeded my expectations by very far. ;)

Regards,

Pieter

[the_saint]

thx will d/l that thing, yer i already used counterspy to try an get rid of it

[GForce]

Pieter,

Thanks. I thoroughly enjoyed this interesting lesson. ;)
~ from a newbs perspective that is... :D


GF

[Pieter_Arntz]

I'll take that as a compliment GForce. 8)

Regards,

Pieter

[GlobalForce]

Please do. ;D

GF