Additional toolbar on internet explorer

[Guest]

When starting Ie6 for first time, a toolbar appears on the bottom of the
screen. It's got headings like music,casino, shoppping, all stuff similar to
the cool web search junk.It has a cross to shut it down so I shut it down &
it stays off.
I've run the coolweb search shredder but it finds nothing. I've run spybot &
ad-aware & they don't find anything either.
Any clues to miy next step to get rid of it?

thanks in advance

 

[Frank Saunders, MS-MVP IE/OE]

When starting Ie6 for first time, a toolbar appears on the bottom of
the screen. It's got headings like music,casino, shoppping, all stuff
similar to the cool web search junk.It has a cross to shut it down so
I shut it down & it stays off.
I've run the coolweb search shredder but it finds nothing. I've run
spybot & ad-aware & they don't find anything either.
Any clues to miy next step to get rid of it?

thanks in advance

Try ToolbarCop:
http://www.mvps.org/sramesh2k/toolbarcop.htm

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Jan Il]

Hi Jester

Try the following and see if it helps:

Unwanted Toolbars - How to get rid of them

Using ToolbarCop to remove the unwanted Toolbands, Toolbar icons and Browser
Helper Objects
http://www.mvps.org/sramesh2k/utils/ToolbarCop.exe

or.......

Unwanted Toolbars - Get Rid of

Utility: Internet Explorer Toolbar settings utility.
http://www.mvps.org/sramesh2k/IEFAQ.htm

If these steps do not resolve your problem, please post back to this thread
with the details and any error messages.

Hope this helps

Jan
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 

[Alan Edwards]

Using ToolbarCop to remove the unwanted Toolband, Toolbar Icons and
BHO:
http://www.mvps.org/sramesh2k/toolbarcop.htm

....Alan

 

[Ramesh [MVP]]

Hi Jester,

Once you download ToolbarCop, click Tools menu and choose "Scan for Search bars". This should list all the side-search and the bottom bars.

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org


When starting Ie6 for first time, a toolbar appears on the bottom of the
screen. It's got headings like music,casino, shoppping, all stuff similar to
the cool web search junk.It has a cross to shut it down so I shut it down &
it stays off.
I've run the coolweb search shredder but it finds nothing. I've run spybot &
ad-aware & they don't find anything either.
Any clues to miy next step to get rid of it?

thanks in advance

 

[Guest]

OK, I ran the toolbarcop & disabled all suspect items, no good though. I
disabled all suspect items via manage toolbar add-ons, but no joy. The tool
bar appears as a separate tool bar at the base of ie6, so if you close ie6
the toolbar remains. I can't seem to post a screen shot of it, so I'll
describe whats on it.
Blue two level bar with symbols & headings followed by
top level (symbol)& Make Money,(symbol)Music (symbol)Casino
lower level (symbol) Travel (symbol)mortgage (symbol)Credit

& then boxes with the words Dating,Travel,Casino,Computer & Insurance & then
a search bar & a magnifying glass

Here's hoping someone can get rid of it

 

[Frank Saunders, MS-MVP IE/OE]

OK, I ran the toolbarcop & disabled all suspect items, no good
though. I disabled all suspect items via manage toolbar add-ons, but
no joy. The tool bar appears as a separate tool bar at the base of
ie6, so if you close ie6 the toolbar remains. I can't seem to post a
screen shot of it, so I'll describe whats on it.
Blue two level bar with symbols & headings followed by
top level (symbol)& Make Money,(symbol)Music (symbol)Casino
lower level (symbol) Travel (symbol)mortgage (symbol)Credit

& then boxes with the words Dating,Travel,Casino,Computer & Insurance
& then a search bar & a magnifying glass

Here's hoping someone can get rid of it

First eliminate any scumware.
CAUTION!!!!! Before you try to remove spyware using any of these programs ,
download a copy of LSPFIX from any of the following sites:
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.

See
Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Note that AdAware and SpyBot S & D will each catch some things the other
won't. Also, each needs to be updated with the program's update function
before every use, even when just downloaded. There's also a lot more to do
than just those two programs. CWShredder is also available here:
http://www.kellys-korner-xp.com/regs_edits/cwshredder.zip
**Post your HijackThis log to
http://forums.spywareinfo.com/ or the Spyware forum at
http://forum.aumha.org/ for expert analysis, not here.**
Alternative download pages for Ad-Aware, Spybot, HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.


See this link for information about malware:
http://arstechnica.com/articles/paedia/malware.ars

If nothing there helps, please post back to this thread.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Ramesh [MVP]]

As Frank said, running spyware cleaners is a _must_. It would also be good if you can identify the Explorer bar's product / DLL name. Once in Toolbarcop, click "Scan for search bars" and then post the "Explorer bar" details here (generate a log)

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org


OK, I ran the toolbarcop & disabled all suspect items, no good though. I
disabled all suspect items via manage toolbar add-ons, but no joy. The tool
bar appears as a separate tool bar at the base of ie6, so if you close ie6
the toolbar remains. I can't seem to post a screen shot of it, so I'll
describe whats on it.
Blue two level bar with symbols & headings followed by
top level (symbol)& Make Money,(symbol)Music (symbol)Casino
lower level (symbol) Travel (symbol)mortgage (symbol)Credit

& then boxes with the words Dating,Travel,Casino,Computer & Insurance & then
a search bar & a magnifying glass

Here's hoping someone can get rid of it

 

[Guest]

I did run latest versions of both adaware & spybot before using toolbarcop, &
ran CWshredder. (Shredder found nothing)I have disabled all additional
toolbars that the log would allow me too, both using toolbarcop & from within
ie6 by manage add-ons & still it remains. It does not appear to be in the
log, when I scan for search bars. I have searched the registry using
"toolbar" but nothing suspect appears.
I'm using xp on a broadband connection, so I don't have any dialler issues.
As requested I will post the search results here later.

 

[Ramesh [MVP]]

Jester,

In Toolbarcop, have you clicked "Scan for search bars" in the Tools menu? Then generate a log using the notepad icon in the toolbar.

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org


I did run latest versions of both adaware & spybot before using toolbarcop, &
ran CWshredder. (Shredder found nothing)I have disabled all additional
toolbars that the log would allow me too, both using toolbarcop & from within
ie6 by manage add-ons & still it remains. It does not appear to be in the
log, when I scan for search bars. I have searched the registry using
"toolbar" but nothing suspect appears.
I'm using xp on a broadband connection, so I don't have any dialler issues.
As requested I will post the search results here later.

 

[Guest]

Yes, I have used the scan for search bars option. As mentioned earlier, I
have disabled everthing that I am allowed to, but still it appears on
starting Ie.
I will post the log to this thread later, as I am not on my pc at present.

 

[Guest]

Here is the log detail
Browser Extension: n/a - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - n/a -
Disabled - All Users

Browser Extension: Create Mobile Favorite -
{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft
ActiveSync\INETREPL.DLL - Disabled - All Users

Browser Extension: n/a - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program
Files\Microsoft ActiveSync\INETREPL.DLL - Disabled - All Users

Browser Extension: Real.com - {CD67F990-D8E9-11D2-98FE-00C0F0318AFE} -
C:\WINDOWS\system32\Shdocvw.dll - Disabled - All Users

Browser Extension: Messenger - {FB5F1910-F110-11D2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe - Disabled - All Users

Toolbar: &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} -
%SystemRoot%\system32\SHELL32.dll - Enabled - Current User

Toolbar: &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} -
%SystemRoot%\system32\browseui.dll - Enabled - Current User

Toolbar: (Empty) - {4E7BD74F-2B8D-469E-A0E8-F479B685FA7D} - (empty) -
Disabled - Current User

Toolbar: Web assistant - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - C:\Program
Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll - Disabled -
Current User

Toolbar: Web assistant - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - C:\Program
Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll - Disabled - All
Users

Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll -
Disabled - All Users

BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - Disabled
- All Users

BHO: (Empty) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
Files\Spybot - Search & Destroy\SDHelper.dll - Disabled - All Users

BHO: (Empty) - {965884D9-5CF1-C256-1903-D340B7998B46} -
C:\DOCUME~1\Ami\APPLIC~1\STYLEO~1\nurbaim.exe - Disabled - All Users

BHO: CNisExtBho Class - {9ECB9560-04F9-4BBC-943D-298DDF1699E1} - C:\Program
Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll - Disabled - All
Users

BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll - Disabled - All
Users

Explorer Bar - Vertical: Search Band -
{30D02401-6A81-11D0-8274-00C04FD5AE38} - %SystemRoot%\system32\browseui.dll -
Enabled - All Users

Explorer Bar - Horizontal: &Tip of the Day -
{4D5C8C25-D075-11D0-B416-00C04FB90376} - %SystemRoot%\system32\shdocvw.dll -
Enabled - All Users

Explorer Bar - Horizontal: &Discuss - {BDEADE7F-C265-11D0-BCED-00A0C90AB50F}
- shdocvw.dll - Disabled - All Users

Explorer Bar - Vertical: File Search Explorer Band -
{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} - %SystemRoot%\system32\SHELL32.dll -
Enabled - All Users

Explorer Bar - Vertical: Favorites Band -
{EFA24E61-B078-11D0-89E4-00C04FC9E26E} - %SystemRoot%\system32\shdocvw.dll -
Enabled - All Users

Explorer Bar - Vertical: History Band -
{EFA24E62-B078-11D0-89E4-00C04FC9E26E} - %SystemRoot%\system32\shdocvw.dll -
Enabled - All Users

Explorer Bar - Vertical: Explorer Band -
{EFA24E64-B078-11D0-89E4-00C04FC9E26E} - %SystemRoot%\system32\shdocvw.dll -
Enabled - All Users

Explorer Bar - Horizontal: Real.com - {FE54FA40-D68C-11D2-98FA-00C0F0318AFE}
- C:\WINDOWS\system32\Shdocvw.dll - Disabled - All Users

If you need the list of running processes they are:-

\SystemRoot\System32\smss.exe
\??\C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Zoom\CnxDslTb.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Malcolm\My Documents\Dad's
Stuff\Media\Toolbarcop\toolbarcop.exe

 

[Ramesh [MVP]]

Jester,

{FE54FA40-D68C-11D2-98FA-00C0F0318AFE}is the only Explorer bar item there. This may require HijackThis log examination. If you've disabled the add-ons using Toolbarcop, enable them and the follow-up with HijackThis.

Visit http://forum.aumha.org/index.php and register there. Scroll down to the "HijackThis Logs" section: Read the preliminary advice given here: http://forum.aumha.org/viewtopic.php?t=4075 Then post your HijackThis Log here: http://forum.aumha.org/viewforum.php?f=30

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org


Here is the log detail
Browser Extension: n/a - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - n/a -
Disabled - All Users

Browser Extension: Create Mobile Favorite -
{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft
ActiveSync\INETREPL.DLL - Disabled - All Users

Browser Extension: n/a - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program
Files\Microsoft ActiveSync\INETREPL.DLL - Disabled - All Users

Browser Extension: Real.com - {CD67F990-D8E9-11D2-98FE-00C0F0318AFE} -
C:\WINDOWS\system32\Shdocvw.dll - Disabled - All Users

Browser Extension: Messenger - {FB5F1910-F110-11D2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe - Disabled - All Users

 

[none]

Try typing something in the search bar and then do the search. See where it
takes you. From there look around the search engine's page for any hint of
a removal method. I did this with a couple of hijackers and it worked
without spending money on 50,000 spyware removal tools.