'Interesting' blocked toolbar behaviour

[Guest]

My AV subscriptions axpired for a while, and while my AV
program was out of date a toolbar installed itself
(Alexa). I tried to follow the uninstall routine on the
Amazon website, but could not find an Alexa entry in the
Ad/Remove programs list as it describes (don't worry, this
does have something to do with AntiSpyware!).

I eventually located the DLLs by hand and deleted them.
This got rid of the toolbar, but not the entry in the IE
View-->Toolbars menu list. When I use AntiSpyware it
lists two Symantec toolbars (Personal Firewall and
Antivirus), one that it calls '&radio' (don't know what
that is)...and the Alexa toolbar. 'Great', I thought, 'I
can get rid of the Alexa toolbar entry.' When I choose to
block the Alexa toolbar, it does a series of interesting
things.

a) A new item appears at the bottom of the toolbar list in
Antispyware marked simply 'Internet Explorer Toolbar...'
flagged as unknown.
b) The IE entry for Norton Antivirus now invokes the
Personal Firewall toolbar
c) The IE entry for the Alexa toolbar not only is still
present, but invokes the Norton Antivirus toolbar
d) The IE entry for the Norton Antivirus toolbar brings up
a 'This page cannot be displayed' message.

Now that I've unblocked the Alexa toolbar, the two Norton
entries point to Norton items (the wrong ones, though;
Antivirus to Personal Firewall and vice versa), and the
Alexa entry produces the 'This page cannot be displayed'
message.

I am not running any other antivirus or antispayware
applications.

Regards,

Des Weller

 

[Mikolaj]

My AV subscriptions axpired for a while, and while my AV

program was out of date a toolbar installed itself
(Alexa). I tried to follow the uninstall routine on the
Amazon website, but could not find an Alexa entry in the
Ad/Remove programs list as it describes (don't worry, this
does have something to do with AntiSpyware!).

I eventually located the DLLs by hand and deleted them.
This got rid of the toolbar, but not the entry in the IE
View-->Toolbars menu list. When I use AntiSpyware it
lists two Symantec toolbars (Personal Firewall and
Antivirus), one that it calls '&radio' (don't know what
that is)...and the Alexa toolbar. 'Great', I thought, 'I
can get rid of the Alexa toolbar entry.' When I choose to
block the Alexa toolbar, it does a series of interesting
things.

a) A new item appears at the bottom of the toolbar list in
Antispyware marked simply 'Internet Explorer Toolbar...'
flagged as unknown.
b) The IE entry for Norton Antivirus now invokes the
Personal Firewall toolbar
c) The IE entry for the Alexa toolbar not only is still
present, but invokes the Norton Antivirus toolbar
d) The IE entry for the Norton Antivirus toolbar brings up
a 'This page cannot be displayed' message.

Now that I've unblocked the Alexa toolbar, the two Norton
entries point to Norton items (the wrong ones, though;
Antivirus to Personal Firewall and vice versa), and the
Alexa entry produces the 'This page cannot be displayed'
message.

I am not running any other antivirus or antispayware
applications.

Regards,

Des Weller

I actually can't help you with the "mixed" Norton entries, but maybe provide
some clues to remove Alexa at least.

First - if you suspect any malware in your system, please send the Suspected
Spyware Report to SpyNet through the MSAS Tools menu - it will help to
detect and hopefully remove such threats in the future.

Second - the best way to clean the system (in case of having one of
2000/XP/2003) is to start it in the Safe mode (F8 during boot-up), run
Windows Explorer, go to your profile temporary folders (usually C:\Documents
and Settings\username\local settings\temp and c:\Documents and
Settings\username\local settings\Temporary Internet Files\Content.IE5) and
delete all the files in those directories and subdirectories.
Then do a full system scan with MS AntiSpyware (check the proper option
under Scan settings). Also using some other "cleaning" software such as:

Spybot Search&Destroy http://www.majorgeeks.com/download2471.html
HijackThis http://www.majorgeeks.com/download3155.html
CWShredder http://www.majorgeeks.com/download3019.html
Ad-Aware SE Personal http://www.lavasoft.com/software/adaware/
McAfee Stinger http://vil.nai.com/vil/stinger/

Also you can try the solution provided here
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453075454

 

[JohnF.]

Download BHODemon and see if you can remove the toolbar by that route rather
than blocking it.

http://www.majorgeeks.com/download3550.html