iSearch toolbar

[Rollie]

Recently an iSearch toolbar was mysteriously added to my
explorer 6 toolbar. I removed the installation/activation
program for this unwanted component, but have been unable
to remove the toolbar itself. When I use View-Toolbars-,I
do not get Customize as an option. Instead, I get Standard
Buttons, Address Bar, Links, McAfee Virus Scan, and
iSerach Toolbar as options (all non-highlighted and
inactive) and Text Labels (Highlighted and active). Does
anyone have any suggestions for eradicating this pesky
piece of junk?

 

[Jim Byrd]

Hi Rollie - Sounds like this might be a variant of some malware called
CoolWebSearch (if not, then see AdAware, SpyBot, and HijackThis, below). Do
the following:

Download, UPDATE before running, and run:
http://209.133.47.200/~merijn/files/CWShredder.exe to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: http://www.zerosrealm.com/downloads/CWShredder.zip

You will need to show Hidden files first and then at the end disable System
Restore and then reboot your system in order to clear the malware garbage
from the backups after you've cleaned up. It's best to perform CWShredder
(and most other malware fixers too) from Safe mode and then reboot. After
cleaning things up, then you can disable and then re-enable System Restore.
See ******** below.

The following links give instructions on how to do these various functions:


HOW TO Restart in Safe Mode
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406>

HOW TO Enable Hidden Files
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339>

HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039>
(WinXP)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239>
(WinME)



Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093#appliesto

which blocks the exploit upon which this parasite family depends.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions.


However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm



If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Unzip the downloaded HijackThis to any convenient folder, start it then
press Scan. Click on SaveLog when it's finished which will create
hijackthis.log. Now click the Config button, then Misc Tools and click on
Generate StartupList.log which will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Rollie]

Thanks for the tips regarding the removal of the iSearch
toolbar. Looks like I have my work cut out for me.
Regards,
Rollie

-----Original Message-----
Hi Rollie - Sounds like this might be a variant of some malware called
CoolWebSearch (if not, then see AdAware, SpyBot, and HijackThis, below). Do
the following:

Download, UPDATE before running, and run:
http://209.133.47.200/~merijn/files/CWShredder.exe to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: http://www.zerosrealm.com/downloads/CWShredder.zip

You will need to show Hidden files first and then at the end disable System
Restore and then reboot your system in order to clear the malware garbage
from the backups after you've cleaned up. It's best to perform CWShredder
(and most other malware fixers too) from Safe mode and then reboot. After
cleaning things up, then you can disable and then re- enable System Restore.
See ******** below.

The following links give instructions on how to do these various functions:


HOW TO Restart in Safe Mode
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/ 2001052409420406>

HOW TO Enable Hidden Files
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/ 2002092715262339>

HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/ 2001111912274039>
2001012513122239>
(WinME)



Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093#appliesto

which blocks the exploit upon which this parasite family depends.

Now download and run:
http://www.kellys-korner-

xp.com/regs_edits/RestoreSearch2.REG to restore

your search functions.


However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-

bin/forums/ikonboard.cgi. I recommend

using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm



If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php? id=3155&file=3&evp=3304750663b552982a8baee6434cfc13

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Unzip the downloaded HijackThis to any convenient folder, start it then
press Scan. Click on SaveLog when it's finished which will create
hijackthis.log. Now click the Config button, then Misc Tools and click on
Generate StartupList.log which will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi- bin/forum/ikonboard.cgi?
s=d3c2c886d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit- links for a variety
of parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

Recently an iSearch toolbar was mysteriously added to my
explorer 6 toolbar. I removed the installation/activation
program for this unwanted component, but have been unable
to remove the toolbar itself. When I use View-Toolbars- ,I
do not get Customize as an option. Instead, I get Standard
Buttons, Address Bar, Links, McAfee Virus Scan, and
iSerach Toolbar as options (all non-highlighted and
inactive) and Text Labels (Highlighted and active). Does
anyone have any suggestions for eradicating this pesky
piece of junk?

.

 

[Jim Byrd]

YW, Rollie.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Guest]

Dear Jim

I have just had the same problem as Rollie as well as having had my browser hijacked

I used Ad-Aware 6.181 but the additions to the Favorites and the new tool bar "flaw find atom" still remains

Your excellenet "tutorial" on elimiating these pests is what I am following. So thank

Cheers, Sa

BTW what is "YW"

 

[Rollie]

Unfortunately, neither AdAware nor Spybot were successful
in removing this parasite. Even more frustrating, when I
try to go to any of several sites to download HijackThis,
the iSearch screen appears and displays the following
message- DNS Error: Site Not Found. Other web pages load
properly. This thing seems to have some kind of uncanny
ability to sense when an effort is being made to eradicate
it! Any other suggestions for removing this troublesome
pest would be greatly appreciated.

 

[Rollie]

Further to my predicament, I realized that my version of
AdAware was not up to date. (I have the freeware
version.) When I tried to get a current update, iSearch
prevented me from accessing the lavasoft webpage. This
thing is insidious!!

 

[Jim Byrd]

Hi Sam - http://www.acronymfinder.com/af-query.asp?Acronym=YW Teach a
man to fish, etc. Try CWShredder for that one.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Jim Byrd]

Hi Rollie -

From Mike Burgess:
"First, rename your HOSTS file as "iSearch" hijacks that also,
preventing you from reaching many "anti-spyware" sites (including mine
Then download and run Ad-Aware (see below)

They also disable several other IE toolbar functions!

Copy and paste the below to Notepad
"File Types" drop-down menu = all files
Save as: UnlockToolbar.reg

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explor
er]
"NoBandCustomize"=dword:00000000
"NoToolbarCustomize"=dword:00000000
"Btn_Search"=dword:00000000
"SpecifyDefaultButtons"=dword:00000000

To use: right-click and select: Merge"


See my previous post - be sure you UPDATE AdAware and CWShredder before you
run them and run both after following Mike's instructions, as I outlined
before in my previous post.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Rollie]

Thanks for the input. I will be away from my computer for
several days, but plan on giving this a try as soon as
possible. Thanks again for the assistance.

-----Original Message-----
Hi Rollie -

From Mike Burgess:
"First, rename your HOSTS file as "iSearch" hijacks that also,
preventing you from reaching many "anti-spyware" sites (including mine
Then download and run Ad-Aware (see below)

They also disable several other IE toolbar functions!

Copy and paste the below to Notepad
"File Types" drop-down menu = all files
Save as: UnlockToolbar.reg

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersio
n\Policies\Explor
er]
"NoBandCustomize"=dword:00000000
"NoToolbarCustomize"=dword:00000000
"Btn_Search"=dword:00000000
"SpecifyDefaultButtons"=dword:00000000

To use: right-click and select: Merge"


See my previous post - be sure you UPDATE AdAware and CWShredder before you
run them and run both after following Mike's instructions, as I outlined
before in my previous post.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

Further to my predicament, I realized that my version of
AdAware was not up to date. (I have the freeware
version.) When I tried to get a current update, iSearch
prevented me from accessing the lavasoft webpage. This
thing is insidious!!

.

 

[Rollie]

I was unable to detect the iSearch toolbar malware with
the free downloadable versions of either Spybot or
Adaware. However, I was able to obtain a recent version of
Webroot's Spy Sweeper from my local computer dealer.
After I installed Spy Sweeper and rebooted my computer, a
window appeared informing me that I had the iSearch
toolbar running in memory. (No big surprise!) After
scanning with Spy Sweeper, it detected the iSearch program
along with three other unwanted pieces of junk. It
removed them all with no problem. I recommend that those
who have been infected with the iSearch toolbar obtain a
copy of Spy Sweeper to rid themselves of this pest.
Continuous Spy Sweeper upgrades are available for around
$20 per year - a real bargain as far as I am concerned.

-----Original Message-----
Thanks for the input. I will be away from my computer for
several days, but plan on giving this a try as soon as
possible. Thanks again for the assistance.

-----Original Message-----
Hi Rollie -

From Mike Burgess:
"First, rename your HOSTS file as "iSearch" hijacks that also,
preventing you from reaching many "anti-spyware" sites (including mine
Then download and run Ad-Aware (see below)

They also disable several other IE toolbar functions!

Copy and paste the below to Notepad
"File Types" drop-down menu = all files
Save as: UnlockToolbar.reg

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersio

n\Policies\Explor
er]
"NoBandCustomize"=dword:00000000
"NoToolbarCustomize"=dword:00000000
"Btn_Search"=dword:00000000
"SpecifyDefaultButtons"=dword:00000000

To use: right-click and select: Merge"


See my previous post - be sure you UPDATE AdAware and CWShredder before you
run them and run both after following Mike's instructions, as I outlined
before in my previous post.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

Further to my predicament, I realized that my version of
AdAware was not up to date. (I have the freeware
version.) When I tried to get a current update, iSearch
prevented me from accessing the lavasoft webpage. This
thing is insidious!!
-----Original Message-----
Unfortunately, neither AdAware nor Spybot were successful
in removing this parasite. Even more frustrating, when I
try to go to any of several sites to download HijackThis,
the iSearch screen appears and displays the following
message- DNS Error: Site Not Found. Other web pages load
properly. This thing seems to have some kind of uncanny
ability to sense when an effort is being made to eradicate
it! Any other suggestions for removing this troublesome
pest would be greatly appreciated.


-----Original Message-----
YW, Rollie.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In Rollie <[email protected]> typed:
Thanks for the tips regarding the removal of the iSearch
toolbar. Looks like I have my work cut out for me.
Regards,
Rollie

.

.

.

.