unwanted shell extension options in IE

[hupjack]

Where on earth did all these shell extensions come from?
See my screen capture: http://invasiondf.notlong.com

Did Office 2003 or office XP put that export to excel option in there?
All the other ones look as if they mimic the Google toolbar's optional info
button. Did the Google toolbar throw in these options? Is there a way to
remove this clutter?

 

[PA Bear]

Check your system for "hijackware":

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder (fix all found)

2. Ad-Aware (fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You *must* seek updates for Ad-Aware, Spybot, etc., before each
and every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://www.spywareinfo.com/~merijn/files/HijackThis.exe) is the preferred
tool to use. It will help you to both identify and remove any
hijackware/spyware. **Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

Also update your virus definitions and then run a full system scan. From
now on, do both daily.

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957
--
HTH - Please Reply to This Thread

~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

AumHa Forums
http://forum.aumha.org

What You Should Know About Spyware
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx

 

[Alan Edwards]

I am not sure why you didn't use Google to find this information
but...

Google supplied four of them, as the help shows.
http://toolbar.google.com/button_help.html
Click Options and uncheck Page Info.

I don't know what put the Export to Excel option but probably Office.
This should help:
Using ToolbarCop to remove the unwanted Toolband, Toolbar Icons and
BHO:
http://www.mvps.org/sramesh2k/toolbarcop.htm

....Alan

--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html


In microsoft.public.windows.inetexplorer.ie6.browser, "hupjack"

 

[hupjack]

Thanks Alan,

Toolbar Cop shed some much desired light on the subject. I could see
exactly what each entry was associated with. I had suspected the ones you
mentioned were google toolbar associated ones but does the google
documentation say specifically that it puts those in the context menu? I
certainly didn't see a check box to keep the the app from adding to the
shell, but I guess that's what toolbar cop was made to address.

Thanks,
-Ethan

 

[Alan Edwards]

Am I missing something?
I told you where the Google toolbar puts the entries in.
The help is clear enough about that.
You uncheck and it doesn't put them in.

....Alan

 

[hupjack]

Yeah that option to include or exclude page info was only modifying the
presence of the button on the Google toolbar. Unchecking the option didn't
remove the entries from the right click menu..

Not sure now if it's a result of my newly installed roboform
http://m2.overseasky.net/forum_posts.asp?TID=21910&PN=1
or if it was from trying ToolbarCop, but now the Google bar is busted such
that choosing page info doesn't even toggle the button's presence in the
toolbar.. In fact.. the Google toolbar was showing, but was "unchecked".
Checking it made the Norton toolbar appear.. unchecking Norton made the
Google toolbar disappear.. apparently these two got switched somehow? I
didn't make any changes with toolbarcop but it sure looks like my registry
has some corruption.

should uninstalling an reinstalling the Google toolbar fix this?

-Ethan

 

[Alan Edwards]

Hmmm... I am wrong in my assumptions.
I didn't think I had the extensions in (I have never used them) but I
see now that I do have them and have had them since I installed the
bar, according to my install log. Sorry about that.

I don't have Page Info checked but that makes no difference as you
say.
When I installed the bar, these are the four Registry keys that were
created to form the Google menu extensions you mentioned:

[HKEY_USERS\.Default\Software\Microsoft\Internet
Explorer\MenuExt\Cac&hed Snapshot of Page]
@="res://C:\\PROGRAM FILES\\GOOGLE\\GOOGLETOOLBAR1.DLL/cmcache.html"
"Contexts"=hex:21,00,00,00

[HKEY_USERS\.Default\Software\Microsoft\Internet
Explorer\MenuExt\Si&milar Pages]
@="res://C:\\PROGRAM FILES\\GOOGLE\\GOOGLETOOLBAR1.DLL/cmsimilar.html"
"Contexts"=hex:21,00,00,00

[HKEY_USERS\.Default\Software\Microsoft\Internet
Explorer\MenuExt\Backward &Links]
@="res://C:\\PROGRAM
FILES\\GOOGLE\\GOOGLETOOLBAR1.DLL/cmbacklinks.html"
"Contexts"=hex:21,00,00,00

[HKEY_USERS\.Default\Software\Microsoft\Internet
Explorer\MenuExt\Translate Page]
@="res://C:\\PROGRAM FILES\\GOOGLE\\GOOGLETOOLBAR1.DLL/cmtrans.html"
"Contexts"=hex:21,00,00,00

I just closed IE, removed the keys, reopened IE and the menu
extensions are gone.
I don't see any way of removing them without resorting to a Registry
edit or by using an application like ToolbarCop.

The crossover between the Google Bar and another toolbar in
View-Toolbars is common but does not seem to cause any harm.

....Alan