20 replies to this topic

[Daemon]

dpatriquin

Let's finish cleaning you up and then we can fix the toolbar problem. Make sure that you have no browsers or windows open as this could prevent the fix from working properly (print this page). Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: (no name) - {16BB125F-D441-4A35-AAB0-CAEFDDD0C4C8} - C:\WINNT\system32\nomkij.dll
O2 - BHO: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINNT\system32\toolbar.dll
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\LimeShop\System\Temp\limeshop_script0.htm
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.co...etup1.0.0.6.cab

Reboot when done.

Next the toolbars. Click Start>Run type regedit and click OK. Search for (Edit>Find) the Values "NoToolbarOptions", "NoBandCustomize" or "NoToolbarCustomize". Either may show up 2 or more times. Wherever you find that DWORD value, right-click it and modify the value from 1 to 0.

Finally, Click here to make sure that you have the latest patches for Windows. It's very important to keep your system up to date to avoid unnecessary security risks. Rescan with HJT and post a new log for a final check over.

[CVDNils]

Hi,

I also had the ISearch-Toolbar. I do not know how it got on my computer. This is really a damned thing.

I was able to find out who could be in charge for this: It is idownload.com.

I was able to remove the ISearch-Bar with the Toolbar-Cop. Made it nice and easy, but it left me back with the same menu problem described earlier here: I can no longer modify the views of my toolbars.

But I will try to fix it according to your great help here.

I think, that the Isearch-Problem is definetely an very new one, or?

Greetings,

CVDNils.

[dcb_1]

First, I?ve sent this information to Spybot, a great free program, to which I?ve made a donation. If you don?t use Spybot, you should consider it.

Here?s how I removed the isearch toolbar on an XP based box:

From, the desktop Start->run selection, enter regedit, to edit your registry.

1. Shutdown all IE browser windows.

2. In regedit, (under File), export a copy of your registry to a known location, like into a file and onto a CD. In case you get in trouble, for some unknown reason, you can import this copy.

3. Under regedit?s Edit menu, do a find for isearch. It should return a default entry containing isearch. On my box the isearch tool bar?s registry entry was:

Registry entry: HKEY_CLASSES_ROOT\CLSID\{1C78AB3F-A857-482e-80C0-3A1E5238A565}

I looked through the registry information, and I found that a Dynamic Loadable Library (DLL) had been put on my box to support the tool bar: C:\windows\system32\toolbar.dll

4. Remove registry parent of default object, on my box it was {1C78AB3F-A857-482e-80C0-3A1E5238A565}

5. Remove C:\windows\system32\toolbar.dll.

I took apart the DLL, looking for incriminating things. Isearch?s toolbar was made Created by MIDL version 6.00.0361. I believe the registry entry {1C78AB3F-A857-482e-80C0-3A1E5238A565} mentioned above should be of the same name on your machine, because it?s hard coded into the DLL.

Here?s something from the DLL?s internals:
<DNSCATCH href="http://auto.isearch.....php?text=%s"/>
<AUTOSEARCH href="http://auto.isearch....ref=%user_id"/>

I pinged isearch.com and auto.isearch.com, and both addresses resolve to the same IP address. They don?t support telnet, but they did have ftp available, which I found amazing, considering they?re deliberately screwing with people's machines?

A note to Isearch.com: I might have put your toolbar on my box, if you would have asked, but you didn?t. I?m a good internet person, I don?t bother people, but you broke the rules by putting a DLL on my box without asking. I looked all over your isearch.com site, and there was no instructions about unistallation, no help, nothing. That?s why I took these actions. The internet is a great place, but we need to behave well, to keep the lawyers and big brother out? peace.

[CalamityJane]

Adaware has already added iSearch in today's update

(in fact there were two updates today - the latest one being Reference File O1R 273 21.03.2004)

Download Adaware (get the free edition)
http://www.lavasoft....ftware/adaware/

After download and installing first, please update the program important to get the updates first before scanning

To Get the updates
Just open Adaware and click on *Check for Updates Now* and then *Continue*. Let them download and install......then press the *Scan now* button. Let it fix what it finds.

Reboot your PC after cleaning with Adaware and scan again. Repeat the process until no further items are found as bad.

I have sent Spybot a sample of iSearch Toolbar as well, so I expect that will be included in the next Spybot S& D update (thought it hasn't updated yet).

And Yes, both Spybot and Adaware and the two programs we recommend to users here. I use both as well. :thumb:

[weeirdoo]

I'm glad my dilemna has helped out many. :king:

[dpatriquin]

Whew. AdAware fixed my problems and got rid of the iSeach Bar. THanks for all your help and advice.