Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

How To Remove Websearch And The Websearch Toolbar


  • Please log in to reply
No replies to this topic

#1 Grinler

Grinler

    Bleep Bleep!


  • Admin
  • 40,524 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:26 AM

Posted 04 October 2004 - 12:15 PM

How to remove WebSearch and the WebSearch toolbar
What this program does:Below is an portion of the websearch privacy policy that will give you an idea of what this software does:
IBIS SERVICE MAY COLLECT AND STORE INFORMATION ABOUT THE WEB PAGES YOU VIEW, THE DATA YOU ENTER IN ONLINE FORMS AND SEARCH FIELDS, THE "CLICKS" YOU MAKE, THE IP ADDRESS, URL AND COUNTRY OF THE SITES YOU VISIT, YOUR IP ADDRESS, INFORMATION ABOUT YOUR BROWSER AND OPERATING SYSTEM, AND THE PRODUCTS YOU PURCHASE ONLINE WHILE USING THE SERVICE. ALTHOUGH IBIS DOES NOT ATTEMPT TO ANALYZE WEB USAGE DATA TO DETERMINE THE IDENTITY OF ANY IBIS USER, SOME INFORMATION COLLECTED BY THE SERVICE IS PERSONALLY IDENTIFIABLE. IBIS AGGREGATES AND ANALYZES THE INFORMATION IT COLLECTS TO IMPROVE ITS SERVICE AND TO PREPARE REPORTS ABOUT AGGREGATE WEB USAGE AND SHOPPING HABITS.
When the WebSearch toolbar is installed it is usually installed with otherprograms like WinTools.Tools Needed for this fix:Related Tutorials:Symptoms in a HijackThis Log:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http ://www.websearch.com/ie.aspx?tb_id=50024
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http ://www.websearch.com/ie.aspx?tb_id=50024
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http ://www.websearch.com/ie.aspx?tb_id=50024
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http ://download.websearch.com/Dnl/T_50024/...2.cab
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll



Instructions:
Automatic RemovalRemove this program through the provided Add/Remove Programs entry. To uninstall it follow these steps:
  1. Enter the control panel.
  2. Double-click on the Add/Remove Programs link.
  3. Look for and uninstall the following entries if found:


    WebSearch Toolbar
    WebSearch Tools
    Search Assistant
    Win-Tools Easy Installer

  4. Do not reboot until they have all been removed even if prompted.

  5. When you are uninstalling the last program you can then reboot when prompted.

  6. Download HijackThis from the above link and extract it to c:\hijackthis.

  7. Navigate to the c:\hijackthis directory and double-click on HijackThis

  8. When the program starts, double-click on the HijackThis icon and then click on the Scan button.

    1. Put a checkmark next to the following entry:

      O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50024/QDow_AS2.cab

    2. Then click the Fix button

  9. Exit HijackThis.

  10. Reboot your computer into Safe Mode

  11. Delete the following directories if they exist:


    C:\Program Files\Toolbar\
    C:\Program Files\Common Files\WinTools\

  12. Reboot your computer and let it boot normally.
Manual Removal:If the automatic removal procedure did not work, then you can follow this manual procedure:
  1. Download HijackThis from the above link and extract it to c:\hijackthis.

  2. Navigate to the c:\hijackthis directory and double-click on HijackThis

  3. When the program starts, double-click on the HijackThis icon and then click on the Scan button.

    1. Put a checkmark next to the following entry:


      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50024
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50024
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50024
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
      R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
      O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
      O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
      O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
      O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
      O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
      O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50024/...2.cab
      O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll


    2. Then click the Fix button

  4. Exit HijackThis.

  5. Reboot your computer into Safe Mode

  6. If you are using Windows XP/NT/2000 open regedit and navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services Click on the services key so you see a list of the services in the right section. Scroll through those services till you find one that has WinTools in it and right click on it and delete the WinTools service.

  7. Delete the following directories if they exist:


    C:\Program Files\Toolbar\
    C:\Program Files\Common Files\WinTools\

  8. Reboot your computer and let it boot normally.


This is a self-help guide. Use at your own risk.

BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can post a HijackThis log in our HijackThis Logs and Analysis forum.
If you have any questions about this self-help guide then please post those questions in our AntiVirus, Firewall and Privacy Products and Protection Methods forum and someone will help you.


BC AdBot (Login to Remove)

 





4 user(s) are reading this topic

0 members, 4 guests, 0 anonymous users