ISearch toolbar

[Blue_Gundam2002]

This thing is driveing me nuts. I've scanned useing updated ad-aware and spybot, but they can't get rid of it. I've tried to just hide it but the toolbar list is faded out. I looked in the add/remove program list but its not there. Anyone have any ideas?

[aym]

Check out this:
http://www.pestpatrol.com/PestInfo/i...ch_toolbar.asp

[Blue_Gundam2002]

I can't get to the site, I had trouble getting to lavasoft and the spybot site to. But no problems to any other site, maybe this is a bigger problem than just spyware. I'm going to do some anti-virus scans.

[Blue_Gundam2002]

I just ran a couple virus scans and nothing came up. I still can't get to that site. Can anyone else?

[LiVeWiRe]

I can get to the site...

Here are their (PestPatrol) instructions on manually removing this:

Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

Unregister DLLs:

Unregister these DLLs with Regsvr32, then reboot:

systemroot+\system32\toolbar_.dll
systemroot+\system\toolbar_.dll

Clean Registry:

Remove these registry items (if present) with RegEdit:

HKEY_CLASSES_ROOT\clsid\{1c78ab3f-a857-482e-80c0-3a1e5238a565}
HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{1c78ab3f-a857-482e-80c0-3a1e5238a565}
HKEY_LOCAL_MACHINE\clsid\{1c78ab3f-a857-482e-80c0-3a1e5238a565}
HKEY_LOCAL_MACHINE\software\classes\clsid\{1c78ab3f-a857-482e-80c0-3a1e5238a565}
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{1c78ab3f-a857-482e-80c0-3a1e5238a565}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{1c78ab3f-a857-482e-80c0-3a1e5238a565}

Remove Files:

Remove these files (if present) with Windows Explorer:

systemroot+\system32\toolbar_.dll
systemroot+\system\toolbar_.dll

HTH,
-LW

[Blue_Gundam2002]

Originally posted by LiVeWiRe I can get to the site... Here are their (PestPatrol) instructions on manually removing this: Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake. Unregister DLLs: Unregister these DLLs with Regsvr32, then reboot: systemroot+\system32\toolbar_.dll systemroot+\system\toolbar_.dll Clean Registry: Remove these registry items (if present) with RegEdit: HKEY_CLASSES_ROOT\clsid\{1c78ab3f-a857-482e-80c0-3a1e5238a565} HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{1c78ab3f-a857-482e-80c0-3a1e5238a565} HKEY_LOCAL_MACHINE\clsid\{1c78ab3f-a857-482e-80c0-3a1e5238a565} HKEY_LOCAL_MACHINE\software\classes\clsid\{1c78ab3f-a857-482e-80c0-3a1e5238a565} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{1c78ab3f-a857-482e-80c0-3a1e5238a565} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{1c78ab3f-a857-482e-80c0-3a1e5238a565} Remove Files: Remove these files (if present) with Windows Explorer: systemroot+\system32\toolbar_.dll systemroot+\system\toolbar_.dll HTH, -LW

Thanks it worked.

[LiVeWiRe]

No problem...glad it got rid of it!

-LW

[Blue_Gundam2002]

I still can't get to that site. And when I go to windows update and run the update scan I get an error, number 0x80070422

[LiVeWiRe]

Have you tried cleaning out your temporary internet files cache?

-LW

[Blue_Gundam2002]

Ok, I fixed the windows update error, turns out you have to have automatic updates set to manual. But I still can't get to that site.

[LiVeWiRe]

Can you get to the Pest Patrol homepage?

http://www.pestpatrol.com

-LW

[Blue_Gundam2002]

Originally posted by LiVeWiRe Can you get to the Pest Patrol homepage? http://www.pestpatrol.com -LW

No, I get connection refused in mozilla and page cannot be displayed in IE.

[aym]

Looks like ISearch mapped some domains to 127.0.0.1, what are the contents of your hosts file? (C:\WINDOWS\system32\drivers\etc\hosts)

[Blue_Gundam2002]

Originally posted by aym_7 Looks like ISearch mapped some domains to 127.0.0.1, what are the contents of your hosts file? (C:\WINDOWS\system32\drivers\etc\hosts)

I think this looks bad, how do I fix?
127.0.0.0 localhost
127.0.0.1 and.doxdesk.com
127.0.0.2 auditmypc.com
127.0.0.3 boards.cexx.org
127.0.0.4 bulletproofsoft.net
127.0.0.5 camtech2000.net
127.0.0.6 cexx.org
127.0.0.7 computercops.us
127.0.0.8 ct7support.com
127.0.0.9 doxdesk.com
127.0.0.10 eblocs.com
127.0.0.11 enigmasoftwaregroup.com
127.0.0.12 forum.aumha.org
127.0.0.13 free-spyware-scan.com
127.0.0.14 free-web-browsers.com
127.0.0.16 grisoft.com
127.0.0.17 hackfaq.org
127.0.0.18 hazeleger.net
127.0.0.19 javacoolsoftware.com
127.0.0.20 kellys-korner-xp.com
127.0.0.21 kephyr.com
127.0.0.22 lavasoft.de
127.0.0.23 lavasoftusa.com
127.0.0.24 lurkhere.com
127.0.0.25 majorgeeks.com
127.0.0.26 merijn.org
127.0.0.27 mjc1.com
127.0.0.28 moosoft.com
127.0.0.29 mvps.org
127.0.0.30 net-integration.net
127.0.0.31 noadware.net
127.0.0.32 no-spybot.com
127.0.0.33 onlinepcfix.com
127.0.0.34 pchell.com
127.0.0.35 pestpatrol.com
127.0.0.36 safer-networking.org
127.0.0.37 secure.spykiller.com
127.0.0.38 secureie.com
127.0.0.39 security.kolla.de
127.0.0.40 spybot.info
127.0.0.41 spychecker.com
127.0.0.42 spychecker.com
127.0.0.43 spycop.com
127.0.0.44 spyguard.com
127.0.0.45 spykiller.com
127.0.0.46 spyware.co.uk
127.0.0.47 spyware-cop.com
127.0.0.49 spywarenuker.com
127.0.0.50 spywareremove.com
127.0.0.51 spywareremove.com
127.0.0.52 stopzillapro.com
127.0.0.53 sunbelt-software.com
127.0.0.54 thiefware.com
127.0.0.55 tomcoyote.org
127.0.0.56 unwantedlinks.com
127.0.0.57 webattack.com
127.0.0.58 wilders.org
127.0.0.59 www.auditmypc.com
127.0.0.60 www.bulletproofsoft.net
127.0.0.61 www.cexx.org
127.0.0.62 www.computercops.us
127.0.0.63 www.ct7support.com
127.0.0.64 www.doxdesk.com
127.0.0.65 www.eblocs.com
127.0.0.66 www.enigmasoftwaregroup.com
127.0.0.67 www.free-spyware-scan.com
127.0.0.68 www.free-web-browsers.com
127.0.0.69 www.grc.com
127.0.0.70 www.grisoft.com
127.0.0.71 www.hackfaq.org
127.0.0.72 www.hazeleger.net
127.0.0.73 www.javacoolsoftware.com
127.0.0.74 www.kellys-korner-xp.com
127.0.0.75 www.kephyr.com
127.0.0.76 www.lavasoft.de
127.0.0.77 www.lavasoftusa.com
127.0.0.78 www.lurkhere.com
127.0.0.79 www.majorgeeks.com
127.0.0.80 www.merijn.org
127.0.0.81 www.mjc1.com
127.0.0.82 www.moosoft.com
127.0.0.83 www.mvps.org
127.0.0.84 www.net-integration.net
127.0.0.85 www.noadware.net
127.0.0.86 www.no-spybot.com
127.0.0.87 www.onlinepcfix.com
127.0.0.88 www.pchell.com
127.0.0.89 www.pestpatrol.com
127.0.0.90 www.safer-networking.org
127.0.0.91 www.secureie.com
127.0.0.92 www.security.kolla.de
127.0.0.93 www.spybot.info
127.0.0.94 www.spychecker.com
127.0.0.95 www.spychecker.com
127.0.0.96 www.spycop.com
127.0.0.97 www.spyguard.com
127.0.0.98 www.spykiller.com
127.0.0.99 www.spyware.co.uk
127.0.0.100 www.spyware-cop.com
127.0.0.102 www.spywarenuker.com
127.0.0.103 www.spywareremove.com
127.0.0.104 www.spywareremove.com
127.0.0.105 www.stopzillapro.com
127.0.0.107 www.thiefware.com
127.0.0.109 www.unwantedlinks.com
127.0.0.110 www.webattack.com
127.0.0.111 www.wilders.org

[aym]

You don't need anything other than:
127.0.0.1 localhost

[Blue_Gundam2002]

Originally posted by aym_7 You don't need anything other than: 127.0.0.1 localhost

127.0.0.0 or 172.0.0.1

[aym]

127.0.0.1

[Blue_Gundam2002]

Everything is working now.

[glc]

Now use Spybot's Immunize function to lock the hosts file read-only.

[Blue_Gundam2002]

Originally posted by glc Now use Spybot's Immunize function to lock the hosts file read-only.

I did have it imunized.