Remove XXXToolbar from my Add/Remove Programs List

[jaguarsfan]

The XXXToolbar has appeared in my Add/Remove Programs List. I have uninstalled the IHatePops and Pest Control from my computer. I have tried to remove the XXXToolbar and it won't let me. I am frustrated. I contacted the company where I got the 2 softwares from. They have informed me it is not there problem and gave me this site to go to for help. I have contacted Gateway and they told me it is the software company's problem. Can anyone help me? Thanks.

[beeboy]

I would try Spybots Search and Destroy first. It is pretty good at getting rid of this type of thing.
http://security.kolla.de/

[froggymorning]

[quote=jaguarsfan]The XXXToolbar has appeared in my Add/Remove Programs List. I have uninstalled the IHatePops and Pest Control from my computer. I have tried to remove the XXXToolbar and it won't let me. I am frustrated.


[quote=jaguarsfan]The XXXToolbar has appeared in my Add/Remove Programs List. I have uninstalled the IHatePops and Pest Control from my computer. I have tried to remove the XXXToolbar and it won't let me. [unquote]

I successfully got rid of an XXXToolbar that came in with Istbar browser Hijack. Adaware didn't locate it on my system, Spybot S&D didn't either, though it did find Backweb which I got from the same website. I downloaded SpyHunter and paid for it, because SpyHunter found all the problems, and stopped running them. However, Spyhunter did not find the hidden executable that reinstalled XXXtoolbar at every start up. I tried Symantec's removal tool, but it only takes care of a different type of XXXtoolbar attack. After getting rid of any unfamiliar process I didn't recognize with Hijackthis, uninstalling every unneccessary program and .dll and manually picking through my registry for a few hours, I was still stumped, and XXXToolbar was still reinstalling at every reboot!

Finally I found out how the Toolbar had come in, by searching through all changes to my computer in the last 24 hours. It had come in on an 'update' to Windows Media Player. This was particularly troublesome because while browsing, I received an icon in my system tray that was very similar to the Microsoft automatic updates icon, and a message that said updates were available, that was almost identical to Microsoft's automatic updates message! Like me, many people have set their preferences to receive microsoft's many necessary security patches automatically. Making this type of attack particularly effective. And thus I myself installed this phony, hostile update to Windows Media player that brought in XXXToolbar. The only fix was to uninstall Windows Media Player. It may be possible to rollback to the original Windows Media Player version, but I did a total uninstall and reinstalled direct from MSN. XXXToolbar free.

I know longer trust any auto notices for 'updates' but cancel any notices of updates. Then I check for updates myself. SpyHunter, Adaware and SpybotS&D are a little behind on this new attack.

I've seen several responses to XXXToolbar attacks that work as they were designed, but it looks like they are single type of attack specific. XXXToolbar is very effective at attacking through many different means and it looks like they have developers who are continually being creative with new means of attack. Try Symantec's removal tool and every other means of removal you can search for to see if those address your specific type of attack. Uninstall Windows Media player from Control Panel/Add and remove programs and hopefully you don't have something new from XXXtoolbar that hasn't been found yet.

[rasagulla]

any body tried the microsoft antispyware.its pretty good.that is the best antispyware softwre i have ever seen.i think this will easily remove XXX tool bar.

[sp_100]

XXXToolbar removal:

Open the registry (click 'Start', choose 'Run' and enter 'regedit') and find the key HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run. Delete the 'AutoUpdater' entry on the right (pointing to aupdate.exe). Find the key HKEY_CLASSES_ROOT\CLSID, and delete the subkey '{69550BE2-9A78-11D2-BA91-00600827878D}'. Delete the subkey of the same name from HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars, and the entry of the same name from HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar.

Restart the computer and you should be able to delete the files 'aupdate.exe', 'aupdate.conf', 'aupdate.trk' and (if it is there) 'aupdate_uninstall.exe' from the System folder. (The System folder can be found inside the Windows folder; it is called 'System32' on Windows NT/2000/XP or just 'System' on Windows 95/98/Me.)

Finally you can restore your normal search settings (Internet Options->Programs->Reset Web Settings).

Then see Spyware/Virus Removal and Prevention.

All the Best!

[HenryRoot]

Originally Posted by sp_100

XXXToolbar removal:

Then see Spyware/Virus Removal and Prevention.

All the Best!

Having been through the trauma of losing my http brouse feature after SP2 due to conflicts with Norton, and having fixed this with various patches, I now find that (using XP Pro) my mouse cursor will not settle on the bottom Windows tool bar. It moves over the toolbar but I cannot click any of the quick-start programs or "Start." I can access stuff using Control/Escape but I would prefer to use my mouse! Any ideas please?

Thanks (New member in UK)

[sreenig]

Dear friend
Its better to go and download microsoft Antispiware softwra to remove all thsis type of spyware and adware programes from the system .
http://www.microsoft.com/athome/secu...easenotes.mspx.
You can find more details there

Originally Posted by jaguarsfan

The XXXToolbar has appeared in my Add/Remove Programs List. I have uninstalled the IHatePops and Pest Control from my computer. I have tried to remove the XXXToolbar and it won't let me. I am frustrated. I contacted the company where I got the 2 softwares from. They have informed me it is not there problem and gave me this site to go to for help. I have contacted Gateway and they told me it is the software company's problem. Can anyone help me? Thanks.

[Cache]

run "Ad-aware", "Spybot search&destoy", "CWShreder" and your antivirus form safe mode, make sure you update them first!. then reboot back to normal mode and download Hijack This from here: http://www.spywareinfo.com/~merijn/downloads.html

unzip Hijack This to a permanent folder such as C:\HijackThis. make sure you can view hidden files and folders, including system files. close all open windows. run Hijack This and post you log. this way people veiwing this can get a better idea of what the solution may be, which files to delete etc.

[Cache]

lol.. i just noticed the date this post was made. i must have got confused with it been brought back from the dead.

HenryRoot,
ud have been better of just starting a new thread. iv got no idea why this thread was dug up. jumping from 2003 to 2005 lol

[sdavis83]

Try to search for it in the registry, right click on the left fields then select "find" type in the xxxtoolbar and when it finds the associated registry key, delete it, then keep hitting F3 to find the other keys and delete them as well. after all keys have been found and deleted, boot into safemode, and try running either, spybot, adaware, or microsoft antispyware. Don't forget to try and find the folder on the harddrive itself and delete it manually. Also empty all temp folders and temporary internet folders. Hope this helps. This is also a decent way to remove alot of spyware from your machine that likes to hang around. IMPORTANT: Do NOT follow these instructions if you are not familiar with the registry. If you delete the wrong key in the registry it can damage your operating system, I'm not liable for any stupid mistakes anyone does should you follow these instructions. Hope they do work though.