attacked by an aggressive toolbar 1

[stormbind]

Hi all,

The way I see the world, everything is user error. If I don't install dodgy software then I won't be infected by-

Son of a..!

It's an aggressive toolbar that may have been installed with an ActiveX control via MSIE. It does not hijack the browser in the ussual way of editing your home page, but instead redirects your home page to a local resource.

This blasted thing is visible in MSIE and Windows Explorer!

Adaware and AdwareSpy both fail to detect it. It is definately not a CoolWebSearch toolbar. It appears unbranded.

Please advise.

--Glen

Memoria mihi benigna erit qui eam perscribam

 

[bcastner]

http://www.mvps.org/sramesh2k/toolbarcop.htmO

 

[stormbind]

Spybot can be added to the list of tools that don't catch it.

Thanks bcastner. Now I just need VB6 runtimes..
*mutters something about proper programming languages*

--Glen

Memoria mihi benigna erit qui eam perscribam

 

[bcastner]

I hope you corrected my ink. It should be:

http://windowsxp.mvps.org/toolbarcop.htm

(it was moved).

For VB6 runtimes:

http://www.microsoft.com/downloads/...24-4122-44af-8ab4-7c039d9bf629&DisplayLang=en

 

[stormbind]

Thanks, yeah I spotted the O

I got it working before you replied. Just returned to award you a pretty pink star - Thanks!

I am not entirely sure the culprit has been eliminated. After killing the toolbar it persisted to hijack the home page. It is not doing that at the moment - and fingers crossed for it not doing so following a restart.

I am also not entirely sure what ToolbarCop does. Some of the the BHO I tried to disable with it have remained.

--Glen

Memoria mihi benigna erit qui eam perscribam

 

[stormbind]

It gets worse!

All the right-click options in MSIE menus were greyed out by the aggressive toolbar. How do I fix that?

--Glen

Memoria mihi benigna erit qui eam perscribam

 

[stormbind]

It is no good, there is an army of them, we are doomed!

This enemy intruder has responded by declaring hostilities. It is now forcing popups and attempting to regain the strategic position across the top of my windows.

Bugger! Iexplore just performed an illegal...

--Glen

Memoria mihi benigna erit qui eam perscribam

 

[bcastner]

Start with faq608-4650 , steps #2-#4

And then post if needed a Hijack This log here.

 

[stormbind]

Found THREE trojans, and mulitple other nasties. Things are better now that they are gone.

My PC went from good to bad in just seconds, all because I left ActiveX enabled. I had it because Gmail requires ActiveX in MSIE.

Side issue: What happens if someone sends an ActiveX exploit to all their Gmail contacts? :/

--Glen

Memoria mihi benigna erit qui eam perscribam