Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

Ibis Toolbar Removal

Overview:
This toolbar is also a search hijacker and BHO. It will also try to install a number of other applications which according to the terms you agreed to while installing it CAN do! IBIS has been known to prevent you from visiting a number of popular spyware removal sites.

Web Search features one-click access to the search results of fifteen (15) of the best search providers on the Internet! Now, you can search for relevant web results, images, audio, news and much more from one convenient location! Web Search is your best "search friendly" tool on the web, saving you time and effort. Source

Originating Website

Destroy Autorun:
Delete the following keys

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\wintools
From: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\
emusicclient systray,
fash
wintools
From: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices\
wintools
wintools"
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservicesonce\wintools

Reboot your system then:

Make sure you click start --> Run and type in msconfig. Then select the startup tab. Any references to the processes below.

Unregister DLLs:

Tip: this is only a list of known files/locations. You will want to do a search by the name of the file to see if they're on your system.
A while back I wrote a guide to Register/remove DLL or AX files which you will need if you don't know how to unregister these files.

Each file is in several locations so you'll need to search for them and unregister + delete them in every location you find.

btiein.dll
f3ezsetp.dll
sep.dll
toolbar.dll
wtoolsb.dll

End Processes (may or may not exist):
iexploreskins.exe
emusicclient.exe
fash.exe
wintools.exe
wtoolsa.exe
wsup.exe
wtoolss.exe

Remove Directories:
Program Files\common files\wintools\
Program Files\common~1\wintools\
Program Files\funwebproducts\installr\2.bin

Clean your Registry:

You should be back to normal IF this was your only problem. I suggest you post in our HJT forum since its not likely that this is your only bug. Read this first


Written By: Martin Krohn
Printer Friendly

Article Index:
Talk About it! -->