IBIS Toolbar

[SUSZANNAH]

Sorry guys....still learning, I hear of all these toolbar thingys...well I had one IBIS...Ms Antispy removed it...I always thought you could see a toolbar, am I missing something?

Don't know how I got it, don't do dodgy sites or anything like that, looked at google, only confused me more...all techie talk..

Frank you out there.........

[neal62]

Susz,

If you would like please go HERE to read about this IBIS toolbar. 

[Eddy]

This toolbar is also a search hijacker and BHO. It will also try to install a number of other applications which according to the terms you agreed to while installing it CAN do! IBIS has been known to prevent you from visiting a number of popular spyware removal sites.

The toolbar originates from websearch.com

REMOVAL INSTRUCTIONS:
Destroy Autorun:
Delete the following keys
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\wintools
From: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\
emusicclient systray,
fash
wintools
From: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices\
wintools
wintools"
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservicesonce\wintools

Reboot your system then:

Make sure you click start --> Run and type in msconfig. Then select the startup tab. Any references to the processes below.

Unregister DLLs:

Tip: this is only a list of known files/locations. You will want to do a search by the name of the file to see if they're on your system.
A while back I wrote a guide to Register/remove DLL or AX files which you will need if you don't know how to unregister these files.

Each file is in several locations so you'll need to search for them and unregister + delete them in every location you find.

btiein.dll
f3ezsetp.dll
sep.dll
toolbar.dll
wtoolsb.dll

End Processes (may or may not exist):
iexploreskins.exe
emusicclient.exe
fash.exe
wintools.exe
wtoolsa.exe
wsup.exe
wtoolss.exe

Remove Directories:
Program Files\common files\wintools\
Program Files\common~1\wintools\
Program Files\funwebproducts\installr\2.bin

[crofty59]

Hi SUSZANNAH

This is the version that i have on my computer of MSAS
Microsoft AntiSpyware Version:  1.0.615
This version expires on: 31/12/2005
Spyware Definition Version: 5753 (10/09/2005 10:35:54 AM)

This is what Castle Cops Security Forum has to say about IBIS toolbar.
They say it is a false Positive see below.

I have QuickTime Version 6.5.2 (without itunes) and MSAS seems to recognize the unistaller (unvise32qt.exe) as IBIS Toolbar. After running MSAS scan, then a quarantine or delete of this item, when you go to Start>Programs>QuickTime, the uninstall option is not there - nor is it when you try Control Panel>Add/Delete Programs. I don't know about Version 7.0. It definitely is a false positive by MSAS. The only simple solution seems to be "ignore" it after running a scan. Don't "always ignore", "delete" or "quarantine", since the two latter will remove the uninstaller and the first allows a possiblity of the real IBIS Toolbar to come in. Hopefully Microsoft will correct this in the next version - which I hope they release soon.

If you don't have Quick Time ignore this.

I myself sent IBIS toolbar to Quarantine and i checked my add remove etc and found that indeed the uninstaller was gone.
Restored from Quarantine and sure enough the Uninstaller was back again for Quick time.

I have only posted this as a guide, as i know next to nothing, about computers.
I would reccomend check out Castle cops for your self.
I would put a link in but i can never get them to work.

[parachutestx]

I had the same issue except with mine it was in the Windows Folder and I by instinct deleted it...........now I havent had any issues but should I worry? It was really strange as it only picked this 1 file up after I updated..........

(UPDATE)
For those that deleted it if you have Ittunes go into the Control panel under modify/delete programs and on ittunes click repair and it will bring the file back

[SUSZANNAH]

Thanks for all the input, it seems I have got rid of it......still don't know how I got it, as I don't us Quick Time or ITunes.......

[FreewheelinFrank]

Seems the false alarm could be generated by a Vise uninstallation file:

http://www.pcreview.co.uk/forums/thread-2131123.php

Vise is just a easy way to make Installer applications without needing complicated scripts so is used by a lot of applications.

In other words it could be a different application but it still looks like a false alarm.

[Ricky2005]

god... if you want a toolbar always http://google.com out there..

[SUSZANNAH]

I didn't want one........

[polonus]

Well Susz,

You better without toolbars, there are a few out there that are safe, but more likely than not they will snoop on you.
I tested A-toolbar, it is free of scumware, but my firewall says it phones home once in a while (probably to update). But some are really like trojan horses or even worse, costing you cycles and bandwidth and opening your comp up to real scumware and all sorts of nastiness, later very diicult to get rid off. Stay away, better use a stand-alone search program. Always first establish it is not malware and spyware or adware , and then maybe you can allow it on your machine (lest it is scanned by AVAST),

greets,

polonus

[essexboy]

The only toolbar I use is robobform.  No need for any others FF has a google built in.  If I need the weather I look out of the window

[neal62]

Susz, that is very good advice that Polonus is giving you IMHO. Better to be out a bit of convenience than to later discover that your pc is full of Malware.

[Ricky2005]

I didn't want one........

oh well lol