Uninstall Google Toobar

Discussion in 'Computer Support' started by Michael Payne, Oct 2, 2004.

  1. After a frustrating couple of days trying to rid my machine of
    spy/adware, I still can't seem to get rid of whatever is causing web
    pages to be redirected to "Sir Search" and occasionally "Incredifind"
    (although I *think* that one may be taken care of now).

    I have run all the free programs regularly suggested here. But I
    still find that sometimes I am redirected to SirSearch. The most
    frustrating is the News button on the Google toolbar will ALWAYS take
    me there. So I think "I'll just uninstall the toolbar and see if that
    will do the trick."

    No luck, because I go to Add/Remove Software (Windows 2000 Pro) and
    click uninstall and ... nothing. It won't let me remove it, change
    it, or anything. I tried reinstalling the toolbar and then
    uninstalling but still nothing.

    Any ideas would be greatly appreciated.

    Mike
    Michael Payne, Oct 2, 2004
    #1
    1. Advertising

  2. Michael Payne

    °Mike° Guest

    I haven't had Google toolbar installed in quite a while, so
    I'm going on memory here -- there has also been an update
    to it, so thing may be different. Open Windows Explorer
    to "[Drive]:\Windows\Downloaded Program Files". Find
    the Google toolbar ActiveX control, right click on it and
    choose 'Remove'. Go to "[Drive]:\Program Files" and
    delete anything from Google. Search your Windows,
    Windows\System and Windows\System32 folders for
    any google DLL files and, making sure that all browser
    windows are closed, delete the google files and then
    reboot.


    On Sat, 02 Oct 2004 12:35:32 -0400, in
    <>
    Michael Payne scrawled:

    >After a frustrating couple of days trying to rid my machine of
    >spy/adware, I still can't seem to get rid of whatever is causing web
    >pages to be redirected to "Sir Search" and occasionally "Incredifind"
    >(although I *think* that one may be taken care of now).
    >
    >I have run all the free programs regularly suggested here. But I
    >still find that sometimes I am redirected to SirSearch. The most
    >frustrating is the News button on the Google toolbar will ALWAYS take
    >me there. So I think "I'll just uninstall the toolbar and see if that
    >will do the trick."
    >
    >No luck, because I go to Add/Remove Software (Windows 2000 Pro) and
    >click uninstall and ... nothing. It won't let me remove it, change
    >it, or anything. I tried reinstalling the toolbar and then
    >uninstalling but still nothing.
    >
    >Any ideas would be greatly appreciated.
    >
    >Mike


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Oct 2, 2004
    #2
    1. Advertising

  3. Michael Payne

    JustMe Guest

    "Michael Payne" <> wrote in message
    news:...
    > After a frustrating couple of days trying to rid my machine of
    > spy/adware, I still can't seem to get rid of whatever is causing web
    > pages to be redirected to "Sir Search" and occasionally "Incredifind"
    > (although I *think* that one may be taken care of now).
    >
    > I have run all the free programs regularly suggested here. But I
    > still find that sometimes I am redirected to SirSearch. The most
    > frustrating is the News button on the Google toolbar will ALWAYS take
    > me there. So I think "I'll just uninstall the toolbar and see if that
    > will do the trick."
    >
    > No luck, because I go to Add/Remove Software (Windows 2000 Pro) and
    > click uninstall and ... nothing. It won't let me remove it, change
    > it, or anything. I tried reinstalling the toolbar and then
    > uninstalling but still nothing.
    >
    > Any ideas would be greatly appreciated.
    >
    > Mike
    >


    Incredifind is a particularly nasty piece of work. Using add/remove programs
    doesn't always work. Bazooka works as well as anything but you still might
    have to manually remove some components. Here's the instructions:
    http://tinyurl.com/ywj86 andor get Bazooka here:
    http://www.kephyr.com/spywarescanner/index.html

    When you remove malware you always want to use safe mode without networking,
    be logged in as an administrator and empty the recycle bin before
    restarting.
    JustMe, Oct 2, 2004
    #3
  4. Thanks Mike. I never could get it to uninstall, but I did get rid of it by
    deleting everything I could find from Google. I couldn't find the ActiveX
    control for it (it wasn't in the Downloaded Program Files or *anywhere* that
    I could find.

    Could I ask why you don't use the toolbar any more? Problems with it or
    have you found something better?


    On Sat, 02 Oct 2004 17:45:20 +0100, in 24hoursupport.helpdesk °Mike°
    <> sputtered:

    >I haven't had Google toolbar installed in quite a while, so
    >I'm going on memory here -- there has also been an update
    >to it, so thing may be different. Open Windows Explorer
    >to "[Drive]:\Windows\Downloaded Program Files". Find
    >the Google toolbar ActiveX control, right click on it and
    >choose 'Remove'. Go to "[Drive]:\Program Files" and
    >delete anything from Google. Search your Windows,
    >Windows\System and Windows\System32 folders for
    >any google DLL files and, making sure that all browser
    >windows are closed, delete the google files and then
    >reboot.
    >
    >
    >On Sat, 02 Oct 2004 12:35:32 -0400, in
    > <>
    > Michael Payne scrawled:
    >
    >>After a frustrating couple of days trying to rid my machine of
    >>spy/adware, I still can't seem to get rid of whatever is causing web
    >>pages to be redirected to "Sir Search" and occasionally "Incredifind"
    >>(although I *think* that one may be taken care of now).
    >>
    >>I have run all the free programs regularly suggested here. But I
    >>still find that sometimes I am redirected to SirSearch. The most
    >>frustrating is the News button on the Google toolbar will ALWAYS take
    >>me there. So I think "I'll just uninstall the toolbar and see if that
    >>will do the trick."
    >>
    >>No luck, because I go to Add/Remove Software (Windows 2000 Pro) and
    >>click uninstall and ... nothing. It won't let me remove it, change
    >>it, or anything. I tried reinstalling the toolbar and then
    >>uninstalling but still nothing.
    >>
    >>Any ideas would be greatly appreciated.
    >>
    >>Mike
    The Conscience of ASCP, Oct 3, 2004
    #4
  5. On Sat, 2 Oct 2004 11:22:04 -0700, "JustMe" <> wrote:

    >
    >"Michael Payne" <> wrote in message
    >news:...
    >> After a frustrating couple of days trying to rid my machine of
    >> spy/adware, I still can't seem to get rid of whatever is causing web
    >> pages to be redirected to "Sir Search" and occasionally "Incredifind"
    >> (although I *think* that one may be taken care of now).
    >>
    >> I have run all the free programs regularly suggested here. But I
    >> still find that sometimes I am redirected to SirSearch. The most
    >> frustrating is the News button on the Google toolbar will ALWAYS take
    >> me there. So I think "I'll just uninstall the toolbar and see if that
    >> will do the trick."
    >>
    >> No luck, because I go to Add/Remove Software (Windows 2000 Pro) and
    >> click uninstall and ... nothing. It won't let me remove it, change
    >> it, or anything. I tried reinstalling the toolbar and then
    >> uninstalling but still nothing.
    >>
    >> Any ideas would be greatly appreciated.
    >>
    >> Mike
    >>

    >
    >Incredifind is a particularly nasty piece of work. Using add/remove programs
    >doesn't always work. Bazooka works as well as anything but you still might
    >have to manually remove some components. Here's the instructions:
    >http://tinyurl.com/ywj86 andor get Bazooka here:
    >http://www.kephyr.com/spywarescanner/index.html
    >
    >When you remove malware you always want to use safe mode without networking,
    >be logged in as an administrator and empty the recycle bin before
    >restarting.


    Thanks JM. It certainly is nasty. I seem to have rid myself of
    Incredifind, but searches are still being swiped by Sir Search and now
    Zoombar. Thanks for the advice about safe mode as I had forgotten
    that.

    I'm relenting and will post a HJT log and hopefully someone will see
    something that I dont.
    Michael Payne, Oct 3, 2004
    #5
  6. Michael Payne

    JustMe Guest


    > >>

    > >
    > >Incredifind is a particularly nasty piece of work. Using add/remove

    programs
    > >doesn't always work. Bazooka works as well as anything but you still

    might
    > >have to manually remove some components. Here's the instructions:
    > >http://tinyurl.com/ywj86 andor get Bazooka here:
    > >http://www.kephyr.com/spywarescanner/index.html
    > >
    > >When you remove malware you always want to use safe mode without

    networking,
    > >be logged in as an administrator and empty the recycle bin before
    > >restarting.

    >
    > Thanks JM. It certainly is nasty. I seem to have rid myself of
    > Incredifind, but searches are still being swiped by Sir Search and now
    > Zoombar. Thanks for the advice about safe mode as I had forgotten
    > that.
    >
    > I'm relenting and will post a HJT log and hopefully someone will see
    > something that I dont.
    >


    No problem. You also might want to run regclean while you're in safe mode
    and check on what processes look questionable in Task Manager.
    JustMe, Oct 3, 2004
    #6
  7. Michael Payne

    samuel Guest

    Michael Payne <> wrote in

    > I'm relenting and will post a HJT log and hopefully someone will
    > see something that I dont.


    post to alt.privacy.spyware and hijack forums possibly
    samuel, Oct 3, 2004
    #7
  8. Michael Payne

    °Mike° Guest

    I have absolutely no use for it now, since I've been using
    SlimBrowser:
    http://www.flashpeak.com/sbrowser/

    It even reads RSS feeds.


    On Sat, 02 Oct 2004 20:33:43 -0400, in
    <>
    The Conscience of ASCP scrawled:

    >Thanks Mike. I never could get it to uninstall, but I did get rid of it by
    >deleting everything I could find from Google. I couldn't find the ActiveX
    >control for it (it wasn't in the Downloaded Program Files or *anywhere* that
    >I could find.
    >
    >Could I ask why you don't use the toolbar any more? Problems with it or
    >have you found something better?


    <snip>

    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Oct 3, 2004
    #8
  9. Michael Payne

    Jim Byrd Guest

    Hi Michael - Both Incredifind and Sir Search are related to a base piece of
    malware called KeenValue. Start here:
    http://www.doxdesk.com/parasite/KeenValue.html

    For this one, run BOTH AdAware and SpyBot S&D, and then install
    SpywareBlaster (which blocks some 18+ variants of KeenValue including the
    SirSearch and Incredifind variants).


    #########IMPORTANT#########
    Before you try to remove spyware using any of the programs below, download
    both a copy of LSPFIX here:

    http://www.cexx.org/lspfix.htm

    AND a copy of Winsockfix
    http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
    Directions here: http://www.tacktech.com/display.cfm?ttid=257

    The process of removing certain malware may kill your internet connection.
    If this should occur, these programs, LSPFIX and WINSOCKFIX, will enable you
    to regain your connection.

    NOTE: It is reported that in XP SP2, the command netsh winsock reset
    will fix this problem without the need for these programs. You can also try
    this if you're on XP SP1. There has also been one, as yet unconfirmed,
    report that this also works there.
    #########IMPORTANT#########



    #########IMPORTANT#########
    All of the following removal tools should be run from Safe mode when
    possible. Reboot and test if the malware is fixed after using each tool.
    #########IMPORTANT#########


    Sometimes the tools below will find files which they are unable to delete
    because they are in use. A program called Copylock, here,
    http://noeld.com/programs.asp?cat=misc#CopyLock can aid in the process of
    "replacing, moving, renaming or deleting one or many files which are
    currently in use (e.g. system files like comctl32.dll, or virus/trojan
    files.)" Another is Killbox, here:
    http://download.broadbandmedic.com/Killbox.exe



    Download and run Stinger.exe, here:
    http://download.nai.com/products/mcafee-avert/stinger.exe or from the link
    on this page: http://vil.nai.com/vil/stinger/


    Download sysclean.com , from Trend Micro, here:
    http://www.trendmicro.com/download/dcs.asp along with the latest pattern
    file, here: http://www.trendmicro.com/download/pattern.asp Be sure to read
    the "How-to" info here:
    http://www.trendmicro.com/ftp/products/tsc/readme.txt (You might also want
    to get Art's updater, SYS-UP.Zip, here for future updating of these:
    http://home.epix.net/~artnpeg/). (If you download and use the updater from
    the beginning, it will automatically handle downloading the other files.)
    Place them in a dedicated folder after appropriate unzipping. Disable
    Restore if you're on XP or ME (directions here:
    http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm), then boot to
    Safe mode (HowTo here:
    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
    Do a complete scan of your system in Safe mode and clean or delete anything
    it finds. Reboot to normal mode and re-run the scan again.

    This scan may take a long time, as Sysclean is VERY extensive and thorough.


    Get Ad-Aware SE Personal Edition, here:
    http://www.lavasoftusa.com/support/download/. UPDATE, set it up in
    accordance with this: http://forum.aumha.org/viewtopic.php?t=5877 or the
    directions immediately below and run this regularly to get rid of most
    "spyware/hijackware" on your machine. If it has to fix things, be sure to
    re-boot and rerun AdAware again and repeat this cycle until you get a clean
    scan. The reason is that it may have to remove things which are currently
    "in use" before it can then clean up others. Configure Ad-aware for a
    customized scan, and let it remove any bad files found.....

    <Begin Setup Directions>
    Then, courtesy of NonSuch at Lockergnome, open Ad-aware then click the gear
    wheel at the top and check these options to configure Ad-aware for a
    customized scan:

    General> activate these: "Automatically save log-file" and "Automatically
    quarantine objects prior to removal"

    Scanning > activate these: "Scan within archives", "Scan active processes",
    "Scan registry", "Deep scan registry," "Scan my IE Favorites for banned
    sites," and "Scan my Hosts file"

    Tweaks > Scanning Engine> activate this: "Unload recognized processes during
    scanning."

    Tweaks > Cleaning Engine: activate these: "Automatically try to unregister
    objects prior to deletion" and "Let Windows remove files in use after
    reboot."

    Click "Proceed" to save your settings, then click "Start." Make sure
    "Activate in-depth scan" is ticked green, then scan your system. When the
    scan is finished, the screen will tell you if anything has been found, click
    "Next." The bad files will be listed. Right click the pane and click "Select
    all objects" - This will put a check mark in the box at the side, click
    "Next" again and click "OK" at the prompt "# objects will be removed.
    Continue?"
    <End Setup Directions>

    Courtesy of http://www.nondisputandum.com/html/anti_spyware.html: HINT: If
    Ad Aware is automatically shut-down by a malicious software, first run
    AWCloak.exe, http://www.lavasoftnews.com/downloads/AAWCloak.exe, before
    opening Ad Aware. When AAWCloak is open, click "Activate Cloak". Than open
    Ad Aware and scan your system.


    Another excellent program for this purpose is SpyBot Search and Destroy
    available here: http://security.kolla.de/ SpyBot Support Forum here:
    http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
    using both normally. After UPDATING and fixing ONLY RED things with SpyBot
    S&D, be sure to re-boot and rerun SpyBot again and repeat this cycle until
    you get a clean "no red" scan. The reason is that SpyBot sometimes has to
    remove things which are currently "in use" before it can then clean up
    others.

    Note that sometimes you need to make a judgement call about what these
    programs report as spyware. See here, for example:
    http://www.imilly.com/alexa.htm

    Both of these programs should normally be UPDATED and run after doing any
    other fix such as CWShredder and, as a minimum, normally at least once a
    week.


    Once you get this cleaned up, you might want to consider installing Eric
    Howes' IESpyAds, SpywareBlaster and SpywareGuard here to help prevent this
    kind of thing from happening in the future:

    IESpyads - https://netfiles.uiuc.edu/ehowes/www/resource.htm "IE-SPYAD adds
    a long list of sites and domains associated with known advertisers,
    marketers, and crapware pushers to the Restricted sites zone of Internet
    Explorer. Once you merge this list of sites and domains into the Registry,
    the web sites for these companies will not be able to use cookies, ActiveX
    controls, Java applets, or scripting to compromise your privacy or your PC
    while you surf the Net. Nor will they be able to use your browser to push
    unwanted pop-ups, cookies, or auto-installing programs on your PC." Read
    carefully.

    http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
    X installs) (BTW, SpyWareBlaster is not memory resident ... no CPU or memory
    load - but keep it UPDATED) The latest version as of this writing will
    prevent installation or prevent the malware from running if it is already
    installed, and it provides information and fixit-links for a variety of
    parasites.

    http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
    install malware) Keep it UPDATED. All three Very Highly Recommended

    Next, install and keep updated a good HOSTS file. It can help you avoid
    most adware/malware. See here: http://www.mvps.org/winhelp2002/hosts.htm
    (Be sure it's named/renamed HOSTS - all caps, no extension) Additional
    tutorials here:
    http://www.bleepingcomputer.com/forums/index.php?s=14f3f9225081133297a8acdd11137c5b&showtutorial=51
    (detailed) and here: http://www.spywarewarrior.com/viewtopic.php?t=410
    (overview)


    Finally, be sure that you have a good hardware or software firewall and an
    AntiVirus installed, and bring your OS up-to-date with ALL Critical updates
    from Windows Update.


    --
    Please respond in the same thread.
    Regards, Jim Byrd, MS-MVP



    In news:,
    Michael Payne <> typed:
    > On Sat, 2 Oct 2004 11:22:04 -0700, "JustMe" <> wrote:
    >
    >>
    >> "Michael Payne" <> wrote in message
    >> news:...
    >>> After a frustrating couple of days trying to rid my machine of
    >>> spy/adware, I still can't seem to get rid of whatever is causing web
    >>> pages to be redirected to "Sir Search" and occasionally
    >>> "Incredifind" (although I *think* that one may be taken care of
    >>> now).
    >>>
    >>> I have run all the free programs regularly suggested here. But I
    >>> still find that sometimes I am redirected to SirSearch. The most
    >>> frustrating is the News button on the Google toolbar will ALWAYS
    >>> take me there. So I think "I'll just uninstall the toolbar and see
    >>> if that will do the trick."
    >>>
    >>> No luck, because I go to Add/Remove Software (Windows 2000 Pro) and
    >>> click uninstall and ... nothing. It won't let me remove it, change
    >>> it, or anything. I tried reinstalling the toolbar and then
    >>> uninstalling but still nothing.
    >>>
    >>> Any ideas would be greatly appreciated.
    >>>
    >>> Mike
    >>>

    >>
    >> Incredifind is a particularly nasty piece of work. Using add/remove
    >> programs doesn't always work. Bazooka works as well as anything but
    >> you still might have to manually remove some components. Here's the
    >> instructions: http://tinyurl.com/ywj86 andor get Bazooka here:
    >> http://www.kephyr.com/spywarescanner/index.html
    >>
    >> When you remove malware you always want to use safe mode without
    >> networking, be logged in as an administrator and empty the recycle
    >> bin before restarting.

    >
    > Thanks JM. It certainly is nasty. I seem to have rid myself of
    > Incredifind, but searches are still being swiped by Sir Search and now
    > Zoombar. Thanks for the advice about safe mode as I had forgotten
    > that.
    >
    > I'm relenting and will post a HJT log and hopefully someone will see
    > something that I dont.
    Jim Byrd, Oct 3, 2004
    #9
  10. Michael Payne

    Guest

    , Oct 22, 2004
    #10
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Abso
    Replies:
    3
    Views:
    2,687
  2. JW
    Replies:
    2
    Views:
    633
  3. vvv
    Replies:
    2
    Views:
    2,681
    a_mcbride
    Sep 8, 2003
  4. Michael Payne

    HJT Log - was Uninstall Google Toobar

    Michael Payne, Oct 3, 2004, in forum: Computer Support
    Replies:
    1
    Views:
    1,417
    °Mike°
    Oct 3, 2004
  5. Can't Uninstall Google Earth

    , Aug 6, 2007, in forum: Computer Support
    Replies:
    3
    Views:
    562
    Plato
    Aug 8, 2007
Loading...

Share This Page