Viewing Thread:
"Need help getting rid of a search toolbar"

Basically, was surfing the net and those usual 'do you want to install' messages came up. I clicked no but a search toolbar with loads of links showed up. This isn't the problem. Since this 'Searchtoolbar' has showed up, a trojan alert appears virtually everytime I open a new browser opened, and AVG is incapable to heal, delete or move it. Just now I signed into SR chat forums and was redirected to a poker site. Usually you can right click in the browser to unselect toolbars you do't want, but everything is shaded grey. Also, in add/remove programs there is nothing. Apart from something called Wareout which searched the computer when I wasn't looking and wanted to erase important files.

Well getting rid of that spoof scanner was easy but the toolbar is a lot more tricky due to the fact it doesn't seem to be found by spybot, ad-aware or a-squared, and spy doctor which usually sorts bull like this out now has a 'problem unpacking'. Final clue to what might be going on is the fact Ikeep on getting this 'windows firewall message' talking of unusual activity. Now on windows 98se with zone alarm it doesn't take a genius to realise this is a load of rubbish. So, any help would be greatly appreciated, and maybe there might be a free trip to New york to sort out the guy behind this

Bless the Whois database

It's called 'SearchToolbar', and a 'google' didn't shed any light. Thanks Roj but that list doesn't have a lot, such as the AVG, zone alarm stuff so not a great deal of help.

Here is the process list:
Realevent- Realplayer
ZLclient- Zone alarm
Avgemc- Avg?
Aoldial- AOL s/w
Avgcc- Avg?
Wmencagt- Windows media
Stimon- Dunno but it's usual
Loadgm- Dunno but it's been there before
Systray- Dunno but usual
Dslagent- New one (to do with modem?)
Aolsp scheduler- Usual
Dslstat- New one (But I do have a DSL modem)

Also things that come up in all capitals are sometimes suspect.

I'd still say posting a printscreen of your processes would be the best way. if not the toolbar must have a name on it, if you can find that finding removal tips is a lot easier.

Well as everyone else mentioned, try Spybot etc. By the way, when you ctrl alt del check the task list programs with this [URL]http://www.answersthatwork.com/Tasklist_pages/tasklist.htm[/URL] - it's a rather useful site. Even some programs that look familiar may be viruses, especially if they change only 1 letter of the name etc.

Marzman wrote:
> Chippxero wrote:
> I am surprise Spybot search and destroy didn't get this, it normally
> nukes anything that changes IE and sets everything back to default.
>
> Since the toolbar it has been running very slow. Scans never
> used to take three quarters of an hour

Mine take about 2 hours, then at the end, no virus!

wmencagt = Windows Media Encoder Agent

So thats not a problem, but if your system is running slow it's got to be something running outside of IE like a separate program.

Chippxero wrote:
> Often these sorts of things install a folder in your program files
> folder, have a browse through for it. Do you know what it's called in
> your processes list when you Ctl-Alt-DEl?
>
> If so please post it's name and will have a look around for removal
> tips. If you can't find it in there please printscreen your process
> list and maybe someone will be able to pick it out.

Inthe program folder there is nothing that shouldn't be there. Also, on ctrl+alt+del the only thing I don't reconise is wmencagt, which may be an AVG thingy. Odd things are happening, like a whole load of new items inthe favourates

Often these sorts of things install a folder in your program files folder, have a browse through for it. Do you know what it's called in your processes list when you Ctl-Alt-DEl?

If so please post it's name and will have a look around for removal tips. If you can't find it in there please printscreen your process list and maybe someone will be able to pick it out.

Chippxero wrote:
> I am surprise Spybot search and destroy didn't get this, it normally
> nukes anything that changes IE and sets everything back to default.

Since the toolbar it has been running very slow. Scans never used to take three quarters of an hour

I am surprise Spybot search and destroy didn't get this, it normally nukes anything that changes IE and sets everything back to default.

Try microsofts anti spyware program it does seem to pick up a thing or 2.

[URL]http://castlecops.com/[/URL]

Try this lot.