IE 6 can't remove iSearch toolbar

nolabartender, Glad to see that the problem is solved and Thanks for posting back to let us know.

Tufenuf

I tried the removal tool...and I can't find the isearch folder or isearch temp folder....ad aware and spybot don't find anything. I look through the Hijackthis log...and didnt' see anything that said Isearch in it...and the tool bar is removed from IE.

It seems that maybe winxp and the removal tool work well together...am I wrong?

Will go searching for isearch in registry tommorrow sometime...

Thanks for all of the help,

Kana

Hi i have used Ad Aware and Spyboy to no affect the iSearch toolbar is still there

here is that hijack thing you may need

Logfile of HijackThis v1.97.7
Scan saved at 11:24:44, on 19/03/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~4\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Andy\My Documents\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.timecomputers.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.timecomputers.com/
R3 - URLSearch Hook: iS earch Toolbar - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\System32\toolbar.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\System32\toolbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: iS earch Toolbar - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\System32\toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [IW ControlCenter] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~3\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\System32\toolbar.dll/S EARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.timecomputers.com
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com.../c381/chat.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/SU/ocx/12119/CTSUEng.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director6/cabs/sw.cab
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/downlo...?1070998788562
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/0955b1855ccdebc...p/RdxIE601.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/SU/ocx/12119/CTPID.cab

Any help on how to get rid of this would be great

Oh and i just backed up my Registry i think

Thanks in advance

Thanks to those posting help here. Nothing worked for me, but they pointed me in the right direction.

Which was the registry key HKEY_CURRENT_USER\SOFTWARE. There I found a folder named iSearch. Deleting that got rid of the toolbar, but I'm still trying to repair IE so I can again customize the normal toolbar, right now all options are missing or grayed out. This too shall pass.

If all else fails in repairing IE, it can be removed and reinstalled, FYI. I've used IEradicator several times and it works fine for me. http://www.litepc.com/ieradicator.html

First make sure you have an AOL or other CD with IE on it.

What, I wonder, is the matter with these iSearch morons? I'm sure other people have called in a tech to remove this unwanted toolbar, paying quite a bit for the service. I'm thinking spam is not a problem, it's easily deleted. It's crappola like iSearch that needs legislation, it seems like trespassing or fraud to me.

I notice iSearch uses Google for search results. I think I'll drop a love note to Google suggesting they're keeping bad company.

- Al -

PS: If anybody's interested, here's the contact information for Google:

http://www.google.com/help/index.html

I dropped a note to Google Search ~> Suggestions. Maybe it would be better to just go visit iSeach HQ with a shotgun, then they might get the point.

- Al -

Al, For the toolbar problem if you're running XP did you try this which is posted earlier in this thread?

Go to the link below and under the letter "T" scroll down to "Toolbar Repair" and download & run the "Toolbar Repair Utility" which corrects missing Address Bar, Toolbars and/or Menu bars in Windows Explorer and Internet Explorer and hopefully will correct your problem.

http://www.kellys-korner-xp.com/xp_abc.htm

HTH,
Tufenuf

Andy, I'm not an expert with the Hijack logs but there are a few items that look suspicious.

R3 - URLSearchHook: iSearch Toolbar - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\System32\toolbar.dll

O2 - BHO: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\System32\toolbar.dll

O3 - Toolbar: iSearch Toolbar - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\System32\toolbar.dll

O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\System32\toolbar.dll/SEARCH.HTML

Maybe someone will come along who has expertise with these logs but the above items appear to be associated with it iSearch Toolbar and it's your call.

Tufenuf

Thank you ephektz ! I clicked on http://toolbar.isearch.com/uninstall/ and it worked perfectly! Everything back to normal now. I'm using Windows XP HE with IE6.

Yep, I tried everything everybody suggested, but nothing worked. I run Win98SE.

But finally found an iSeach folder in the registry--not the only one as it turned out--and deleting that got rid of their phonus balognus toolbar.

BUT Internet Explorer (v6.02) was still crippled. It turned out the iSearch scum had hacked my registry still further, freezing the IE toolbar the way they wanted it. Uninstall and reinstall--the universal solvent--of IE did nothing because the settings were still in the registry.

Amazingly, Microsoft was no help at all. But happily, some True Geeks know about this stuff.

http://tln.lib.mi.us/~amutch/pro/ie/restrictions.htm

It was necessary for me to change the "NoToolbarCustomize" value to 0 [zero], which is off.

Poking around in HKEY_USERS, various Policy settings, also found another iSearch folder and some more strangeness. Hunt and fix. Best of luck to those with 98SE, and let's not forget why God gave us shotguns.

- Al -

picbuck with the best solution of all...fist full of boom stick...lmao

Ad-aware's reference file update released today has added the iSearch Toolbar to it's list so anyone having the iSearch Toolbar problem download the latest Ad-aware reference file update and it may get rid of it.

A new reference file (01R272 21.03.2004) is now available.

Here is a breakdown explaining what is included:

New Items
--------------------------------------------------------
GigaFinder
iSearch Toolbar

Updated Items
--------------------------------------------------------
2020Search
ClickSpring (3 variants)
DyFuCA
eAcceleration
GetMirar
Golden Palace Casino
istbar
Lop.com (2 variants)
Powerscan
Roings (5 variants)
SearchCentrix
Softomate Toolbar
7 Tracking Cookies
WonderGate

After updating, the detail-screen shows the following information:

Reference Number : 01R272 21.03.2004
Internal build : 199
Total size : 978872 Bytes
Signature data size : 961965 Bytes
Reference data size : 16843 Bytes
Signatures total : 21688
Target categories : 10
Target families : 458

Tufenuf

I eliminated all traces of iSearch I could find, using SpyBot, HiJack this, deleting toolbar.dll, and good old fashion Reg hacking. And I changed the policies back so I can customize my IE toolbar settings, but now my windows explorer toolbar optionss are still greyed out which seems odd, but maybe there is another spot int he registry for windows explorer policies? I cannot find it.

Ignore my post above, a once over with HiJack this and a simple restart cleared everything up, does anyone know of any other traces or effects of this toolbar? I want to get rid of all of it!

I went to that site that un installs isearch toolbar automatically, but it tells me it cannot un install it. I ran spy bot, ad aware, hijack this, spy sweeper, even went into the registry. I am freakin lost. I finally just did the toolbar repair thing, but everything is still grey'd out except the text labels thing. Can ANYONE PLEASE HELP?

Thanks SOOOOOOOO Much in advance,
Chris

Coastie, did you see Tufenuf's post about the updated Ad-Aware? If you downloaded from a 3rd party site you could well have an outdated version. Note the "Check for Updates Now" link on the first Ad-Aware screen. Or here's the home site:

http://www.lavasoft.de/

Meanwhile, here's ToolbarCop. I know nothing about it, just ran across it in my travels.

http://www.mvps.org/sramesh2k/toolbarcop.htm

And here's another discussion about the iSearch vandals, scroll down through quite a few ads to get to the discussion.

http://www.experts-exchange.com/Web/..._20925424.html

Here's yet more information, perhaps the best of all. Scroll to the bottom of the page:

http://www.mvps.org/sramesh2k/IEFAQ.htm

In my own case...well, of course by the time I got it fixed I was so confused I can't remember what finally did the fixing. The nature of messing with strange machinery like puters.

But messing in the registry is what finally did the job. And there are a couple of tricks I remember.

First, iSearch is not, as you'd expect, in HKEY_LOCAL_MACHINE. The scum hid it in HKEY_CURRENT_USER.

Neither, as you'd expect (or as I expected), is it in Internet Exporer. It's hidden in the Windows Explorer folder. As I recall, the path was:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Lots of options are in this Explorer key. Numeral zero is off, numeral 1 is on. Especially the option NoToolbarCustomize, which should be zero for off.

To switch off or on, in the right-hand side of the Regedit window, right-click a name, then click Modify. In the small dialog that appears, just enter numeral zero or one, Windows fills in the rest of the digits when you click OK (EXCEPT some of the values won't accept just zero or one, and all I know about those is leave them alone: click the Cancel button).

While drilling down from HKEY_CURRENT_USER, keep a lookout for an iSearch folder. Right-click and delete any found.

Big fat disclaimer, I'm telling you this from memory, and as said I was totally confused at the time. Take copious notes. Back up the registry before any changes. Before doing anything else, empty the recycle bin, clear Tempory Internet Files, Scandisk, restart, pray, brush your teeth, give to the poor.

Above all, study long and hard before acting. This piece of crappola was made by geeks who went over to the dark side, not True Geeks. But still these garbage heads have arcane knowledge. So surely we un-geeky mere mortals need to, as carpenters advise, measure twice before we cut once.

- Al -