I cannot remove Isearch Deskbar!!

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by NEWGEEK2005, Jan 1, 2005.

  1. NEWGEEK2005

    NEWGEEK2005 Private E-2

    CAN SOMEONE PLEASE HELP ME REMOVE ISEARCH DESKBAR!

    Thank you guys for taking the time to help me out, I have read all the rules and followed all the procedures to get ride of all spyware. I scanned my Pc with all the necessary programs but can't get ride of The ISEACH DESKBAR that keep poppping up and down from behind the taskbar. everytime i try to delete it it starts again once i restart my computer. I tried spyware doctor , noadware and also read the forum about Hijackthis and the person who had the same problem as me. SO CAN SOMEONE PLEASE HELP ME REMOVE THIS ISEARCH COMPLETELY OFF MY PC!
     
  2. TheDoug

    TheDoug MajorGeek

    Only if you are comfortable with and knowledgeable about editing your registry. Back it up, and create a restore point first:

    In regedit search for/remove the following:

    !!! ALWAYS EXPORT A COPY OF YOUR REGISTRY BEFORE ATTEMPTING CHANGES!!!

    HKEY_CLASSES_ROOT\CLSID\{1C78AB3F-A857-482e-80C0-3A1E5238A565}

    HKEY_CLASSES_ROOT\CLSID\{1C78AB3F-A857-482e-80C0-3A1E5238A565}

    HKEY_CLASSES_ROOT\iSearch.Object

    HKEY_CLASSES_ROOT\iSearch.Object.1

    HKEY_CLASSES_ROOT\TypeLib\{6D3F5DE4-E980-4407-A10F-9AC771ABAAE6}

    HKEY_CURRENT_USER\Software\iSearch

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&iSearch The Web

    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1C78AB3 F-A857-482e-80C0-3A1E5238A565}

    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iSearch.Object

    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iSearch.Object .1

    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6D3F5 DE4-E980-4407-A10F-9AC771ABAAE6}

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1C78AB3F-A857-482E-80C0-3A1E5238A565}\DownloadInformation
    >>DELETE ONLY THIS KEY!!! : http://toolbar.isearch.com/install/00010/initial.cab

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1AE2F26C-8E23-4930-A68D-9E681A764001}

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
    >>DELETE ONLY THIS KEY!!! : {1C78AB3F-A857-482e-80C0-3A1E5238A565}

    HKEY_USERS\S-1-5-21-329068152-1972579041-725345543-500\Software\iSearch

    HKEY_USERS\S-1-5-21-329068152-1972579041-725345543-500\Software\Microsoft\Internet Explorer\MenuExt\&iSearch The Web

    It seems some of the HKEY_USERS ones dissapear after
    deleting the first ones.

    Look in the folder C:\WINDOWS\system32\drivers\etc\ at the hosts file and see what is in it. Delete all entries except one: 127.0.0.1 Local host.

    Reboot

    I found this by Googling REMOVE ISEARCH
     
  3. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.

    NOTE: In order to resolve the issues you are having it is very important that you at least try to perform all the steps as outlined. If you have any difficulty please post back letting us know what steps you have completed, what you found while doing the scans if anything and details about any problems you have encountered in completing the steps. The more details you can provide the better.

    After doing ALL of the above if you still have a problem:

    Make sure you have HijackThis 1.99 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

    Now post a HijackThis as a .txt file attachment to your message. All running programs should be closed,including your web browser, e-mail. Close before running Hijack This!

    Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds