isearch toolbar removal

[roboth]

Continuing from the thread: http://forums.designtechnica.com/showthread.php?s=&threadid=4055&perpage=40&pagenumber=1

In the hosts file ( found in c:\windows\system32\drivers\etc ) I found this:

127.0.0.0 localhost
127.0.0.1 and.doxdesk.com
127.0.0.2 auditmypc.com
127.0.0.3 boards.cexx.org
127.0.0.4 bulletproofsoft.net
127.0.0.5 camtech2000.net
127.0.0.6 cexx.org
127.0.0.7 computercops.us
127.0.0.8 ct7support.com
127.0.0.9 doxdesk.com
127.0.0.10 eblocs.com
127.0.0.11 enigmasoftwaregroup.com
127.0.0.12 forum.aumha.org
127.0.0.13 free-spyware-scan.com
127.0.0.14 free-web-browsers.com
127.0.0.15 grc.com
127.0.0.16 grisoft.com
127.0.0.17 hackfaq.org
127.0.0.18 hazeleger.net
127.0.0.19 javacoolsoftware.com
127.0.0.20 kellys-korner-xp.com
127.0.0.21 kephyr.com
127.0.0.22 lavasoft.de
127.0.0.23 lavasoftusa.com
127.0.0.24 lurkhere.com
127.0.0.25 majorgeeks.com
127.0.0.26 merijn.org
127.0.0.27 mjc1.com
127.0.0.28 moosoft.com
127.0.0.29 mvps.org
127.0.0.30 net-integration.net
127.0.0.31 noadware.net
127.0.0.32 no-spybot.com
127.0.0.33 onlinepcfix.com
127.0.0.34 pchell.com
127.0.0.35 pestpatrol.com
127.0.0.36 safer-networking.org
127.0.0.37 secure.spykiller.com
127.0.0.38 secureie.com
127.0.0.39 security.kolla.de
127.0.0.40 spybot.info
127.0.0.41 spychecker.com
127.0.0.42 spychecker.com
127.0.0.43 spycop.com
127.0.0.44 spyguard.com
127.0.0.45 spykiller.com
127.0.0.46 spyware.co.uk
127.0.0.47 spyware-cop.com
127.0.0.48 spywareinfo.com
127.0.0.49 spywarenuker.com
127.0.0.50 spywareremove.com
127.0.0.51 spywareremove.com
127.0.0.52 stopzillapro.com
127.0.0.53 sunbelt-software.com
127.0.0.54 thiefware.com
127.0.0.55 tomcoyote.org
127.0.0.56 unwantedlinks.com
127.0.0.57 webattack.com
127.0.0.58 wilders.org
127.0.0.59 www.auditmypc.com
127.0.0.60 www.bulletproofsoft.net
127.0.0.61 www.cexx.org
127.0.0.62 www.computercops.us
127.0.0.63 www.ct7support.com
127.0.0.64 www.doxdesk.com
127.0.0.65 www.eblocs.com
127.0.0.66 www.enigmasoftwaregroup.com
127.0.0.67 www.free-spyware-scan.com
127.0.0.68 www.free-web-browsers.com
127.0.0.69 www.grc.com
127.0.0.70 www.grisoft.com
127.0.0.71 www.hackfaq.org
127.0.0.72 www.hazeleger.net
127.0.0.73 www.javacoolsoftware.com
127.0.0.74 www.kellys-korner-xp.com
127.0.0.75 www.kephyr.com
127.0.0.76 www.lavasoft.de
127.0.0.77 www.lavasoftusa.com
127.0.0.78 www.lurkhere.com
127.0.0.79 www.majorgeeks.com
127.0.0.80 www.merijn.org
127.0.0.81 www.mjc1.com
127.0.0.82 www.moosoft.com
127.0.0.83 www.mvps.org
127.0.0.84 www.net-integration.net
127.0.0.85 www.noadware.net
127.0.0.86 www.no-spybot.com
127.0.0.87 www.onlinepcfix.com
127.0.0.88 www.pchell.com
127.0.0.89 www.pestpatrol.com
127.0.0.90 www.safer-networking.org
127.0.0.91 www.secureie.com
127.0.0.92 www.security.kolla.de
127.0.0.93 www.spybot.info
127.0.0.94 www.spychecker.com
127.0.0.95 www.spychecker.com
127.0.0.96 www.spycop.com
127.0.0.97 www.spyguard.com
127.0.0.98 www.spykiller.com
127.0.0.99 www.spyware.co.uk
127.0.0.100 www.spyware-cop.com
127.0.0.101 www.spywareinfo.com
127.0.0.102 www.spywarenuker.com
127.0.0.103 www.spywareremove.com
127.0.0.104 www.spywareremove.com
127.0.0.105 www.stopzillapro.com
127.0.0.106 www.sunbelt-software.com
127.0.0.107 www.thiefware.com
127.0.0.108 www.tomcoyote.org
127.0.0.109 www.unwantedlinks.com
127.0.0.110 www.webattack.com
127.0.0.111 www.wilders.org

Im not a hacker or techie and want to thank you all for your contributions to this thread. I used the tool provided at the isearch web site becouse I cant or am unexpreinced to alter the register.

I deleted all but the first and renamed it to 127.0.0.1. Is that right?

Whats the hosts file really for anyway?

[Ioman]

Rename the file completely to something like bak.blah and reboot your system. Windows XP should automatically create a new host file for you (free of spyware) and you should be good to go. If it doesnt work, rename the file back to what it should be and we can try fixing it using anti-spyware software. I am pretty sure the first trick will work though.

[roboth]

In the directory: c:\windows\downloaded program files
I find a file created the same time and date as the isearch toolbar was selfinstalled. its called: {1C78AB3F-A857-482E-80C0-3A1E5238A565}

When I rightclick at it it says that it´s codebase is:

ms-its:mhtml:file://C:\ss.MHT!http://toolbar.isearch.com/install/00010/chm.chm::/files/initial.cab

and when I open next the file depends on the file: toolbar.dll in the windows system folder. But it also says toolbar.dll is damaged.

I cant seem to find any of the 3 files it´s depends on. The names is: toolbar.dll, initial.inf and version.txt
Both the file initial.inf and version.txt has exact the same size: 4,096 byte.

In the file setupapi.log I found a long log with the 3 files when I search for them inside files. And Im not an techie so I cant figure out what it says unfortunatly.