Inside Tufts

University Information Technology

Information Security

Removing Spyware, Adware and I.E. toolbars

According to current research no one software program currently identifies and removes all spyware programs. Combine that with the rapidly changing nature of IE toolbar parasites and it can be very difficult to identify and clean a desktop computer. Please select two out of the three free software suggested below to clean up the computer.

  1. AdAware SE
  2. Microsoft Antispyware
  3. Spybot Search and Destroy

Once the computer is free from these parasitic programs, introduce the user to the Mozilla or FireFox browser. While no browser remains free from vulnerabilities forever, Mozilla and FireFox have two advantages over Internet Explorer; 1) They are not tied to the operating system so the activity is "sandboxed" or contained within the browser space, and 2) They are not as popular a target as Internet Explorer.

Manual instructions for some of the thornier parasites

ABX toolbar - SANS, March 7, 2005
Run Regedit and search for "abx" (do not include quotes). Remove all references containing "abx" from the registry. There are at least two Keys in the registry that contain several Values related to this spyware. On my test workstation, one of them was: HKCU\software\xbtb01186\toolbar.
I am not sure, but the "xbtb01186" may be a randomly generated Key, but within that Key will be several Values with "abx" references. Remove the entire Key starting at "xbtb01186".
You will need to delete two files in the "Download Program Files" directory under your Windows directory. In Windows XP they will be under c:\windows\Download Program Files. In NT they will be under c:\winnt\Download Program Files. The file names are: abx_search.dll and abx_search.inf
The "Download Program Files" directory stores the ActiveX Cache used when starting up Internet Explorer. This directory may be hidden, so make sure your Explorer settings allow you to view hidden files.
BestFriends AIM adware/virus
Short-Media Forums removal instructions.
Marketscore
Columbia's removal instructions.