BrowserToolbar

Overview

Summary

An IE toolbar object which comes with various other components that act as adware and spyware.

Alias

ausvc (after the filename of one of its components), Backdoor.Autoupder (Kaspersky Anti-Virus), Backdoor.Autoupder (Symantec), BrowseEvt (after the spyware component it installs), Downloader-W (McAfee), JS/Downloader-W, TROJ_SUA.A (Trend Anti-Virus), TrojanDownloader.Win32.Minstaller (KAV),

Origins

Group

browsertoolbar.com

Vendor

http://www.browsertoolbar.com/

URL

http://www.browsertoolbar.com/

Date of Origin

December, 2002

Detection and Removal

Manual Removal

See http://www.browsertoolbar.com/removal.html

Stop Running Processes:

Kill these running processes with Task Manager:

Remove Autorun Reference:

Go To the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\mnsvc, delete it and reboot the machine immediately.

If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\sysscan, delete it and reboot the machine immediately.

Clean Registry:

Remove these registry items (if present) with RegEdit:

HKEY_CLASSES_ROOT\clsid\{6541b981-2e27-46b1-a2cc-8264a75b74fe}HKEY_CLASSES_ROOT\clsid\{6d8b1b74-4ab8-473b-b479-253fa1936802}HKEY_CLASSES_ROOT\clsid\{868b015f-3515-44db-b0ad-182cd058985e}HKEY_CLASSES_ROOT\clsid\{9a05fe9b-5b52-4d13-a77d-fa7c38557a8e}HKEY_CLASSES_ROOT\clsid\{bae85c97-2cd4-45c3-a1ed-e4cef7c6aa52}HKEY_CLASSES_ROOT\clsid\{c76be992-2bc3-41a4-8b87-a8c01fe419a7}HKEY_CLASSES_ROOT\clsid\{f53c844a-d9c8-4e92-b923-c05b46c4a7e3}HKEY_LOCAL_MACHINE\software\classes\appid\{8b034058-08b0-4cb3-b2e8-60238b4967f2}HKEY_LOCAL_MACHINE\software\classes\clsid\{6541b981-2e27-46b1-a2cc-8264a75b74fe}HKEY_LOCAL_MACHINE\software\classes\clsid\{868b015f-3515-44db-b0ad-182cd058985e}HKEY_LOCAL_MACHINE\software\classes\clsid\{9a05fe9b-5b52-4d13-a77d-fa7c38557a8e}HKEY_LOCAL_MACHINE\software\classes\clsid\{bae85c97-2cd4-45c3-a1ed-e4cef7c6aa52}HKEY_LOCAL_MACHINE\software\classes\clsid\{c76be992-2bc3-41a4-8b87-a8c01fe419a7}HKEY_LOCAL_MACHINE\software\classes\clsid\{f53c844a-d9c8-4e92-b923-c05b46c4a7e3}HKEY_LOCAL_MACHINE\software\classes\clsid\{fbe091e5-df43-4ffb-aecc-7e3a3bc7b0d9}HKEY_LOCAL_MACHINE\software\classes\typelib\{6d8b1b74-4ab8-473b-b479-253fa1936802}HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\mnsvcHKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\sysscan

Remove Files:

Remove these files (if present) with Windows Explorer:

BrowserAid.Startium BrowserAid.X BrowserAidToolbar BrowserEnhancement BrowserPal BrowserToolbar BrowserTunnel Browserplugin.com Bruja Brute