Home>Tips & Articles>Remove Adware & Spyware>
Remove TinyBar Adware
About TinyBar
Tinybar is an Internet Explorer toolbar implemented as an HTML file, which may offer a search feature pointed at a generic portal, for example:
- tinybar.com
- allcybersearch.com
- gocybersearch.com
- clickyestoenter.net
- topsearcher.com
- jethomepage.com
|
- jetseeker.com
- znext.com
- traffic4sure.com
- errorpage404.com
- searchaccurate.com
- ourlinklist.com
|
- topclicks.net
- iseekresults.com
- wowsearch.com
- ysearchus.com
|
Remove this spyware using Spyware Doctor
There may also be link buttons pointed at the same site. Some versions may not be visible in the IE interface at all and only spawn pop-up ads.
How to Remove TinyBar ?
- Open the registry editor (click Start > Run and enter 'regedit').
For TinyBar/A, delete these keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\{69555BE2-9A78-11D2-BA91-00600827878D}
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\{69555BE2-9A78-11D2-BA91-00600827878D}
HKEY_CLASSES_ROOT\CLSID\{69555BE2-9A78-11D2-BA91-00600827878D}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\>>> Search The Web <<<
For TinyBar/B, delete:
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\{69550BE2-9A78-11D2-BA91-00600827878D}
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\{69550BE2-9A78-11D2-BA91-00600827878D}
HKEY_CLASSES_ROOT\CLSID\{69550BE2-9A78-11D2-BA91-00600827878D}
For TinyBar/C:
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\{8FB0F3E2-5193-11D7-9F88-0050FC5441CB}
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\{8FB0F3E2-5193-11D7-9F88-0050FC5441CB}
HKEY_CLASSES_ROOT\CLSID\{8FB0F3E2-5193-11D7-9F88-0050FC5441CB}
For TinyBar/D:
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\{82599E0A-8C81-11D7-9F97-0050FC5441CB}
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\{82599E0A-8C81-11D7-9F97-0050FC5441CB}
HKEY_CLASSES_ROOT\CLSID\{82599E0A-8C81-11D7-9F97-0050FC5441CB}
For the TinyBar/D variant, also go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, and delete entries pointing to '.hta' files. You may see a 'system' entry pointing to systemsearch.hta and/or a name made of random characters pointing to a '.hta' file in the System folder with a random-character filename.
- Restart IE and the toolbar should be gone. On variants that store the toolbar page locally, you may find this under the name 'tinybar.html' or 'hb.html' inside the System folder (which is inside the Windows folder, called 'System32' in Windows NT, 2000 and XP, or just 'System' under Windows 95, 98 and Me). This file can be deleted, along with 'hb.reg', 'br.reg' or 'br.dll'.
- Use Internet Options->Programs->Reset Web Settings to restore the normal search page.
Hijacker removal
Before the settings can be restored you must remove the hijacker that is run on every restart. Open the registry editor(Start->Run->regedit), find the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and remove any entries of the form 'regedit /s C:\Windows\System\sp.dll'. Then delete sp.dll (or sp.reg) in the System folder. Then use Reset Web Settings to get the normal search page back.
Denial of Service removal
Open the Windows folder and check the 'System' (on Windows 95/98/Me) or 'System32' (on Windows NT/2K/XP) folder for a file called 'atk.vbs'. If you have it, open the registry (Start->Run->regedit) and find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. There should be a value here, possibly called 'Messenger', pointing at the atk.vbs file. Remove it and restart the machine; you should then be able to delete the atk.vbs file.
Remove spyware using PestPatrol
Remove other programs:
