PC Hell: IBIS Web Search (websearch.com) Removal Instructions

IBIS Web Search is a Internet Explorer toolbar that allows you to get fast search results. It also includes a pop up blocker and browser skins. Unfortunately, it also includes the WinTools installer to keep the toolbar updated and now adds a Web Security Guard to supposedly protect your computer from unauthorized tampering. The only problem I have is I didnt ask for the Web Security Guard to be installed and it doesnt state in the terms of service that it was going to be installed. This is a good example of how these automatic updating solutions to toolbars work. They install themselves and then one day update silently and the next thing you know there are new icons in your System Tray or new browser toolbars, etc.

You'll notice the following toolbar in your browser if Web Search is installed on your computer.

Because the software also installs a program called Web Security Guard (click here for a screenshot) , you will see a new icon in your system tray that looks like this:

If you run Hijackthis, you'll also notice the following lines that have been added:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50024
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50024
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50024
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll

O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll

O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll

O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe (this is seen on spyware removal sites as the Neo toolbar)

O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50024/QDow_AS2.cab

O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll

It may also add the following line as well
O4 - HKLM\..\Run: [PIB] C:\PROGRA~1\Toolbar\PIB.exe (this is commonly seen on spyware removal sites as the PIB toolbar)

First, uninstall the Web Search program and WinTools program from Add/Remove Programs

3) Find "Web Search Toolbar" and "Win-Tools Easy Installer (By Web Search)" in the list of installed programs and click on Change/Remove to uninstall it.

During the uninstall process, you will be presented with several prompts to guide you through uninstalling the product. Read these carefully to make sure you are actually choosing to uninstall rather than keep the software.

** Note: I find it particularly funny that after the install, the company actually pops up a screen telling you its not spyware and guiding you to buy spyware removal software with what appears to be affiliate links that the company would profit from. See a screenshot of this advertisement.

5) After rebooting the computer, run HijackThis and remove any of the leftover lines shown above especially the following lines that do not seem to be uninstalled completely.

R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll

O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50024/QDow_AS2.cab

6) Next, open My Computer, Drive C, and double-click on the Program Files folder

Also check for the presence of the C:\Program Files\Common Files\Wintools directory. If this folder still remains you may have to follow the WinTools uninstall procedure.

8) IBIS WebSearch (websearch.com) should now be completely uninstalled from your computer.