CWS.toolband is a CWS variant implemented as an Internet Explorer Browser Helper Object and toolbar [1] [2].

CWS.toolband's main files, Toolband.dll and rundlg32.dll, are located in %ProgramsDir%\IntBar\ or in %WinDir%\Downloaded Program Files\. CWS.toolband adds a "URLSearchHook" that is queried when the browser cannot determine the protocol of a URL. There are some indications that CWS.toolband change some browser settings to

Note: %ProgramsDir% is a variable (?). By default, this is C:\Program Files.
Note: %WinDir% is a variable (?). By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\WINNT (Windows NT/2000).

Norton Anti-virus reports CWS.toolband as Spyware.Iwantsearch:

4. Source: C:\WINDOWS\Downloaded Program Files\rundlg32.dll Description: The file C:\WINDOWS\Downloaded Program Files\rundlg32.dll is a Spyware threat. Click for more information about this threat : Spyware.Iwantsearch

There is also another variant that uses webdlg32.dll as its filename.


Changes custom URL protocol translation


CoolWebSearch  CoolWebSearch.alfasearch  CoolWebSearch.control  CoolWebSearch.cpan  CoolWebSearch.criticalupdater  CoolWebSearch.ctrlpan  CoolWebSearch.dnse  CoolWebSearch.dnserr  CoolWebSearch.dpe  CoolWebSearch.ehttp  CoolWebSearch.excel10  CoolWebSearch.explorer32  CoolWebSearch.googlems  CoolWebSearch.iefeatsl  CoolWebSearch.iefeatslupdate  CoolWebSearch.image  CoolWebSearch.keymgrldr  CoolWebSearch.ld  CoolWebSearch.madfinder  CoolWebSearch.mgs_32  CoolWebSearch.msaps  CoolWebSearch.msconfd  CoolWebSearch.msmk  CoolWebSearch.mssearch  CoolWebSearch.msstar  CoolWebSearch.msstar2  CoolWebSearch.mstaskm  CoolWebSearch.msupdate  CoolWebSearch.msupdater  CoolWebSearch.mtwirl32  CoolWebSearch.notepad32  CoolWebSearch.ntsearch  CoolWebSearch.olehelp  CoolWebSearch.popup_bl  CoolWebSearch.quicken  CoolWebSearch.qttasks  CoolWebSearch.soundmx  CoolWebSearch.sys  CoolWebSearch.time  CoolWebSearch.toolband  CoolWebSearch.winproc32  CoolWebSearch.winsuck  CoolWebSearch.winres  CoolWebSearch.winug  CoolWebSearch.xplugin  CoolWebSearch.xpsystem  CoolWebSearch.xrectar 


Toolband.dll, rundlg32.dll, webdlg32.dll

If you have any of the files related to CWS.toolband on your system, please send them for additional analysis. Generally, I have only analysed a few versions for each software component listed at this web site. With your help I will be able to look at both old and more recent versions of the CWS.toolband software. Thank you very much for your time!

Log references

Privacy policy

No privacy policy available.


Bazooka Adware and Spyware Scanner detects CWS.toolband. Bazooka is freeware and detects spyware, adware, foistware, trojan horses, viruses, worms and other potentially unwanted applications. Read more »

Uninstall CWS.toolband with FreeFixer

I'm working on a general purpose tool for removing unwanted software. The tool is called FreeFixer and can help you remove unwanted Browser Helper Objects, Internet Explorer toolbars and software that starts automatically when you reboot your computer, so it can offer some assistance while uninstalling CWS.toolband. The manual removal instructions listed below will help you to identify what to delete with FreeFixer.

Read more about FreeFixer.

Manual removal

Please follow the instructions below if you would like to remove CWS.toolband manually. Please notice that you must follow the instructions very carefully and delete everything that is mentioned. In most cases the removal will fail if one single item is not deleted. If CWS.toolband remains on your system after stepping through the removal instructions, please double-check by stepping through them again.

  1. Start your computer in safe mode.
  2. Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
  3. Delete 'HKEY_LOCAL_MACHINE\SOFTWARE \ Classes \ CLSID \ {30192F8D-0958-44E6-B54D-331FD39AC959}', if it exists.
  4. Delete 'HKEY_LOCAL_MACHINE\SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer\Browser Helper Objects \ {30192F8D-0958-44E6-B54D-331FD39AC959}', if it exists.
  5. Browse to the key:
    'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ Toolbar'
  6. In the right pane, delete the value called {30192F8D-0958-44E6-B54D-331FD39AC959}, if it exists.
  7. Browse to the key:
    'HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Internet Explorer \ Toolbar \ WebBrowser'
  8. In the right pane, delete the value called {30192F8D-0958-44E6-B54D-331FD39AC959}, if it exists.
  9. Exit the registry editor.
  10. Start Windows Explorer and delete:
    %WinDir%\Downloaded Program Files\Toolband.dll
    %WinDir%\Downloaded Program Files\rundlg32.dll
    %WinDir%\Downloaded Program Files\webdlg32.dll
    Note: %ProgramsDir% is a variable (?). By default, this is C:\Program Files.
    Note: %WinDir% is a variable (?). By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\WINNT (Windows NT/2000).
  11. Start Microsoft Internet Explorer.
  12. In Internet Explorer, click Tools -> Internet Options.
  13. Click the Programs tab -> Reset Web Settings.

Problems uninstalling? Click here.

I'm looking for your help!

Thank you for using my site, I hope you find it useful. I'm looking for help from all users, please read more.

Contact information for CWS.toolband's vendor

In order to provide correct, accurate and updated information about CWS.toolband I encourage the vendor to contact me if any part of this write-up needs a revision.

How do you rate the information provided about CWS.toolband?

Related links

Bazooka - Free scan for spyware, adware, trojan horses, keyloggers, etc. Detects more than 500 potentially unwanted applications. Freeware!

The File Database - Search the file database for more information. Free!

PopUp Blocker Test - Find out if your pop-up killer can handle all pop-ups. Free!

Kephyr Labs - Find out what is going on at Kephyr. Try products in an early stage of development.

Read more about FreeFixer, Kephyr's latest spyware removal tool.
Home & Products |  Legal |  Privacy |  Search

© Kephyr, 2003-2012. HtmlTidy, HTML 4.01, CSS