WebSearch Toolbar

Overview

WebSearch Toolbar, also called IBIS Toolbar, is an Internet Explorer search toolbar. WebSearch Toolbar changes the Search Bar and SearchAssistant to http://www.websearch.com/ie.aspx, shows related links based on the information your view and the pages you visit. WebSearch Toolbar has a silent update feature. WebSearch Toolbar will appear in the task manager's process list as TBPS.exe, WSG.exe and PIB.exe. Sometimes there are multiple TBPS.exe processes.

From the developer: "By installing the Service you understand and agree that the following changes may be made to your Internet Explorer browser and that the following functions may be performed by the Service: install a Search Toolbar in your browser which may (i) block certain pop-up ads and pages; (ii) display links to related websites and keywords based on the information you view and the websites you visit; (iii) store non-personally identifiable statistics of the websites you have visited; (iv) redirect certain URL's including your browser default address bar search, DNS error page and Search Button page to or through the Service and; (v) automatically update the Service and install added features or functionality conveniently without your input or interaction unless you have chose to be notified of such update in advance." Source

Later versions of WebSearch Toolbar may also change settings in the Windows Firewall: "(v) on Windows X2 Service Pack 2 computers use Microsoft Firewall API to open communication ports IBIS uses in the toolbar to communicate with servers and;.."

Lavasoft states in their Threat Assessment Chart that WebSearch Toolbar use tracking cookies, change browser results and tracks the user's surfing habit. PestPatrol classify WebSearch Toolbar as a Search Hijacker and states the following reasons for retention: "Changes browser settings other than homepage, without user permission. Silently tracks sites visited along with identification of the user/machine by IP address, GUID for that machine, email address, name, SSN#, phone number, credit card info, or other identifier without user permission."

WebSearch Toolbar can be installed from the vendor's site, http://download.websearch.com/install/download.aspx?id=50024&t=2. If you visit this url with Internet Explorer, an security warning dialog will appear. The dialog states that it will install "WebSearch Assistant/Toolbar/Tools and Win-Tools Easy Installer; free ad-supported downloads which help you search the web and display Search Assistant branded search results and ads based on the sites you view? First click here and read our agreements, then click yes to accept them". In this encyclopedia Win-Tools Easy Installer is described as Win-Tools. According to an IBIS representative 13% of the WebSearch Toolbar distributions also contain Win-Tools Easy Installer.

The second method of installation is to use the downloader file, http://download.websearch.com/Dnl/T_50024/edow.exe. This executable does not show an end user license agreement.

The third method of installation is to download WebSearch Toolbar from Download.com's software repository by accessing the following URL: http://www.download.com/3001-2379_4-10342757.html which will open a download dialog for "setupex.exe". This executable does not show an end user license agreement.

The fourth method of installation is to visit ZDNet China with the following URL: http://www.zdnet.com.cn/download/windows/ personal/swinfo/0,2008005289,39051400s,00.htm which, will open a download dialog for "tb_setup_31.exe", located in http://www.websearch.com/toolbar/.

Classification

Change browser settings
Bundled software

Files

IExploreSkins.exe, PIB.exe, TBPS.exe, TBPSvc.exe, WSG.exe, common.dll, toolbar.dll, BBDE.cab, Stoolbar.dll, cursors.xml, edow.exe, setupex.exe

If you have any of the files related to WebSearch Toolbar on your system, please send them for additional analysis. Generally, I have only analysed a few versions for each software component listed at this web site. With your help I will be able to look at both old and more recent versions of the WebSearch Toolbar software. Thank you very much for your time!

Vendor

Websearch.com, IBIS LLC, contact@ibisit.com

End User License Agreement

2003-11-25

Privacy policy

2003-11-25

Alias

IBIS Toolbar Adware [Microsoft Antispyware], IBIS Toolbar [AdAdware], HuntBar [Spybot Search & Destroy], Application.IBIS.Toolbar, Adware.Tbbar.A [BitDefender], Adware.Toolbar-6 [ClamAV], Adware/Websearch [Fortinet], AdWare.WebSearch.aa, RiskWare.Tool.Exporun, AdWare.WebSearch.f [Kaspersky Anti-Virus], RiskWare.Tool.Exporun, AdWare.WebSearch.f [VBA32], ADW_WBSEARCH.A [Trendmicro], Adware.Websearch [Norton AntiVirus]

Detection

Bazooka Adware and Spyware Scanner does not detect WebSearch Toolbar.

Uninstall notice for WebSearch Toolbar

Notice that removing WebSearch Toolbar may cause the program that bundled it to not function as intended.

Uninstall procedure

Uninstall WebSearch Toolbar from "Add/Remove Programs" in the Windows® Control Panel. Look for an entries called 'WebSearch Toolbar', 'WebSearch Tools' and 'Search Assistant'. If you run into problems uninstalling WebSearch Toolbar, please contact the vendor at contact@ibisit.com for advise.

Observations during the uninstall procedure

Uninstall from the "Add/Remove programs" generally works smoothly, however there are also incidents where WebSearch Toolbar reinstalls without user consent right after it has been uninstalled from the "Add/Remove programs" dialog. Another observation worth mentioning here is that the uninstall information text in the Toolbar's options is bigger than the dialog. It is not possible to scroll or resize the dialog to see the complete text. Copying the text does not work either.

Uninstall WebSearch Toolbar with FreeFixer

I'm working on a general purpose tool for removing unwanted software. The tool is called FreeFixer and can help you remove unwanted Browser Helper Objects, Internet Explorer toolbars and software that starts automatically when you reboot your computer, so it can offer some assistance while uninstalling WebSearch Toolbar. The manual removal instructions listed below will help you to identify what to delete with FreeFixer.

Read more about FreeFixer.

Manual removal

Please follow the instructions below if you would like to remove WebSearch Toolbar manually. Please notice that you must follow the instructions very carefully and delete everything that is mentioned. In most cases the removal will fail if one single item is not deleted. If WebSearch Toolbar remains on your system after stepping through the removal instructions, please double-check by stepping through them again.

1. Start your computer in safe mode.
2. Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
3. Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {339BB23F-A864-48C0-A59F-29EA915965EC}', if it exists.
4. Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {6A85D97D-665D-4825-8341-9501AD9F56A3}', if it exists.
5. Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {8952A998-1E7E-4716-B23D-3DBE03910972}', if it exists.
6. Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects \ {8952A998-1E7E-4716-B23D-3DBE03910972}, if it exists.
7. Delete 'HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Internet Explorer \ Toolbar \ {339BB23F-A864-48C0-A59F-29EA915965EC}', if it exists.
8. Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ Toolbar \ {6A85D97D-665D-4825-8341-9501AD9F56A3}', if it exists.
9. Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Uninstall \ TTOOL_UNINSTALL', if it exists.
10. Delete 'HKEY_CURRENT_USER \ Software \ Microsoft \ Internet Explorer \ Toolbar \ WebBrowser \ {339BB23F-A864-48C0-A59F-29EA915965EC}', if it exists.
11. Delete 'HKEY_CURRENT_USER \ Software \ Microsoft \ Internet Explorer \ Toolbar \ WebBrowser \ {6A85D97D-665D-4825-8341-9501AD9F56A3}', if it exists.
12. Browse to the key:
    'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run'
13. In the right pane, delete the value called 'TBPS', if it exists.
14. Exit the registry editor.
15. Start Windows Explorer and delete:
    %ProgramsDir%\Toolbar\
    Note: %ProgramsDir% is a variable (?). By default, this is C:\Program Files.
16. Start Microsoft Internet Explorer.
17. In Internet Explorer, click Tools -> Internet Options.
18. Click the Programs tab -> Reset Web Settings.
    

Problems uninstalling? Click here.

I'm looking for your help!

Thank you for using my site, I hope you find it useful. I'm looking for help from all users, please read more.

Contact information for WebSearch Toolbar's vendor

In order to provide correct, accurate and updated information about WebSearch Toolbar I encourage the vendor to contact me if any part of this write-up needs a revision.

Additional notes

IBIS LLC sent a CEASE AND DESIST letter to me on the 5th of April, 2005. Bazooka's detection for WebSearch Toolbar has therefore been removed.