WinSB

Overview

WinSB, also known as Windows Search Bar hijacker, is an UPX compressed browser helper object and toolbar with unknown purpose.

Looking inside the winsb.dll file, the following data of interest is found:
"http://conf.blazefind.com/index.php"

Connecting to the url above will return the following data: "1084301659 | http://conf.blazefind.com/Icons/Search.ico 1088190358 | http://conf.blazefind.com/XML2/WindowsSB.xml 1088190401 | http://conf.blazefind.com/Icons/Go.ico", which indicates that WinSB is a BlazeFind variant. BlazeFind.com describes its software as ".. a toolbar installed in your Internet Explorer and/or a search bar placed directly on your windows taskbar." WinSB is mentioned at the security forums where its removal is recommended [1] [2] [3] [4] [5] [6] [7].

Classification

Internet Explorer toolbar

Files

WinSB.dll, WinSB1.dll

If you have any of the files related to WinSB on your system, please send them for additional analysis. Generally, I have only analysed a few versions for each software component listed at this web site. With your help I will be able to look at both old and more recent versions of the WinSB software. Thank you very much for your time!

Log references

Log 517 Log 832

Vendor

BlazeFind

Detection

Bazooka Adware and Spyware Scanner detects WinSB. Bazooka is freeware and detects spyware, adware, foistware, trojan horses, viruses, worms and other potentially unwanted applications. Read more »

Uninstall procedure

Uninstall WinSB from "Add/Remove Programs" in the Windows® Control Panel.

Uninstall WinSB with FreeFixer

I'm working on a general purpose tool for removing unwanted software. The tool is called FreeFixer and can help you remove unwanted Browser Helper Objects, Internet Explorer toolbars and software that starts automatically when you reboot your computer, so it can offer some assistance while uninstalling WinSB. The manual removal instructions listed below will help you to identify what to delete with FreeFixer.

Read more about FreeFixer.

Manual removal

Please follow the instructions below if you would like to remove WinSB manually. Please notice that you must follow the instructions very carefully and delete everything that is mentioned. In most cases the removal will fail if one single item is not deleted. If WinSB remains on your system after stepping through the removal instructions, please double-check by stepping through them again.

1. Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
2. Delete 'HKEY_LOCAL_MACHINE\SOFTWARE \ Classes \ CLSID \ {1E432263-6841-4653-8F02-366A2F77E339}', if it exists.
3. Delete 'HKEY_LOCAL_MACHINE\SOFTWARE \ Classes \ CLSID \ {9FB534E3-67CB-4307-AE0A-9E8B5581BE2C}', if it exists.
4. Delete 'HKEY_LOCAL_MACHINE\SOFTWARE \ Classes \ CLSID \ {A1DD937D-71E1-4BB5-BD5D-1B01B9CB1C2F}', if it exists.
5. Delete 'HKEY_LOCAL_MACHINE\SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer\Browser Helper Objects \ {9FB534E3-67CB-4307-AE0A-9E8B5581BE2C}', if it exists.
6. Browse to the key:
   'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ Toolbar'
7. In the right pane, delete the value called {A1DD937D-71E1-4BB5-BD5D-1B01B9CB1C2F}, if it exists.
8. Browse to the key:
   'HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Internet Explorer \ Toolbar \ WebBrowser'
9. In the right pane, delete the value called {A1DD937D-71E1-4BB5-BD5D-1B01B9CB1C2F}, if it exists.
10. Exit the registry editor.
11. Restart your computer.
12. Start Windows Explorer and delete:
    WinSB.dll
    WinSB1.dll
13. Start Microsoft Internet Explorer.
14. In Internet Explorer, click Tools -> Internet Options.
15. Click the Programs tab -> Reset Web Settings.
    

Problems uninstalling? Click here.

I'm looking for your help!

Thank you for using my site, I hope you find it useful. I'm looking for help from all users, please read more.

Contact information for WinSB's vendor

In order to provide correct, accurate and updated information about WinSB I encourage the vendor to contact me if any part of this write-up needs a revision.