Internet Explorer toolbar has new icons

  • Thread starter Thread starter Stelcom
  • Start date Start date
S

Stelcom

My IE toolbar now has the icons: Remove Popups, Scan Spyware, Security Test &
Spam Protection, all of which attempt to download a file, it's some kind of
malicious thing my pc somehow acquired. I can remove them temporarily via the
View command, the toolbar is actually named "The ensfolr". I ran Windows
Defender, McAffee and another program I purchased called Spywarebot. Defender
& Spywarebot found items, I couldn't remove the item called "Smitfraud" that
Defender found until I went into Safe Mode. I wonder how can I remove the
program for this toolbar? I even went into msconfig to disable various
startup items, no luck. I see nothing related to the term "ensfolr".
 
Stelcom said:
My IE toolbar now has the icons: Remove Popups, Scan Spyware, Security Test &
Spam Protection, all of which attempt to download a file, it's some kind of
malicious thing my pc somehow acquired. I can remove them temporarily via the
View command, the toolbar is actually named "The ensfolr". I ran Windows
Defender, McAffee and another program I purchased called Spywarebot. Defender
& Spywarebot found items, I couldn't remove the item called "Smitfraud" that
Defender found until I went into Safe Mode. I wonder how can I remove the
program for this toolbar? I even went into msconfig to disable various
startup items, no luck. I see nothing related to the term "ensfolr".
Click to expand...

Your computer is still infected. Do the preparatory steps here:
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Then do the specific removal steps here:
http://www.elephantboycomputers.com/page2.html#Smitfraud_Trojan -
Smitfraud, Spyaxe, Spyfalcon

You can also check to see if there are targeted removal steps for your
malware here:
Bleeping Computer removal how-to's -
http://www.bleepingcomputer.com/forums/forum55.html

When all else fails, run HijackThis and post your log in one of the
specialty forums listed at the first link above (not here, please).

Not all tools used will work in Vista and you will need to run them
elevated. If you are unable to remove the infection by following the
general steps, register at one of the HijackThis forums as suggested.

Standard caveat: If the procedures look too complex - and there is no
shame in admitting this isn't your cup of tea - take the machine to a
professional computer repair shop (not your local version of
BigComputerStore/GeekSquad). Please be aware that not all local shops
are skilled at removing malware and even if they are, your computer may
be so infested that Windows will need to be clean-installed. Have all
your data backed up before you take the machine into a shop.


Malke
 
Hi Shawn,

Thanks for the help. I did find "The ensfolr" in Add Ons, but I wasn't able
to find it when I went to Control Panel - Programs/Features to remove it. Or,
at least the name wasn't like the original. I was able to find the
ensfolr.dll file and I deleted it. The strange thing is after I did that and
restarted the pc it still showed in the View - Toolbars in IE, but if I
clicked view it wouldn't run. I removed it by doing System Restore to a few
hours before it was added, maybe there was another way but your suggestion
certainly helped to find the .dll file and when it was added. I recall
downloading some kind of video codec that a website said was required to run
a video. It seems at that point the toolbar was added.
 
Thanks - I'll look at the links provided for future reference, see my
previous post. I did run the SmitFraudfix and maybe I did something wrong,
according to the log it didn't find anything. McAfee kept telling me it was
an unwanted program. After running it my desktop background was chaged to a
solid color and the icon's text font was changed. I ran System Restore which
restored the settings. When I have more time I'll read the info in the links
provided in detail.
 
Shawn,

Now that I read your original response more carefully I see there was a step
to reset IE7, which I skipped. Had I done that maybe the Restore wouldn't
have been necessary.
 
Back
Top