Babylon.Toolbar - Flagged as Adware C

[Andy112]

Hi,

I updated Spybot S&D yesterday and ran a scan today - to my surprise it showed 17 threats by Babylon.Toolbar - AdwareC.

I search around and it seems like a toolbar for Babylon translation. But I've never downloaded that program before. I've checked my Program list, Firefox, IE and no signs of this babylon toolbar. How it got to my system is still a mystery to me.

I went for the fix on Spybot...it couldn't fix two of them because it was still in use by the memory.

So I plan on doing a clean install on my computer - but was wondering if this babylon.toolbar is a malicious trojan/virus that spreads throughout your files or more a adware nuisance?

The reason I ask is because I have some files I want to save, but I don't want to bring over infected files to the new install.

Any help is appreciated, Thanks!

*Sorry, I can't post any logs due to being away from the computer with the babylon.toolbar*

[tashi]

Hello Andy112,

So I plan on doing a clean install on my computer

A format would be pretty drastic. Which browser are you using?

I went for the fix on Spybot...it couldn't fix two of them because it was still in use by the memory.

Did you trying running in safe mode?

"In safe mode, you have access to only basic files and drivers. When the machine is operating in normal mode all processes are running.
Scanning with Spybot-S&D in safe mode allows the program to try and remove items that keep reappearing after a scan, despite having been 'fixed'.

http://forums.spybot.info/showpost.p...29&postcount=2

*Sorry, I can't post any logs due to being away from the computer with the babylon.toolbar*

When you have access to the computer you could start a new topic in the Malware Removal Forum http://forums.spybot.info/forumdisplay.php?f=22 providing the DDS logs so a volunteer analyst can advise.

FAQ: http://forums.spybot.info/showthread.php?t=288

Of interest: http://krebsonsecurity.com/2011/12/d...ns/#more-12761

Best regards,

[Andy112]

Hi Tashi,

Thanks for the reply.

1) As for the re-format; I was planning to do it as a way to make my system snappier again lol...but the discovery of this "babylon.toolbar" propelled it to a sooner time.

As for browser, currently using FF.

2) As for safe-mode, I tried that but for some reason some traces of it still popped up during a re-scan. I'll have to double-check when I have access to that computer.

3) I was wondering, if this babylon.toolbar spreads like a trojan/virus or is it more of a nuisance? Just want to know if I can safely remove some documents from my computer.

Thanks for your help!

[tashi]

Hi Andy112,

3) I was wondering, if this babylon.toolbar spreads like a trojan/virus or is it more of a nuisance? Just want to know if I can safely remove some documents from my computer.

It's not a file infecting virus.

Categories:

• adware

Description:

Babylon Toolbar is a useless toolbar that gets installed by other software,

http://forums.spybot.info/showthread.php?t=65321

As for browser, currently using FF.

Curious, did you use Start > Control Panel > Add/Remove programs to see if the toolbar is listed?

Also open Firefox > tools > add-ons and check to see if the toolbar is a browser add on.

But if you are going to reformat you'd be starting off fresh anyway.

[Andy112]

Hi Tashi,

Thanks for confirming that it wasn't a file infecting virus.

As for checking if the toolbar was installed, I did go into the Add/Remove Programs and the addons in FF; but I didn't find any thing that had babylon in there.

Still a mystery to how it got installed in the first place lol.

Thanks for you help!

[tashi]

Hi Andy112,

There is always the chance of a false positive

As for the re-format; I was planning to do it as a way to make my system snappier again lol..

[trutone]

Interesting. I just got 17 instances of Babylon toolbar too. Not listed in add/remove programs and can't be removed due to not being logged in as administrator, which is incorrect as I was logged in as administrator. Will try a scan in safe mode.

[tashi]

Hello trutone,

http://forums.spybot.info/showthread.php?t=65391tp://

There will be a modification for the detection of Babylon.Toolbar in Wednesday's update, 14-3-2012.

[trutone]

Thanks Tashi. My German is a bit rusty but I ran another scan in safe mode this time and it found 17 instances again of BT but this time it said cannot remove 2 of them due to being used in memory and asked permission to scan again on startup. I rebooted into normal mode and did another scan and no detections this time! Ran another scan just to be sure and again no detections.

[tashi]

I used a translator.

Thank you for this message.
With the next update of the detection on Wednesday, the 14.03.2012 detection for the Babylon.Toolbar is modified accordingly, that previously to other components of the Babylon.Toolbar is checked.

Please make sure that the Babylon.Toolbar at them is installed nor was, as it often silently installs itself and leaves still functional remains even after a regular uninstall.

Updates are tomorrow.