Jump to content

Removing Babylon Toolbar


Recommended Posts

Hello All,

Since a short time I'm dealing with a very annoying type of spyware/malware called Babylon.

After trying to delete in manually with the configuration windows of software and deleting it from the browers options itself - it's still there.

Altho I'm not having to many problems with it (At least it seems), I still don't trust the toolbar and starting page fully.

Including with this post is the ComboFix Log I did in the first place - with the directions that was given in a previous post on this forum with a member that was infected with babylon.

I hope somebody can see into this problem, Thanks in Advance.



Link to post
Share on other sites

Welcome to the forum.

Please download AdwCleaner from here and save it on your Desktop.

  1. Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.


Link to post
Share on other sites

  1. Please re-run AdwCleaner
  2. Click on Delete button.
  3. Confirm each time with OK.
  4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.


Link to post
Share on other sites

Just booted in safe mode, tried to run it with the same error occuring and still no log results.

When I booted Firefox it said something about that it wasn't my default brower and if I wanted to set it as default brower again. (Normally doesn't give this message when booting Firefox)

Link to post
Share on other sites

Run AdwCleaner again and hit the uninstall button.

Download a fresh copy and run it:

Please download AdwCleaner from here and save it on your Desktop.

  1. Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

You don't have to the log just continue and click the "Delete" button.

Let me know, MrC

Link to post
Share on other sites

It seems like it's gone now from my browser ^_^

Are you enable to open the file?

In case it doens't open I'll post in this post.

Hope it's gone and i'm clear again

Thanks in Advance!


# AdwCleaner v2.002 - Verslag gemaakt op 09/19/2012 om 17:52:42

# Geactualiseerd op 16/09/2012 door Xplode

# Besturingssysteem : Windows 7 Ultimate Service Pack 1 (64 bits)

# Gebruiker : Mike - PC-MIKE

# Opstarten Modus : Normale modus

# Gelanceerd vanaf : C:\Users\Mike\Desktop\adwcleaner.exe

# Optie [Verwijderen]

***** [Diensten] *****

***** [Files / Mappen] *****

***** [Register] *****

***** [browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Vervangen : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=HP_ss&mntrId=9653f2390000000000008c89a57e160a --> hxxp://www.google.com

Vervangen : [HKCU\Software\Microsoft\Internet Explorer\Main - BrowserMngr Start Page] = hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=HP_ss&mntrId=9653f2390000000000008c89a57e160a --> hxxp://www.google.com

Vervangen : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=NT_ss&mntrId=9653f2390000000000008c89a57e160a --> hxxp://www.google.com

-\\ Mozilla Firefox v15.0.1 (nl)

Profielnaam : default

File : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\ksh7ya9l.default\prefs.js

C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\ksh7ya9l.default\user.js ... Verwijdert !

Verwijdert : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=NT_ss&mntr[...]

Verwijdert : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");

Verwijdert : user_pref("browser.search.order.1", "Search the web (Babylon)");

Verwijdert : user_pref("browser.search.selectedEngine", "Search the web (Babylon)");

Verwijdert : user_pref("browser.startup.homepage", "hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=HP_s[...]

Verwijdert : user_pref("extensions.BabylonToolbar.admin", false);

Verwijdert : user_pref("extensions.BabylonToolbar.aflt", "babsst");

Verwijdert : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");

Verwijdert : user_pref("extensions.BabylonToolbar.autoRvrt", "false");

Verwijdert : user_pref("extensions.BabylonToolbar.babExt", "");

Verwijdert : user_pref("extensions.BabylonToolbar.babTrack", "affID=110823&tt=3612_6");

Verwijdert : user_pref("extensions.BabylonToolbar.babext", "babExt");

Verwijdert : user_pref("extensions.BabylonToolbar.babtrack", "babTrack");

Verwijdert : user_pref("extensions.BabylonToolbar.bbDpng", "19");

Verwijdert : user_pref("extensions.BabylonToolbar.bbdpng", 6);

Verwijdert : user_pref("extensions.BabylonToolbar.cntry", "NL");

Verwijdert : user_pref("extensions.BabylonToolbar.dfltLng", "en");

Verwijdert : user_pref("extensions.BabylonToolbar.dfltlng", "en");

Verwijdert : user_pref("extensions.BabylonToolbar.dfltsrch", "false");

Verwijdert : user_pref("extensions.BabylonToolbar.dp_alert", "0");

Verwijdert : user_pref("extensions.BabylonToolbar.dpk", "a239ee63432785bc9c5f6d9c56596c52");

Verwijdert : user_pref("extensions.BabylonToolbar.envrmnt", "production");

Verwijdert : user_pref("extensions.BabylonToolbar.excTlbr", false);

Verwijdert : user_pref("extensions.BabylonToolbar.firstrun", false);

Verwijdert : user_pref("extensions.BabylonToolbar.hdrMd5", "6E8EB69C1C5DDD93FA8DFE259713D2F4");

Verwijdert : user_pref("extensions.BabylonToolbar.hmpg", false);

Verwijdert : user_pref("extensions.BabylonToolbar.hrdid", "9653f2390000000000008c89a57e160a");

Verwijdert : user_pref("extensions.BabylonToolbar.id", "9653f2390000000000008c89a57e160a");

Verwijdert : user_pref("extensions.BabylonToolbar.instlDay", "15588");

Verwijdert : user_pref("extensions.BabylonToolbar.instlRef", "sst");

Verwijdert : user_pref("extensions.BabylonToolbar.instlday", "15588");

Verwijdert : user_pref("extensions.BabylonToolbar.instlref", "sst");

Verwijdert : user_pref("extensions.BabylonToolbar.isdcmntcmplt", "false");

Verwijdert : user_pref("extensions.BabylonToolbar.keywordurl", "");

Verwijdert : user_pref("extensions.BabylonToolbar.lastVrsnTs", "");

Verwijdert : user_pref("extensions.BabylonToolbar.lastdp", 6);

Verwijdert : user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.1");

Verwijdert : user_pref("extensions.BabylonToolbar.newTab", false);

Verwijdert : user_pref("extensions.BabylonToolbar.newtab", "false");

Verwijdert : user_pref("extensions.BabylonToolbar.newtaburl", "");

Verwijdert : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");

Verwijdert : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");

Verwijdert : user_pref("extensions.BabylonToolbar.prtnrid", "babylon");

Verwijdert : user_pref("extensions.BabylonToolbar.savedVrsnTs", "1");

Verwijdert : user_pref("extensions.BabylonToolbar.sg", "tzb");

Verwijdert : user_pref("extensions.BabylonToolbar.smplGrp", "tzb");

Verwijdert : user_pref("extensions.BabylonToolbar.smplgrp", "none");

Verwijdert : user_pref("extensions.BabylonToolbar.srcExt", "ss");

Verwijdert : user_pref("extensions.BabylonToolbar.srcext", "ss");

Verwijdert : user_pref("extensions.BabylonToolbar.srch", "");

Verwijdert : user_pref("extensions.BabylonToolbar.srchprvdr", "");

Verwijdert : user_pref("extensions.BabylonToolbar.tlbrId", "tb9");

Verwijdert : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[...]

Verwijdert : user_pref("extensions.BabylonToolbar.tlbrid", "tb9");

Verwijdert : user_pref("extensions.BabylonToolbar.tlbrsrchurl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[...]

Verwijdert : user_pref("extensions.BabylonToolbar.vrsn", "");

Verwijdert : user_pref("extensions.BabylonToolbar.vrsnTs", "");

Verwijdert : user_pref("extensions.BabylonToolbar.vrsni", "");

Verwijdert : user_pref("extensions.BabylonToolbar.vrsnts", "");

Verwijdert : user_pref("extensions.BabylonToolbar_i.babExt", "");

Verwijdert : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=110823&tt=3612_6");

Verwijdert : user_pref("extensions.BabylonToolbar_i.newTab", false);

Verwijdert : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

Verwijdert : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

Verwijdert : user_pref("extensions.BabylonToolbar_i.vrsnTs", "");

-\\ Google Chrome v21.0.1180.89

File : C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Preferences

Verwijdert [l.580] : homepage = "hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=HP_ss&mntrId=9653f2390000000000008c89a57e160a",

Verwijdert [l.739] : urls_to_restore_on_startup ="session": {"restore_on_startup": 4, [ "hxxp://search.babylon.com/?affID=110823&tt=3612_6&babsrc=HP_ss&mntrId=9653f2390000000000008c89a57e160a" ]},


AdwCleaner[s1].txt - [484 octets] - [19/09/2012 17:52:27]

AdwCleaner[s2].txt - [6903 octets] - [19/09/2012 17:52:42]

########## EOF - C:\AdwCleaner[s2].txt - [6963 octets] ##########

Link to post
Share on other sites

Great thumbsup.gif

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /


Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)


Please download OTL from one of the links below: (you may already have OTL on the system)




Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, etc....


Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.