Toolbars: Innocent Programs Packaged with Malware

On the surface, toolbars seem like innocent programs that help you organize your bookmarks or make searching the web easier. However, many toolbar programs are packaged with malware. We mentioned toolbars with Adware, and this is just one malicious program that could be included with your favorite toolbar applications. Before you install a browser extension or third-party toolbar that changes your browser, consider the following issues and privacy concerns.

---

A Brief History of Toolbar Malware

Toolbars are those menu items at the top of your browser. Some search engines created a toolbar that extended the browser menu to include a search function right in the browser. The user typed a search into the toolbar, and the user was automatically redirected to the search results in the browser.

One common toolbar that popped up even in Java installations was the Ask toolbar. Ask did a massive campaign to include its own search engine in browsers to compete against the ever-growing popularity of Google. The push actually had a negative effect on the way users perceived Ask. Instead of using Ask, they deleted the toolbar due to the other unwanted programs included.

Since the Ask toolbar, more toolbars continued to pop up around the Internet. For the most part, they looked like harmless programs that just made it easier to search. However, toolbars often came packaged with Adware, Spyware, and programs that would hijack certain page results. For instance, the user’s home page was changed to an ad page. Instead of seeing Google, users would get a list of links or a third party landing page that could contain even more malware.

---

Why You Don’t Want to Install That Toolbar

Toolbar programs have extended beyond the basic Ask toolbar. They now add several additional malicious components. Toolbars also come with several side effects.

First, Adware works hand-in-hand with toolbars. Adware works to gather user behaviors. Toolbars give users the ability to search without first navigating to a search engine. When a user sends a search phrase through the toolbar, the Adware running in the background picks up this information and sends it to the malware creator. You could also argue that these programs are Spyware. Spyware and Adware also work together to gather user information including user browsing habits. In today’s world where consumers live on the Internet, this type of information is invaluable to marketers.

Even Avast – one of the leading antivirus software companies -- calls toolbars “almost malware”. The fact is that on the surface these toolbars offer a good user experience. However, it’s the background programs that cause issue.

Take a look at one popular image for a user who installed too many toolbars.

The effect of the above installations probably leaves this user with malware that destroys browser and Internet performance. One common issue with toolbars since they contain so much Spyware and Adware is that they use a lot of bandwidth. Your Internet connection slows down, and your PC performance is noticeably slower.

The above image is an extreme example, but with enough malware and toolbars installed, the user’s PC eventually crashes. Malware isn’t written with the intent to endure too long. It isn’t tested for bugs or monitors for any errors. These applications usually come with a payload that’s simple several bugs that can crash a PC.

To look like a legitimate program, most toolbars even have fraudulent uninstall programs. These programs usually don’t work, so they are fraudulent ways to convince the user that the program was removed when, in fact, it’s still installed on the user’s computer.

Sneakier toolbar installations add a group policy entry on the local computer that stops the user from removing the malware. Most users aren’t familiar with the group policy editor (called local policy editor on desktop Windows machines). These policies control software installation permissions and startup applications. Even if the user removes the application, these policies tell the Windows operating system to install the software during the next boot. The user doesn’t understand why the program keeps installing even after being removed, so it’s a frustrating cycle.

---

Avoiding Toolbar Malware

Toolbars are sometimes standalone applications, but they are typically packaged with other software. Software developers are offered money to package a specific toolbar with their applications, so it’s common with freeware. Freeware desktop applications usually come at a price, and this price is the installation of toolbar malware.

If you insist on installing software from third-party developers that aren’t trusted, always read the installation questions. Believe it or not, you can actually avoid most toolbar malware if you just opt out of the toolbar add-ons when you install your software. Developers who package toolbars with legitimate software often give you the option to opt-out of toolbar installations. You can sometimes get a clean installation of your software without adding any malware.

Some browsers don’t allow toolbars such as Chrome. Chrome keeps your browser experience clean, but you must avoid installing third-party Chrome extensions that aren’t from trusted sources. Even without toolbar add-ons, these extensions can sometimes hijack your browser and cause you to have unexpected pages display for searches or other browser activity.

---

Removing Toolbar Malware

Most toolbars can be removed fairly easily. If you do a search for the specific toolbar and how to remove it, you can find step-by-step instructions. It’s usually a matter of deleting certain files and removing registry entries. You might also use the uninstall software included with the toolbar program, or you might need to take extra steps to remove it as well.

Remember that some toolbar writers create security policies on the PC to restrict users from removing the application. You’ll also need to be familiar with the policy editor and how to change these policies to stop the computer from downloading and reinstalling the malware after you remove it.

If you aren’t familiar with the Windows registry or the local policy editor, it’s better to download an antivirus application and run a full scan on your computer. The scan usually identifies toolbar malware and can remove it for you.