Previous: "Home"
mirar toolbar removal
If you have managed to mistakenly, or unknowingly install the mirar toolbar/spyware and wish the hijacking to end, then here is your answer. This is a manual uninstall of this annoying program, so first you should back up all your important files, and if you aren't comfortable with working with the registry and command line interface, then you should use a mirar removal tool, and registry cleaning software. There are a few on the internet for free, or as part of some demo anti-virus programs. There are also programs to back up the files and processes you will be altering in this tutorial. Always maintain backups.
This tutorial will come in 4 steps:
1) Trash all mirar processes.
2) Get rid of registry values and keys.
3) Deregister all .dll's.
4) Trash all the mirar files.
Now we'll start with the first step, delete all processes.
Go to Start -> Search -> Files and Folders. Here you need to find 2 files "mirarsetup.exe" and "875455-NOSB.exe". Delete both of these files by right clicking on them and then delete.
For the next step you need to back up your registry, realize that it is infected already, but at least it works, and if anything goes wrong when you edit the registry, at least you can restore it and start over.
Open the registry editor by going to Start -> Run, then enter "REGEDIT" click "OK". When the registry editor opens go to Edit -> Find, now you need to find and delete the following entries in the registry individually. In order to delete the fields indicated, first select the field, right click, select delete. Here is the list of entries:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunToolbarInstall=mirarsetup.exe
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionshareddlls c:winntsystem32windmy.dll
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionshareddlls c:winntdownloaded program filesmirarsetup.exe
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionmoduleusagec:/winnt/system32/windmy.dll
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionmoduleusagec:/winnt/downloaded program files/mirarsetup.exe
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionInternetsettingsoneMapDomains
et-nucleus.com
9A9C9B68-F908-4AAB-8D0C-10EA8997F37E
HKEY_LOCAL_MACHINESOFTWAREClassesNN_Bar.NN_Bar_Helper
HKEY_LOCAL_MACHINESOFTWAREClassesNN_Bar_Dummy.NN_BarDummy.1
HKEY_LOCAL_MACHINESOFTWAREClassesNN_Bar.NN_Bar_Helper.1
HKEY_LOCAL_MACHINESOFTWAREClassesNN_Bar_Dummy.NN_BarDummy
HKEY_LOCAL_MACHINESOFTWAREClassesNN_Bar.NN_WebBand
HKEY_LOCAL_MACHINESOFTWAREClassesNN_Bar.NN_WebBand.1
179E4B4A-76C3-4F65-BCED-C9FA1A28D2EF
1037B06C-84B7-4240-8D80-485810A0497D
8A0DCBDA-6E20-489C-9041-C1E8A0352E75
224302B0-94E9-45C2-9E5B-BA989EE556E1
566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49
54B287F9-FD90-4457-B65E-CB91560C021D
6E4C7AFC-9915-4036-B7F9-8B3F1710788F
753B9349-7E46-4E5C-A27F-A60A6BF1EAB5
F8310E7D-4C4D-46A4-A068-B5BB99411CC7
4035DE1B-D54A-411E-9EE7-923295D2E86E
9A9C9B69-F908-4AAB-8D0C-10EA8997F37E
As was stated before, make a backup of the registry before deleting the above entries.
The third step in the process is to unregister all the .dll's that are associated with the spyware. In order to unregister the files you must get the exact locations of the files concerned, then go to Start -> Run, then type in "regsvr32/u (file name), then press enter. The full path must go into the file name field. Here are the .dll's: windmy.dll, nn_bar21.dll, nn_bar.dll, nn_bar22.dll, nn_bar31.dll, winnb(x).dll, winnb41.dll, and winnb40.dll.
Now on to the last few steps, there a few files that will be left you need to search for, the installer.cab, mit3.tmp.cab, and the mit3.cab. Once these files are deleted, empty the recycle bin, reboot your machine, then do a complete scan disk and disk defragmenter.
After all that, it becomes worth it to use an automatic removal tool that could be found on the internet. If you do decide to attempt this long process, make sure to have all back-ups handy that you may need to do a system restore. As a good practice, you should do this anyway, with all the malware, spyware, and viruses on the internet, it is hard to just maintain a system operating at it's peak proficiency. As a safety measure, to insure against this type of thing happening again in the future, you should install an anti-virus and spyware program,. There are a lot of these on the internet, so it should be an easy task to find a suitable candidate.