Should I remove SearchElf 1 Toolbar?

What percent of users and experts removed it?

77% remove it23% keep it

Overall Sentiment

Bad

What do people think about it?

(click star to rate)

How common is it?

Reach <0.001%

Lifespan of installation (until removal)

< 121.62 days

313.97 days >

Average installed length: 164.97 days

Versions

Version	Distribution
6.2.2.4	100.00%

Other programs by Conduit

SearchElf 1 Toolbar

from Conduit Ltd.

Remove SearchElf 1 Toolbar by Conduit

What is SearchElf 1 Toolbar?

SearchElf 1 Toolbar is a Conduit distributed toolbar built on the community toolbar platform which provides web browser integration. This browser extension's primary purpose is to take control of the user's search functionality in order to generate a revenue share for the publisher and Conduit. In addition to search hijacking (although there should be options during bundle installation to prevent this), the toolbar will install itself in Internet Explorer as a toolbar and Browser Helper Object. Also, many installs contain 'Value Apps', which provide additional functionality as well as include various adware extensions such as Cash Back and Price Gong. As for distribution, the toolbar is typically bundled with 3rd party publishers in order to try to maximize install revenue as typically payouts per installation is between a few cents and a couple dollars depending on the geographical location of the host. The platform in many cases installs a service 'engine' that is designed to protect the toolbar as well as the modified search and home pages to Conduit's affiliate search partner.

About (from Conduit)

As part of the installation process of the Conduit Software and/or the Customized Software, we may change your Internet Browser settings and/or provide you with the ability to opt to make changes to your Internet Browser settings and/or your mobile device settings and/or your social network account settings. Change of ... Read more

Overview

Malware detected in the program
Integrates into the web browser
This toolbar is distributed via Conduit (potentially unwanted)
Adds a background Windows Service
Known to reinstall itself
Hijacks the web browser's home page
The experts agree, you should remove it!

Warning, multiple anti-virus scanners have detected possible malware in SearchElf 1 Toolbar.

tbSear.dll (e4cc410bd005958125cd87c5f6e66371) has been flagged by the following 4 scanners:
Anti-Virus software	Version	Detection
Bkav FE	1.3.0.4246	HW32.Stranact
ESET-NOD32	7.9577	a variant of Win32/Toolbar.Conduit.B
Panda Antivirus	14.04.22.11	PUP/Conduit.A
VIPRE Antivirus	27650	Conduit (fs)
prxtbSea2.dll (c89d9c80fd468c6b51c4aadcc8463c2d) has been flagged by the following 7 scanners:
Anti-Virus software	Software version	Detection
AVware	1.5.0.21	Conduit (fs)
Baidu-International	3.5.1.41473	PUA.Win32.Conduit.BX
ESET-NOD32	10643	Win32/Toolbar.Conduit.X
Fortinet FortiGate	5.0.999.0	Riskware/Toolbar_Conduit
G Data	24	Win32.Application.Conduit.F
Panda Antivirus	10.0.3.5	PUP/Conduit.A
VIPRE Antivirus	34366	Conduit (fs)
SearchElf_1ToolbarHelper.exe (943f313974a830d4634c73beb8103f5e) has been flagged by the following 4 scanners:
Anti-Virus software	Software version	Detection
Comodo Security	17313	Application.Win32.Conduit.~f
Dr.Web		Adware.Toolbar.202
Malwarebytes	1.75.0.1	PUP.Optional.Conduit.A
VIPRE Antivirus	23610	Conduit (fs)
uninstall.exe (b728fa6a309e5d18141947b95b730e95) has been flagged by the following 2 scanners:
Anti-Virus software	Software version	Detection
Panda Antivirus	10.0.3.5	PUP/Conduit.A
VIPRE Antivirus	26380	Conduit (fs)

View all 17 all detections

Program details

Displayed publisher: SearchElf 1

URL: SearchElf1.OurToolbar.com

Help link: SearchElf1.OurToolbar.com/help

Installation folder: C:\Program Files\searchelf_1

Uninstaller: C:\Program Files\SearchElf_1\uninstall.exe

Estimated size: 22.37 MB

This is a Community Toolbar by Conduit, what does that mean?

Conduit is a toolbar monetization platform for software publishers. It provides a utility for developers to create branded generic web browser toolbars. Publishers can bundle these toolbars with their software programs or provide access to download them separately through SearchElf1.OurToolbar.com. Once installed, the toolbar modifies the browser's home page and search settings in order to redirect searches through the Conduit portal (which utilizes Bing or Yahoo! Search engines). Read more...

Files installed by SearchElf 1 Toolbar

Program module:	tbSear.dll (Malware detected)
Name:	Conduit Toolbar
Path:	C:\Program Files\searchelf_1\tbSear.dll
MD5:	e4cc410bd005958125cd87c5f6e66371

Additional files:

tbSea1.dll - Conduit Toolbar Automatic Update (Conduit Toolbar)
(Malware detected) SearchElf_1ToolbarHelper.exe - ToolbarHelper Application
(Malware detected) uninstall.exe - Conduit Toolbar Uninstall
hk64tbSea0.dll - Conduit Toolbar
hk64tbSea2.dll
hktbSea0.dll
hktbSea2.dll
ldrtbSea0.dll
ldrtbSea2.dll
(Malware detected) prxtbSea2.dll
tbSea0.dll
tbSea2.dll
(Malware detected) tbSear.dll
UNWISE.EXE

Behaviors exhibited

2 Internet Explorer BHOs

prxtbSea2.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'Radio Masha Toolbar' with the class of {7d05e712-71cd-49ed-9628-9ee79534b87a} (Radio Masha).
tbSear.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'MessengerPlusLive TB Toolbar' with the class of {d8fb4583-db9d-4c7b-85be-294c13a3e5c4}.

Internet Explorer Bar

tbSear.dll installs an Explorer Bar in Internet Explorer called 'Softonic France FF Findbar' with a class of {EC99436A-C0E6-4FFA-915D-132E669B3936}.

2 Internet Explorer Toolbars

prxtbSea2.dll is loaded as Internet Explorer Toolbar with the name 'Radio Masha Toolbar' with the class of {7d05e712-71cd-49ed-9628-9ee79534b87a}.
tbSear.dll is loaded as Internet Explorer Toolbar with the name 'MessengerPlusLive TB Toolbar' with the class of {d8fb4583-db9d-4c7b-85be-294c13a3e5c4}.

2 Internet Explorer URL Search Hooks

prxtbSea2.dll loads into IE as a URL Search Hook named 'Radio Masha Toolbar' with a class of {7d05e712-71cd-49ed-9628-9ee79534b87a} in order to redirect unknown URL searches.
tbSear.dll loads into IE as a URL Search Hook named 'MessengerPlusLive TB Toolbar' with a class of {d8fb4583-db9d-4c7b-85be-294c13a3e5c4} in order to redirect unknown URL searches.

2 Internet Explorer Web Browsers

tbSear.dll installs an IE Web Browser in Internet Explorer named 'MessengerPlusLive TB Toolbar' with a class of {D8FB4583-DB9D-4C7B-85BE-294C13A3E5C4}.
prxtbSea2.dll installs an IE Web Browser in Internet Explorer named 'iNTERNET TURBO Toolbar' with a class of {09152F0B-739C-4DEC-A245-1AA8A37594F1}.

2 Scheduled Tasks

UNWISE.EXE is scheduled as a task with the class '{F71A9918-1861-4EFE-AE94-530BDDE46DD4}' (runs on registration).
uninstall.exe is scheduled as a task with the class '{C247631C-606C-44F8-9B4E-C25B77177427}' (runs on registration).

Service

UNWISE.EXE runs as a service named 'Browser System Enahncer' (671c50b0).

2 Windows Firewall Allowed Programs

UNWISE.EXE is added as a firewall exception for 'C:\Program Files1\Yahoo!\MESSEN~1\UNWISE.EXE'.
SearchElf_1ToolbarHelper.exe is added as a firewall exception for 'C:\Program Files\eTvOnline.ro\eTvOnline.roToolbarHelper.exe'.

How do I remove SearchElf 1 Toolbar?

You can uninstall SearchElf 1 Toolbar from your computer by using the Add/Remove Program feature in the Window's Control Panel.

On the Start menu (for Windows 8, right-click the screen's bottom-left corner), click Control Panel, and then, under Programs, do one of the following:

Windows Vista/7/8/10: Click Uninstall a Program.
Windows XP: Click Add or Remove Programs.

When you find the program SearchElf 1 Toolbar, click it, and then do one of the following:

Windows Vista/7/8/10: Click Uninstall.
Windows XP: Click the Remove or Change/Remove tab (to the right of the program).

Follow the prompts. A progress bar shows you how long it will take to remove SearchElf 1 Toolbar.
If for some reason uninstallation fails, please install Microsoft's uninstall fixer utility which will help fix problems with programs that can't be uninstalled at support.microsoft.com.