The list of toolbars is no longer hosted here. The current list is located at sysinfo.org.
A toolbar's CLSID is a Globally Unique Identifier (GUID) associated with a COM class. It is the unique identifier of a COM server, which in turn is a piece of code compiled into an executable (EXE file) or into a dynamic link library (DLL file).
Before you turn away in utter disgust, here's an example:
Many applications will add a toolbar to Internet Explorer's standard collection (The Address Bar, the Links bar, and others)
Let's take the well known Google Toolbar. On installation it adds certain registry entries that use its googletoolbar_en_1.1.70-big.dll file to implement an Internet Explorer Toolbar.
Once implemented and registered, the toolbar can be selected through the Toolbars submenu of the Internet Explorer View menu or from the shortcut menu that is displayed by right-clicking the toolbar area.
The first step in that process is "registering" that toolbar with Windows. To that effect the Google installer creates the following Registry entries:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ {2318C2B1-4965-11d4-9B18-009027A5CD4F}]
@="&Google"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\ {2318C2B1-4965-11d4-9B18-009027A5CD4F}\InprocServer32]
@="e:\\windows\\googletoolbar_en_1.1.70-big.dll"
"ThreadingModel"="Apartment"
The Google Toolbar is now registered as a unique object within your Windows Installation, and Windows will know it exists.
As a next step the new Tool Band must have its object's CLSID registered with Internet Explorer. To that effect a value under HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar named with the tool band object's CLSID is created.
In the case of the Google Toolbar, like this:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}"=hex:00
Now launch Internet Explorer, and the new toolbar will be an integrated part of it.
Now here's how this list came about:
Merijn Bellekom, a young Dutch developer, has created a troubleshooting tool called Hijack This, which can be downloaded here.
It examines certain key areas of the Registry and Hard Drive and lists their contents. These are areas which are used by both legitimate programmers and baddies like viruses, trojans, spyware or hijackers.
In addition Hijack This can be used to respectively remove selected items or restore the Windows defaults for a registry value, without the need of manually editing the Registry.
Here's a snippet of such a Hijack This log, just to show what kind of things it detects, and how it lists them:
Logfile of HijackThis v1.94.0
Scan saved at 17:01:32, on 4-5-2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://g.msn.com/0SESA/enus?http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=E:\WINDOWS\System32\blank.htm
O2 - BHO: (no name) - {7559B76E-0222-4d77-9499-CCE9EB4EDC2F} - E:\PROGRA~1\AdShield\AdShield\AdShield.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\windows\googletoolbar_en_1.1.70-big.dll
O4 - HKLM\..\Run: [BOCleanautostart] BOClean.exe
O8 - Extra context menu item: Download All by FlashGet - E:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: Add To Trusted Sites (HKLM)
O9 - Extra button: Fill Forms (HKLM)
O9 - Extra 'Tools' menuitem: Fill Forms &] (HKLM)
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http//download.macromedia.com/pub/shockwave/cabs/director/sw.cab
As you see, under O3 we have our Google Toolbar, its identifier and dll clearly listed.
However, sometimes this isn't the case, and only an orphaned identifier is visible. The list can then be helpful in determining what application might have installed that particular toolbar CLSID.
Now here's a listing of known Toolbar Object CLSIDs.
For those interested, I also maintain a list of Browser Helper Objects (BHOs), such as the O2 entry in our Hijack This log.
That list can be viewed here .
Listed Toolbars are tagged X for certified spyware/foistware, or other malware, L for legitimate items, O for 'open to debate' and ? for objects of unknown status.
A thank you goes to Fred de Vries, who's been helping out by installing a number of these toolbars himself in order to extract their Class IDs.
Another big thank you to FreeAtLast who has been a big help in studying the behaviour of some suspicious toolbars.