Remove Gift n Games Toolbar

By | September 29, 2013

Remove Gift n Games ToolbarGift n Games Toolbar is a browser extension, plugin or addon for Google Chrome and Mozilla Firefox, also called a Browser Helper Object for Internet Explorer. The Gift n Games Toolbar is made and promoted by Conduit Ltd and will replace or hijack your default homepage to and in this case the search results are promoted by called GIFTS N GAMES Customized Web Search. The Gift n Games Toolbar is bundled during the installation process of free or shareware downloads by download managers. This PUP – Potentially Unwanted Program is not a malicious process, but it’s build to promote services, advertisements and should not be bundled during the installation process to trick users into installing it without a decent notice.

It is advised to always read the Terms and Agreements before installing software on your computer. Do never click too fast through the installation process [Next] button of software as you will agree to software you might not want to install. If the installer offers an Advanced, Custom or Decline button, click it to find out if there is any other malicious software offered and installed during the installation process.

Remove Gift n Games Toolbar

Remove Gift n Games Toolbar

Please note that all the software we offer to remove Gift n Games Toolbar is free, our instruction is tested and works to remove this threat from your Internet Explorer, Google Chrome or Mozilla Firefox browser. We do not supply any shareware which detects the threat and asks a license in order to remove Gift n Games Toolbar.

Follow all steps in correct order to completely and successfuly remove Gift n Games Toolbar.
This is important: if you have any problem during this removal instruction in order to remove this threat, please stop and ask for assistance using the comments at the end of this instruction.
Step 1 – Remove Gift n Games Toolbar from your favorite browser using AdwCleaner

Step 2 – Remove Gift n Games Toolbar left overs using Junkware Removal Tool

This is a comprehensive removal instruction to remove Gift n Games Toolbar from your computer. If for some reason the instruction does not deliver the desired results, you can reset your favorite browser Internet Explorer, Google Chrome or Mozilla Firefox to default settings. In first place this is not recommended, as restoring to default settings will remove all your personal settings from your browser. Please use restoring to default settings only if anything else fails. Need help ? Ask for our assistance and the end of this instruction.

Step 3 – Optional: Reset browser settings

Remove Gift n Games ToolbarRemove Gift n Games Toolbar using AdwCleaner

AdwCleaner will scan your computer for malicious Services, Folder, Files, Shortcuts, Registry items and Products. As AdwCleaner tries to delete these malicious content it will also clean the Internet Explorer, Google Chrome and Mozilla Firefox browser. We strongly recommend using AdwCleaner several times a month to keep your computer clean from adware, popups, browser hijackers or toolbars.
Download AdwCleaner (Official link and direct-download)

Select AdwCleaner.exe with right mouse click and Run as Administrator

Remove Gift n Games Toolbar - AdwCleaner

If User Account Control asks you to allow AdwCleaner.exe to make changes to your computer, press Yes to continue.

Remove Gift n Games Toolbar

Start scanning your computer for any malicious threats by selecting the Scan button, please wait.

Remove Gift n Games Toolbar

AdwCleaner will now start scanning your computer. If AdwCleaner is done, it will display a list of malicious items detected, please uncheck the items you do not want to remove that might be detected as malicious.
If you have nothing to uncheck, continue to the removal process and select the Clean button.

Remove Gift n Games Toolbar

AdwCleaner will display the following informational alerts and starts rebooting the computer.

All programs will be closed in order to proceed correctly to the removal of the infections. Please save any work in progress and the click [OK]

If you have been brought to use AdwCleaner, it’s probably because your PC contained potentially unwanted programs or adware.
Potentially unwanted programs are often proposed during the installation of software. They may be present form of toolbars that sometimes change the homepage of the browser and slow internet browsing.
To avoid the installation of these programs polluting the computer, it is essential to follow these tips:

– Always download a program from the official link, or a trusted site
– When installing a program, do not click too fast [Next] without paying attention to Terms of Use and third-party programs available.
– If third-party programs are available (toolbars, etc) uncheck them.
– Enable detection of PUP (Potentially Unwanted Program) in your Antivirus.

AdwCleaner must restart the computer to complete the removal process. The report will be opened on the next reboot.

After the reboot a logfile will open. The logfile in Windows XP and Windows 7 will open once the desktop is started. To open the logfile in Windows 8 you need to switch to the Desktop modus by selecting windows key + d on your keyboard.
If you want to check the AdwCleaner log, you can find the report log in your system drive, Adwcleaner folder (for example: C:\adwcleaner)

# AdwCleaner v3.005 – Report created 29/09/2013 at 16:58:13
# Updated 22/09/2013 by Xplode
# Operating System : Windows 8 Pro (64 bits)
# Username :
# Running from : C:\Users\\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****
***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\savenSharE
Folder Deleted : C:\Users\\AppData\Local\Temp\CT3303698
Folder Deleted : C:\Users\\AppData\LocalLow\savenSharE
Folder Deleted : C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\wpoqdxhq.default-1379935650934\Smartbar
Folder Deleted : C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\wpoqdxhq.default-1379935650934\CT3303698
Folder Deleted : C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\wpoqdxhq.default-1379935650934\Extensions\{d46102d3-4611-4506-9665-c598175f9271}
File Deleted : C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\wpoqdxhq.default-1379935650934\searchplugins\Conduit.xml

***** [ Shortcuts ] *****
***** [ Registry ] *****

Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Webplayer
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16384
-\\ Mozilla Firefox v24.0 (en-US)

[ File : C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\wpoqdxhq.default-1379935650934\prefs.js ]

Line Deleted : user_pref(“CT3303698.ENABALE_HISTORY”, “{\”dataType\”:\”string\”,\”data\”:\”true\”}”);
Line Deleted : user_pref(“CT3303698.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE”, “{\”dataType\”:\”string\”,\”data\”:\”true\”}”);
Line Deleted : user_pref(“CT3303698.FF19Solved”, “true”);
Line Deleted : user_pref(“CT3303698.FirstTime”, “true”);
Line Deleted : user_pref(“CT3303698.FirstTimeFF3”, “true”);
Line Deleted : user_pref(“CT3303698.SearchFromAddressBarUrl”, “hxxp://”);
Line Deleted : user_pref(“CT3303698.UserID”, “UN12131874192905523”);
Line Deleted : user_pref(“CT3303698.addressBarTakeOverEnabledInHidden”, “true”);
Line Deleted : user_pref(“”, “true”);
Line Deleted : user_pref(“CT3303698.countryCode”, “NL”);
Line Deleted : user_pref(“CT3303698.defaultSearch”, “true”);
Line Deleted : user_pref(“CT3303698.embeddedsData”, “[{\”appId\”:\”10000002\”,\”apiPermissions\”:{\”crossDomainAjax\”:true,\”getMainFrameTitle\”:true,\”getMainFrameUrl\”:true,\”getSearchTerm\”:true,\”instantAlert\”:[…]
Line Deleted : user_pref(“CT3303698.enableSearchFromAddressBar”, “true”);
Line Deleted : user_pref(“CT3303698.firstTimeDialogOpened”, “true”);
Line Deleted : user_pref(“CT3303698.fixPageNotFoundErrorByUser”, “TRUE”);
Line Deleted : user_pref(“CT3303698.fixPageNotFoundErrorInHidden”, “true”);
Line Deleted : user_pref(“CT3303698.fullUserID”, “UN12131874192905523.IN.20130929164452”);
Line Deleted : user_pref(“CT3303698.installDate”, “29/09/2013 16:44:54”);
Line Deleted : user_pref(“CT3303698.installSessionId”, “A69E07E3-CE7E-49A6-89EB-715D4F137388”);
Line Deleted : user_pref(“CT3303698.installSp”, “false”);
Line Deleted : user_pref(“CT3303698.installType”, “xpe”);
Line Deleted : user_pref(“CT3303698.installUsage”, “2013-09-29T17:45:54.7997033+03:00”);
Line Deleted : user_pref(“CT3303698.installUsageEarly”, “2013-09-29T17:45:54.1601033+03:00”);
Line Deleted : user_pref(“CT3303698.installerVersion”, “”);
Line Deleted : user_pref(“CT3303698.isCheckedStartAsHidden”, true);
Line Deleted : user_pref(“CT3303698.isEnableAllDialogs”, “{\”dataType\”:\”string\”,\”data\”:\”true\”}”);
Line Deleted : user_pref(“CT3303698.isFirstTimeToolbarLoading”, “false”);
Line Deleted : user_pref(“CT3303698.isToolbarShrinked”, “{\”dataType\”:\”string\”,\”data\”:\”false\”}”);
Line Deleted : user_pref(“CT3303698.isWelcomPage”, “{\”dataType\”:\”boolean\”,\”data\”:\”true\”}”);
Line Deleted : user_pref(“CT3303698.keyword”, “true”);
Line Deleted : user_pref(“CT3303698.lastNewTabSettings”, “{\”isEnabled\”:true,\”newTabUrl\”:\”hxxp://\”}”);
Line Deleted : user_pref(“CT3303698.lastVersion”, “”);
Line Deleted : user_pref(“CT3303698.mam_gk_appStateReportTime.enc”, “MTM4MDQ2NTk1NzIyNg==”);
Line Deleted : user_pref(“CT3303698.mam_gk_appState_CouponBuddy.enc”, “b2Zm”);
Line Deleted : user_pref(“CT3303698.mam_gk_appState_Easytobook.enc”, “b2Zm”);
Line Deleted : user_pref(“CT3303698.mam_gk_appState_Easytobook_targeted.enc”, “b2Zm”);
Line Deleted : user_pref(“CT3303698.mam_gk_appState_PriceGong.enc”, “b2Zm”);
Line Deleted : user_pref(“CT3303698.mam_gk_appState_WindowShopper.enc”, “b2Zm”);
Line Deleted : user_pref(“CT3303698.mam_gk_appState_eToro.enc”, “b2Zm”);
Line Deleted : user_pref(“CT3303698.mam_gk_appsData.enc”, “eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9wcmljZWdvbmcuY29uZHVpdGFwcHMuY29tL01BTS92MS9odG1sX2NvbXAuaHRtbCIsInNjcmlwdFVybCI6bnVsbCwib3B0aW9uc0Rp[…]
Line Deleted : user_pref(“CT3303698.mam_gk_appsDefaultEnabled.enc”, “bnVsbA==”);
Line Deleted : user_pref(“CT3303698.mam_gk_calledSetupService.enc”, “MQ==”);
Line Deleted : user_pref(“CT3303698.mam_gk_configuration.enc”, “eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6ImVUb3JvIiwiY3JpdGVyaWFzIjpbeyJjcml0ZXJpYUlkIjoiMzdjN2FkZDktOTYxMy00MzliLWE1MmEtMmU0Yzg5NDE1ZGE1IiwiZG9tYWlucyI6WyJjbm4[…]
Line Deleted : user_pref(“CT3303698.mam_gk_currentVersion.enc”, “MS4xMC40LjA=”);
Line Deleted : user_pref(“CT3303698.mam_gk_existingUsersRecoveryDone.enc”, “MQ==”);
Line Deleted : user_pref(“CT3303698.mam_gk_first_time.enc”, “MQ==”);
Line Deleted : user_pref(“CT3303698.mam_gk_gadgetOpen.enc”, “d2VsY29tZQ==”);
Line Deleted : user_pref(“CT3303698.mam_gk_installer_preapproved.enc”, “ZmFsc2U=”);
Line Deleted : user_pref(“CT3303698.mam_gk_lastLoginTime.enc”, “MTM4MDQ2NTk1OTY4Ng==”);
Line Deleted : user_pref(“CT3303698.mam_gk_localization.enc”, “eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50IFBvbGljeSJ9LCJnYWRnZXREZXNjcmlwdGlvblByaW1hcnkiOnsiVGV4dCI6IlZhbHVlIEFwcHMgZW5yaWNoZXMgeW91ciB3ZWIg[…]
Line Deleted : user_pref(“CT3303698.mam_gk_mamEnabled.enc”, “ZmFsc2U=”);
Line Deleted : user_pref(“CT3303698.mam_gk_new_welcome_experience.enc”, “MQ==”);
Line Deleted : user_pref(“CT3303698.mam_gk_pgUnloadedOnce.enc”, “dHJ1ZQ==”);
Line Deleted : user_pref(“CT3303698.mam_gk_settings1.10.4.0.enc”, “eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiTkwiLCJpc1dlbGNvbWVFeHBl[…]
Line Deleted : user_pref(“CT3303698.mam_gk_showWelcomeGadget.enc”, “ZmFsc2U=”);
Line Deleted : user_pref(“CT3303698.mam_gk_userId.enc”, “YTIyYjk5YjAtNThiMy00NTIxLTlmMWYtNmM3MWM5NjdlN2Fh”);
Line Deleted : user_pref(“CT3303698.mam_gk_user_approval_interacted.enc”, “MA==”);
Line Deleted : user_pref(“CT3303698.mam_gk_welcomeDialogMode.enc”, “MA==”);
Line Deleted : user_pref(“CT3303698.navigationAliasesJson”, “{\”EB_MAIN_FRAME_URL\”:\”\”,\”EB_MAIN_FRAME_[…]
Line Deleted : user_pref(“CT3303698.openThankYouPage”, “true”);
Line Deleted : user_pref(“CT3303698.openUninstallPage”, “true”);
Line Deleted : user_pref(“CT3303698.originalHomepage”, “hxxp://”);
Line Deleted : user_pref(“CT3303698.originalSearchAddressUrl”, “”);
Line Deleted : user_pref(“CT3303698.originalSearchEngine”, “”);
Line Deleted : user_pref(“CT3303698.originalSearchEngineName”, “”);
Line Deleted : user_pref(“CT3303698.revertSettingsEnabled”, “true”);
Line Deleted : user_pref(“”, “10000002”);
Line Deleted : user_pref(“”, “0”);
Line Deleted : user_pref(“CT3303698.searchFromAddressBarEnabledByUser”, “true”);
Line Deleted : user_pref(“CT3303698.searchInNewTabEnabledByUser”, “true”);
Line Deleted : user_pref(“CT3303698.searchInNewTabEnabledInHidden”, “true”);
Line Deleted : user_pref(“CT3303698.searchRevert”, “true”);
Line Deleted : user_pref(“CT3303698.searchSuggestEnabledByUser”, “true”);
Line Deleted : user_pref(“CT3303698.searchUserMode”, “1”);
Line Deleted : user_pref(“CT3303698.selectToSearchBoxEnabled”, “{\”dataType\”:\”string\”,\”data\”:\”true\”}”);
Line Deleted : user_pref(“CT3303698.serviceLayer_service_login_isFirstLoginInvoked”, “{\”dataType\”:\”boolean\”,\”data\”:\”true\”}”);
Line Deleted : user_pref(“CT3303698.serviceLayer_service_login_loginCount”, “{\”dataType\”:\”number\”,\”data\”:\”3\”}”);
Line Deleted : user_pref(“CT3303698.serviceLayer_service_toolbarGrouping_activeCTID”, “{\”dataType\”:\”string\”,\”data\”:\”CT3303698\”}”);
Line Deleted : user_pref(“CT3303698.serviceLayer_service_toolbarGrouping_activeDownloadUrl”, “{\”dataType\”:\”string\”,\”data\”:\”hxxp://\”}”);
Line Deleted : user_pref(“CT3303698.serviceLayer_service_toolbarGrouping_activeToolbarName”, “{\”dataType\”:\”string\”,\”data\”:\”GIFTS N GAMES \”}”);
Line Deleted : user_pref(“CT3303698.serviceLayer_service_toolbarGrouping_invoked”, “{\”dataType\”:\”string\”,\”data\”:\”true\”}”);
Line Deleted : user_pref(“CT3303698.serviceLayer_service_usage_toolbarUsageCount”, “{\”dataType\”:\”number\”,\”data\”:\”2\”}”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_Configuration_lastUpdate”, “1380465954188”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_appTrackingFirstTime_lastUpdate”, “1380465955339”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_appsMetadata_lastUpdate”, “1380465957503”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_gottenAppsContextMenu_lastUpdate”, “1380465955117”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate”, “1380465954386”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate”, “1380465955059”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_login_10.20.1.8_lastUpdate”, “1380465955407”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_otherAppsContextMenu_lastUpdate”, “1380465955153”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_searchAPI_lastUpdate”, “1380465954193”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_serviceMap_lastUpdate”, “1380465954071”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_toolbarContextMenu_lastUpdate”, “1380465955071”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_toolbarSettings_lastUpdate”, “1380465957452”);
Line Deleted : user_pref(“CT3303698.serviceLayer_services_translation_lastUpdate”, “1380465955230”);
Line Deleted : user_pref(“CT3303698.settingsINI”, true);
Line Deleted : user_pref(“CT3303698.shouldFirstTimeDialog”, “false”);
Line Deleted : user_pref(“CT3303698.showToolbarPermission”, “false”);
Line Deleted : user_pref(“CT3303698.smartbar.CTID”, “CT3303698”);
Line Deleted : user_pref(“CT3303698.smartbar.Uninstall”, “0”);
Line Deleted : user_pref(“CT3303698.smartbar.homepage”, “true”);
Line Deleted : user_pref(“CT3303698.smartbar.toolbarName”, “GIFTS N GAMES “);
Line Deleted : user_pref(“CT3303698.startPage”, “true”);
Line Deleted : user_pref(“CT3303698.toolbarBornServerTime”, “29-9-2013”);
Line Deleted : user_pref(“CT3303698.toolbarCurrentServerTime”, “29-9-2013”);
Line Deleted : user_pref(“CT3303698.toolbarLoginClientTime”, “Sun Sep 29 2013 16:45:55 GMT+0200”);
Line Deleted : user_pref(“CT3303698.versionFromInstaller”, “”);
Line Deleted : user_pref(“CT3303698.xpeMode”, “0”);
Line Deleted : user_pref(“CT3303698_Firefox.csv”, “[{\”from\”:\”Abs Layer\”,\”action\”:\”loading toolbar\”,\”time\”:1380466631355,\”isWithState\”:\”\”,\”timeFromStart\”:0,\”timeFromPrev\”:0}]”);
Line Deleted : user_pref(“Smartbar.ConduitHomepagesList”, “hxxp://”);
Line Deleted : user_pref(“Smartbar.ConduitSearchEngineList”, “GIFTS N GAMES Customized Web Search”);
Line Deleted : user_pref(“Smartbar.ConduitSearchUrlList”, “hxxp://”);
Line Deleted : user_pref(“Smartbar.SearchFromAddressBarSavedUrl”, “”);
Line Deleted : user_pref(“Smartbar.keywordURLSelectedCTID”, “CT3303698”);
Line Deleted : user_pref(“”, “GIFTS N GAMES Customized Web Search”);
Line Deleted : user_pref(“”, “GIFTS N GAMES Customized Web Search”);
Line Deleted : user_pref(“”, “hxxp://{searchTerms}”);
Line Deleted : user_pref(“”, “GIFTS N GAMES Customized Web Search”);
Line Deleted : user_pref(“browser.startup.homepage”, “hxxp://”);
Line Deleted : user_pref(“keyword.URL”, “hxxp://”);
Line Deleted : user_pref(“smartbar.addressBarOwnerCTID”, “CT3303698”);
Line Deleted : user_pref(“smartbar.conduitHomepageList”, “hxxp://”);
Line Deleted : user_pref(“smartbar.conduitSearchAddressUrlList”, “hxxp://”);
Line Deleted : user_pref(“smartbar.defaultSearchOwnerCTID”, “CT3303698”);
Line Deleted : user_pref(“smartbar.homePageOwnerCTID”, “CT3303698”);

[ File : C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\z5mcwxfd.default-1379072010919\prefs.js ]
-\\ Google Chrome v29.0.1547.76

[ File : C:\Users\\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Remove Gift n Games ToolbarRemove Gift n Games Toolbar left overs using Junkware Removal Tool

Junkware Removal Tool will not only remove this threat from your computer, but Junkware Removal Tool will scan and remove any threat from your computer that is malicious. Junkware Removal Tool is a great tool to completely clean your computer from any threat and highly recommended to use frequently to keep your computer clean and healthy. Best of all it’s free and updated regularly.
Download Junkware Removal Tool (Official link and direct-download)

Select JRT.exe with right mouse click and Run as Administrator

Remove Gift n Games Toolbar

If User Account Control asks you to allow JRT.exe to make changes to your computer, press Yes to continue.

Remove Gift n Games Toolbar

As described on

Junkware Removal Tool is a security utility that searches for and removes common adware, toolbars, and potentially unwanted programs (PUPs) from your computer.  A common tactics among freeware publishers is to offer their products for free, but bundle them with PUPs in order to earn revenue.  This tool will help you remove these types of programs.

Please note: Close all your browsers, save any work and then press any key to continue.
Your desktop may blink or a new window may open during the scan and removal process of junkware removal tool.

Remove Gift n Games Toolbar

When Junkware Removal Tool is done scanning and removing malicious items from your computer a logfile will open.

Optional: Reset browser settings

If for some reason the instruction as supplied does not work for you, or the problem remains. It might be advised to restore your settings from your favorite browser to default settings. Please know when you restore to default settings all your personal settings will be lost. If you do agree to continue to reset your Internet Explorer, Google Chrome or Mozilla Firefox browser to default settings see our instructions.

Reset Internet Explorer to default settings

  1. Open Internet Explorer
  2. goto “wrench” icon in top right corner
  3. Select Internet Options
  4. Goto tab Advanced
  5. Select Reset button
  6. Enable Delete personal Settings
  7. Click Reset button
  8. Restart Internet Explorer

Reset Google Chrome to default settings

  1. Open File Explorer in Windows
  2. Navigate to C:\Users\{YOUR USERNAME}\AppData\Local\Google\Chrome\
  3. Delete the folder User Data with all it’s content (you must be logged in Administrator to do this!!)
  4. Restart Google Chrome browser

Reset Mozilla Firefox to default settings

  1. Open Mozilla Firefox
  2. Goto the orange Firefox button in the top left
  3. Select Help > Troubleshooting information
  4. Select Reset Firefox
  5. Confirm Reset Firefox
  6. Select Finish
  7. Mozilla Firefox will automatically restart
Author: Max

Hi, I am Max. I am a computer security researcher. Every day I blog about new adware threats as they are released. I am also active in various online communities to help people with their computer problems. Stay safe!

Leave a Reply

Your email address will not be published.