A spyware that cannot be removed...

[JKatarn]

let me tell you my situation.
Several days before i was being infected by many spywares
(about 10)
i removed it all with my Microsoft anti-spyware (BETA)
program.
but after restarting my computer, my anti spyware didnt
start the scheduled scan that night, EVERY NIGHT.
every time when i start up my anti-spyware, i have to
setup all the settings again.
And when i scan my computer for spyware, theres always
one that left in my computer, HDTBar.
I think i had removed it for almost 20 times already, but
10 mins later it will be back again.
I tried to delete the registry, and the temporary files (
I found a HDTBar thing in there...)
but it still cant be defeated.
Please help me to solve this... billions of thanks!!!

 

[JKatarn]

oh, and one more thing...
it is being detected as registry...
3 signatures...
HDTBar

 

[Anonymous Bob]

let me tell you my situation.
Several days before i was being infected by many spywares
(about 10)
i removed it all with my Microsoft anti-spyware (BETA)
program.
but after restarting my computer, my anti spyware didnt
start the scheduled scan that night, EVERY NIGHT.
every time when i start up my anti-spyware, i have to
setup all the settings again.
And when i scan my computer for spyware, theres always
one that left in my computer, HDTBar.
I think i had removed it for almost 20 times already, but
10 mins later it will be back again.
I tried to delete the registry, and the temporary files (
I found a HDTBar thing in there...)
but it still cant be defeated.
Please help me to solve this... billions of thanks!!!

It appears there are several registry entries to remove.
http://sarc.com/avcenter/venc/data/pf/adware.iebar.html

Doesn't your anti-virus program detect this?

Bob Vanderveen

 

[JKatarn]

It can detect that BDTBar.
From registries.
but after it removed it, acutally the Bar will be back in
couple minutes

 

[Alan]

If you are running XP, go to c:\windows\prefetch and
shred any files there whose filenames contain BDTBar and
any other infections detected by MSAS. This folder
contains code that allows programs to start-up quicker.
The unfortunate thinh is that many writers of malicious
programs have become wise to its existance and are
placing code there that's linked to another application,
ususally IE in the case of spyware/malware. When the
application is launched, all code linked to it is
executed. This results in a system getting re-infected,
in your case about ten minutes. You might have to reboot
into Safe Mode (F8 before Winodws screen during
boot/reboot). If you need a file shredder, you can
download a FREE one from download.com.

Just for fun, before removing the files there, rescan the
system and remove anything found. Then launch IE, and
then close IE. Now rescan the system. You'll probably
see that the system has become "re-infected."

Alan