ISTBar undetected

[Guest]

I was surprised to see a menu bar called "Protection Bar" in my IE 7 browser
with buttons to options like Security Settings and Spyware protection, etc...
giong to Tools -> Manage Add-ons, i disabled the so-called Security "add-on".
Anyway moving on I have Windows Defender RTW up and running but being the
extra careful web citizen I have Spybot S&D and Adaware as well. So I run
Spybot and Adaware and they both detect ISTBar. I order them to remove the
adware. I also run an online scan using Trend's free malware scanner and it
sees ISTBar still within the registry, I have it removed.

Now why pray tell didn't WD see it? It's the spyware program that's supposed
to be scanning realtime. Anyone else run into ISTBar?

 

[Dave M]

Tony Hughes ran into it back in July:

http://www.geekzone.co.nz/tonyhughes/779

Basically no single AV product catches everything, but this one is pretty
well known for a miss. I'd recommend you submit this lack of detection
info to Microsoft if you still have access to any parts of the infection...
maybe they'll update the detection defs, since Windows Defender has now
been released as a product:

http://www.microsoft.com/athome/security/spyware/software/support/reportspyware.mspx

 

[Guest]

Now why pray tell didn't WD see it? It's the spyware program that's supposed
to be scanning realtime. Anyone else run into ISTBar?

Have you try to execute the ISTBar setup executable to see if WD real-time
protection will block it? Many spyware are detected in this way and not with
file scanning

 

[Guest]

I wouldn't be recommending that someone run a suspect file of any sort,
particularly one that has been labeled (by some) as a Trojan!

The primary reason that threats perpetuate themselves is that they take
advantage of the method in which Windows rebuilds the registry for its own
self-preservation. Until you remove *ALL* vestiges of a program -- *ANY*
program -- it is likely to be restored promptly on the next boot. This is
why I always advise people to turn of System Restore when making any sort of
repairs, and turning it back on after they have rebooted their system.

I recommend spending some "quality time" with HijackThis!, followed by a
thorough analysis of the HJT! log to assure complete removal. As always,
links in my sig.