Microsoft Anti spyware found malware: IBIS Toolbar

[NewBaol]

Subject: Microsoft Anti spyware found malware: IBIS Toolbar

I have XP Home and Microsoft Anti spyware found some malware (IBIS Toolbar) that was removed but on rescans, it shows up again, but now located in the restore points. I believe that I have to turn off System Restore and reboot and then turn restore back on and do a new restore point. Please advise. Thanks.

 

[pcbutts1]

Yes, that is correct Turn off system restore then Download, install, update
and run all of the following.

Ad-Aware
http://www.pcbutts1.com/downloads/aawsepersonal.exe

Spybot search and destroy
http://www.pcbutts1.com/downloads/spybotsd14.exe

Ewido Security Suite Trial version
http://www.pcbutts1.com/downloads/ewidosetup.exe


If none of the above fixes the issue then download Hijack this, run it, save
a copy of the log file and cut and paste it back here to this group so that
I can analyze it. Ignore anyone especially the troll Leythos, who will tag
along a nonsense post to this message, who tells you to post it elsewhere. I
need to see it not them.


HijackThis
http://www.pcbutts1.com/downloads/HijackThis.zip


The authors of the above programs, with the exception of Microsoft has given
the owner of pcbutts1.com express written permission to redistribute their
software.

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com

 

[Leythos]

Yes, that is correct Turn off system restore then Download, install, update
and run all of the following.

Only download software you can validate as uncompromised - in the case
of non-vendor site you have no guarantee that the files are unmodified
or uncompromised. Anyone providing a link to a non-vendors site with a
direct download should not be trusted, the vendors sites are the safest
place to download their application.

Always remember - only download files from Trusted Sites.

These sites are for downloading Anti-Spyware tools, in order that I
would use them myself:

AdAwareSE can be found here:
http://www.lavasoft.de/support/download/

SpyBot Search and Destroy can be found here:
http://www.safer-networking.org/en/download/index.html

Ewido Security Suite Trial can be found here:
http://www.ewido.net/en/download/

CrapCleaner can be found at the vendors site here:
http://www.ccleaner.com/ccdownload.asp

CleanUp can be found at the vendors site here:
http://www.stevengould.org/software/cleanup/download.html
or from another reputable source:
http://www.tucows.com/get/405276_152071

The following are two links to Antivirus software in order that I would
use them:

You can also download Symantec Trial version of their Antivirus software
from here:
http://www.symantec.com/downloads/

Download AVG Personal Free edition from here:
http://free.grisoft.com/freeweb.php/doc/2/

These are the actual vendors sites, not some unknown or authorized no-
name site. They also don't artificially increase the hits for sites that
get paid for the amount of traffic they can generate like one poster has
admitted to in this group.

 

[Dick Mahar]

Subject: Microsoft Anti spyware found malware: IBIS Toolbar

I have XP Home and Microsoft Anti spyware found some malware (IBIS Toolbar)

that was removed but on rescans, it shows up again, but now located in the
restore points. I believe that I have to turn off System Restore and reboot and
then turn restore back on and do a new restore point. Please advise. Thanks.

Any restore points that were created after the removal of the malware should

not contain the malware. If it should be necessary to restore a point that
contains it, simply run the malware removal tool after the restore. That should
work. Dick M.

 

[Z]

Subject: Microsoft Anti spyware found malware: IBIS Toolbar

I have XP Home and Microsoft Anti spyware found some malware (IBIS
Toolbar) that was removed but on rescans, it shows up again, but now
located in the restore points. I believe that I have to turn off
System Restore and reboot and then turn restore back on and do a new
restore point. Please advise. Thanks.

re: "shows upon rescans"

Immediate rescans?

Immediate rescans after reboot?

Or rescans some days later?

 

[NewBaol]

Subject: Re: Microsoft Anti spyware found malware: IBIS Toolbar

It come up on a new scan after reboot, and every night when MS Antispyware runs automatically at 3 AM. The IBIS Toolbar ihas been removed from the computer but it's still is the Windows restore files.

 

[Guest]

Hi all...

A collegue and I got notification this morning from MSAS that I have a "High
Threat Level" with the "IBIS Toolbar (Adware)". The problem file is
"C:\Windows\unvise32qt.exe".

I believe that this is a False Positive. I ran the usual gambit of tools
and I come up clean. I checked the IE 6.0 "Manage Add-Ons" and IBIS Toolbar
is not listed.

I never got this hit until the new defs dated 09/10/2005 (Spyware Definition
Version: 5753 (9/10/2005 8:26:51 AM)

I also got this same IBIS Toolbar Notification on my home PC. Again I ran
the usual gambit of "Spyware tools" and came up clean.

I am a "HijackThis" advisor on a few forums and know how to analyze a
HijackThis log. Both my home PC and my work PC logs come up clean.

Could this be a False Positive???

Thanks,

Kent

 

[Guest]

I answered my own question of the FP. A couple threads down, the
"unvise32qt.exe may not be spyware" thread mention that it is indeed a FP.

Thanks,

 

[Z]

It come up on a new scan after reboot, and every night when MS
Antispyware runs automatically at 3 AM. The IBIS Toolbar ihas been
removed from the computer but it's still is the Windows restore
files.

If it's only showing up in the restore files, you can either delete the
files manually (delete only the infected ones) or (this will wipe your
entire restore tree) disable restore, reboot, enable restore and reboot
again.

 

[PA Bear]

If it identifies C:\Windows\unvise32qt.exe as IBIS Toolbar, it's a
False/Positive. UNVISE32QT.EXE is a legit QuickTime uninstaller.

Microsoft has established separate newsgroups for the Microsoft Windows
AntiSpyware Beta. Please post your query to:

http://communities.microsoft.com/newsgroups/default.asp?ICP=spyware&sLCID=us

 

[jonah]

If it identifies C:\Windows\unvise32qt.exe as IBIS Toolbar, it's a
False/Positive. UNVISE32QT.EXE is a legit QuickTime uninstaller.

snip

UNVISE32QT.EXE is a legit QuickTime uninstaller

Ha! so its actually a spyware uninstaller then?



Jonah

 

[NotMe]

QuickTime is not spyware.
It is a legitimate player for QuickTime video files.
http://www.apple.com/quicktime/win.html