Real time protection ineffective

[Jim]

I installed the Microsoft Spyware program last night. I
ran a scan, and it found 81 spyware threats on my
computer!!! It removed the threats, but, every time I
turn my computer on (connected to the internet or not) I
get a big box message that HuntBar is trying to download
itself. I choose the remove option, and have to wait a
couple of minutes for it to finish. If I am on-line, my
browser is closed out and I have to start all over. This
would not be so bad, but this happens every couple of
minutes, making using the internet impossible. Also, why
not make the removal much smaller so we can continue to
do what we were doing. To Microsoft: If you deem a
program to be spyware, add it to a list, and when it
tries to download, don't ask me about, kill it or
whatever it is you can do without getting me involved.

 

[Elaine]

This is beta1 software. If you don't know how to solve the problems any beta
software may create......don't install it.

 

[Joe Tam]

This means that the spyware has not been completely
removed, if it's still trying to install itself. Try
doing the removal from Safe Mode. Also check MSConfig and
see if you can disable the auto-load thing for Huntbar
there. MSAS is doing it's job by continuing to hound you
about this. You need to get that piece of spyware removed
completely, and not just partially.
MSAS should be more clear about it though
good luck

 

[John]

Some software can only be successfully defeated by disabling System Restore
first, then clean then reboot and retest then re-enable System Restore. Not
a good thing if you then want to rollback from a beta install. Always good
to have a bare-metal backup ready on a dvd!

 

[Steve Wechsler [MVP]]

I installed the Microsoft Spyware program last night. I
ran a scan, and it found 81 spyware threats on my
computer!!! It removed the threats, but, every time I
turn my computer on (connected to the internet or not) I
get a big box message that HuntBar is trying to download
itself. I choose the remove option, and have to wait a
couple of minutes for it to finish. If I am on-line, my
browser is closed out and I have to start all over. This
would not be so bad, but this happens every couple of
minutes, making using the internet impossible. Also, why
not make the removal much smaller so we can continue to
do what we were doing. To Microsoft: If you deem a
program to be spyware, add it to a list, and when it
tries to download, don't ask me about, kill it or
whatever it is you can do without getting me involved.

Jim,

Advise you to run a scan in Normal mode first, reboot the system to Safe
Mode, then do another scan. Do the first scan disconnected from the
internet.
It seems as though this malware was embedded on the system prior to
installing MSAS and is attempting to "phone home" every time a removal
attempt is made.
Please let us know if this resolved the issue. Thanks.

Steve Wechsler (akaMowGreen)
MVP Windows Server
AumHa VSOP

 

[Doug]

I really like this new offering from Microsoft. Have been cleaning a system
of viruses and spyware and was about to track down Giant to do what adaware
and spybot couldn't do and bamg, Microsoft gives it to me. Thanks.

I am still fighting on bit either hidden somewhere or a false notification.

"Steve Wechsler [MVP]" wrote,
I am having this same problem. See attached WRI file.

To Microsoft: If _I_ deem a program to be unwanted, allow me to set an
"always remove/block" flag for it and don't bother me again.

Advise you to run a scan in Normal mode first, reboot the system to Safe
Mode, then do another scan. Do the first scan disconnected from the
internet.

I have done this. It always comes up clean, as does Spy Sweeper, AdAware, &
Spybot.
Also running SpywareBlaster and SpywareGuard from JavaCool. System Restore
turned off. Was happening primarily on one profile(Windows XP Home with
three users) but when I removed that profile from Docs and Settings, it
showed up on another profile.

Most of the time I don't see it, and yet...every so often when I log on to
one of the three profiles on this computer I get the red "Huntbar is trying
to install" warning box. There is nothing in MSConfig that is not known,
and nothing in the Startup folder.

It seems as though this malware was embedded on the system prior to
installing MSAS and is attempting to "phone home" every time a removal
attempt is made.

Actually I can never find any proof that it is on my system except the MS
AntiSpy Realtime checker.
The logs are not of much help either as they don't tell me what program is
executing or what is being removed.
Under the real-time protection, "View all events" link, the log states,
"Remove Spyware threat huntbar" and goes on to explain, "the user Tasha(or
whoever) had decided to remove the spyware threat huntbar that has been
detected by real-time protection"

See attached archive of my log.

I can not get to this entry through the application real time protection
events, yet when I archive or delete the application events, the listing for
huntbar is removed too. This keeps me from finding the location of the
offending file/entry.

Please let us know if this resolved the issue. Thanks.

Not yet.

Steve Wechsler (akaMowGreen)
MVP Windows Server
AumHa VSOP

I would love some help on this.

Doug

PS. Thanks Microsoft for providing this to us!

 

[Spider]

You should not post binary files attachments in a non-binary group.