XXXToolbar Threat not really removed

[Marc Jacobi]

Hi,

Browser object XXXToolbar is regocnized as a threat and
AntiSpy reports it is removed. But every time I start my
system I get the same threat-warning over and over again.
Somehow the XXXToolbar seems to be reinstalling itself...

Is there some way I can see what files are involveld? Then
maybe I can remove (or rename) them manually.

Thanx,
Marc Jacobi
Netherlands

 

[Bill Sanderson]

The boring method would be to restart in safe mode, and run two full scans
(or until a single scan comes through clean)

Safe mode prevents the startup of third-party processes which may be
interfering with the successful removal.

You can also dig through all the locations shown in the Tools, Advanced
tools, system explorers, and see what you can find there that doesn't look
quite right to you--is marked as unknown, perhaps, and doesn't live in a
folder associated with a known good application.

If you find some things, look at their particulars using the advanced file
analyzer. If it remains suspicious, consider analyzing the file via
viruscan.jotti.org or virustotal. A clean bill of health from these sites
is NOT conclusive, but if one or more vendors list it as a virus, trojan, or
spyware, you know that removal is appropriate.

 

[RichardF]

Marc,

You are in luck. I happen to know the person who is
responsible for the XXX Toolbar.

If you go to http://www.ysbweb.com/ and download (and run)
the uninstall exe - it will remove all of their software

Richard

 

[Spider]

It would be a very bad idea to follow the link Richard posted and use that
uninstall. Do you really want to trust slime to remove slime?

--


Spider
http://web.tampabay.rr.com/spider1
http://spider1.blogspot.com/

 

[Bill Sanderson]

I downloaded the ist_remove.exe file, which didn't require accepting any
ActiveX controls.

I scanned it at both Virustotal and Jotti.org, and none of the scanners
involved listed it as a threat, although Jotti.org noted that it is packed
with UPX which can be a suspicious circumstance.

I'd be happy to pass the file along to anyone equipped to really analyze it.
I could unpack it, but I'd know very little about what to do with it after
that step.