Istbar help please

[John Dean]

AVG free has identified what it calls Trojan Horse Downloader Istbar.aq
as an "infected, embedded object". It's in my TIF as
ysb_1002838[1].cab but AVG cannot heal or send to the vault
From Googling round, it seems that when Istbar infects a system, it
usually hijacks the IE toolbar in recognisable ways but this has not
happened. So is my system infected yet, or is the Trojan just lying
dormant?
More important, how do I get rid of it?
Thanks

 

[David H. Lipman]

From: "John Dean" <[email protected]>

| AVG free has identified what it calls Trojan Horse Downloader Istbar.aq
| as an "infected, embedded object". It's in my TIF as
| ysb_1002838[1].cab but AVG cannot heal or send to the vault
| From Googling round, it seems that when Istbar infects a system, it
| usually hijacks the IE toolbar in recognisable ways but this has not
| happened. So is my system infected yet, or is the Trojan just lying
| dormant?
| More important, how do I get rid of it?
| Thanks
|

Dump the contents of your IE cache -
Start --> settings --> control panel --> Internet options --> delete files

Then rescan the system.

 

[John Dean]

AVG free has identified what it calls Trojan Horse Downloader
Istbar.aq as an "infected, embedded object". It's in my TIF as
ysb_1002838[1].cab but AVG cannot heal or send to the vault
From Googling round, it seems that when Istbar infects a system, it
usually hijacks the IE toolbar in recognisable ways but this has not
happened. So is my system infected yet, or is the Trojan just lying
dormant?
More important, how do I get rid of it?
Thanks

Dump the contents of your IE cache -
Start --> settings --> control panel --> Internet options --> delete
files

Then rescan the system.

That did it. Excellent. Thanks.

 

[David H. Lipman]

|
| That did it. Excellent. Thanks.

Excellent !

Thanx for updating the thread.

 

[John Dean]

Excellent !

Thanx for updating the thread.

Now the thought crosses my mind - why didn't AVG pick this up on the way
in, since it was able to detect its presence?

 

[David H. Lipman]

From: "John Dean" <[email protected]>


|
| Now the thought crosses my mind - why didn't AVG pick this up on the way
| in, since it was able to detect its presence?

The problem is it an archive file. You have scanning within an archive file enabled and
thus it found this tidbit. However, the AV software can extract the file from the archive
file and scan it but it can't remove the infected file and repack the archive file.
Therefore it is not removed and it would take a manual deletion. The same goes for a Java
script Trojan found to be in a .CLASS file in a Java Jar (ZIP type file).

So it would take a manual deletion of the archive file. Since your .CAB file was in the
Internet Explorer Browser Cache (aka; TIF) it is best to just dump the cache. In my above
example of a .CKLASS file in a Java Jar, one would clear the Java cache.

Now why didn't AVG initially find the .CAB file on the PC when it was downloaded ? It could
be there wasn't a signature then, you didn't have scan within archives enabled then, etc...