Logon pop up warning on limited accounts from MSAS

[Guest]

When logging on to a limited account, I get a request
from MSAS for a domain to be added to "Trusted sites".
The domain is different every time and have included
0catch.com, allposters.com, plus severeal more. This
doesn't happen when logging on as Administrator. I've
scanned with NAV, MSAS, AdAware, Spybot and several anti-
trojan programs and they all come up clean. I don't know
if something is hiding under the radar or if this is a
bug.

 

[Andre Da Costa]

1) Submit suspected spyware report in the tools menu of Antispyware
2) Reboot in safe mode and run a deep scan
3) Run antivirus (with current definitions) while you are in safe mode.

Limited account and multiple account scanning is not supported in this beta
1 release of Microsoft Antispyware, should be by beta 2.

 

[Guest]

Okay, I did that and found Mediatickets CDT. When I
rebooted and logged on to my account as administrator, I
received a pop up warning CoolWebSearch was trying to
take over my browser. I blocked that and have had no
problems with CWS since, but I'm still getting warnings
of domains trying to insert into "Trusted sites". I've
ran multiple scans in safe mode and keep
finding "Possible Browser Hijack".

Since MSAS doesn't support multiple accounts, do I have
to scan each account seperately in safe mode?

 

[Bill Sanderson]

I'm not sure what is happening with CWS alerts recently--I am suspecting a
false positive of some sort, but can't be certain.

I've seen folks more experienced at cleaning than I am suggest that scanning
in each user is necessary for some bugs. Additionally, you may need to be
doing that as an administrator.

One way to do this is to elevate each user in turn to administrator, boot in
safe mode, log in as that user, and scan. There's some risk and complexity
to doing this, but it should work.

 

[Guest]

I'm beginning to think MSAS was somehow re-inserting
something it had found before. Since un-installing MSAS,
HJT hasn't found the entries that seemed to be causing
the pop ups. I think I'll wait until a newer version of
MSAS before trying it again.

 

[Bill Sanderson]

Well -I know I was seeing this alert on machines which have never had CWS on
them.