MS Anti Spyware and ISTbar infection...

[Steve Thompson]

Hello all,

Windows XP Pro
Kerio Personal Firewall 4.1.2

I installed the latest MS Anti Spyware and with the latest updates and ran
it under the Administrator account. It detected a several malware, one of
which was the ISTbar infection.I removed all of them successfully and I even
checked it with SpyHunter 2.0. But, since I normally run under a User
account (for safety), whenever I login as a regular user I get prompted that
IST.ISTBar.ContentMatchContral is trying to install itself into the browser.
This happens every time I login under the regular User account.

Any comments and suggestions would be welcome.

Thanks,

Steve

 

[Andre Da Costa]

Manually remove:

http://www.doxdesk.com/parasite/ISTbar.html

Or, use Ad-aware (or) SpyBot Search & Destroy.

Ad-aware here:

http://www.lavasoft.de/ms/index.htm

SpyBot here:

http://www.safer-networking.org/microsoft.en.html
by Ron Chamberlin - how possibly remove spyware and unwanted browser helper
objects in Windows, Internet Explorer with Microsoft AntiSpyware.

Boot into Safe Mode (F8) at Start Up;

Empty your temporary files AND your Temporary Internet Files C:\Documents

and Settings\Username\Local Settings\Temporary Internet Files folder ;

Run the scan while in safe mode;

If you are running SP2, open IE--->Tools--->Manage Add-ons, and uncheck any

BHO's that you don't recognize.

 

[Spyware Hater]

Boot into safe mode and log in as that user, then use those tools to try and
find it.

 

[Steve Thompson]

Manually remove:

http://www.doxdesk.com/parasite/ISTbar.html

Or, use Ad-aware (or) SpyBot Search & Destroy.

Ad-aware here:

http://www.lavasoft.de/ms/index.htm

SpyBot here:

http://www.safer-networking.org/microsoft.en.html
by Ron Chamberlin - how possibly remove spyware and unwanted browser
helper objects in Windows, Internet Explorer with Microsoft AntiSpyware.

Boot into Safe Mode (F8) at Start Up;

Empty your temporary files AND your Temporary Internet Files C:\Documents

and Settings\Username\Local Settings\Temporary Internet Files folder ;

Run the scan while in safe mode;

If you are running SP2, open IE--->Tools--->Manage Add-ons, and uncheck
any

BHO's that you don't recognize.

--

Andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

Thank you Andre,

I have done evertying tht you suggested but it is nowhere to be found. MS
Antispyware irradicated eerything. The warning from MS Antispyware doesn't
show anything when I login as administrator. It only gives me this message
when I log in as a regular user. Any more suggestions?

Thanks,

Steve

 

[Steve Thompson]

-----Original Message-----
Boot into safe mode and log in as that user, then use those tools to try and
find it.

If I reboot in Safe Mode, the only user I can login as is
the Administrator. My regular user account is not
displayed. Any other suggestions?

Steve

 

[Spyware Hater]

Are you logging into a domain normally, and then safe mode without
networking?

If so, try including "with networking"... if not, try adding the "normal"
user to the local administrators group temporarily, and see if you can login
with that account in safe mode.

A

 

[Andre Da Costa]

Remember to do deep scans in safe mode, that means, click on Scan Options
and selection "Full System Scan".

 

[Steve Thompson]

Remember to do deep scans in safe mode, that means, click on Scan Options
and selection "Full System Scan".

I have done all of your suggestions to no avail.

Toataly, lost,

Steve