Microsoft Anti spyware found malware: IBIS Toolbar

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

Subject: Microsoft Anti spyware found malware: IBIS Toolbar

I have XP Home and Microsoft Anti spyware found some malware (IBIS Toolbar) that was removed but on rescans, it shows up again, but now located in the restore points. I believe that I have to turn off System Restore and reboot and then turn restore back on and do a new restore point. Please advise. Thanks.

 

[Kent]

Archived from groups: microsoft.public.windowsxp.general (More info?)

Hi all...

A collegue and I got notification this morning from MSAS that I have a "High
Threat Level" with the "IBIS Toolbar (Adware)". The problem file is
"C:\Windows\unvise32qt.exe".

I believe that this is a False Positive. I ran the usual gambit of tools
and I come up clean. I checked the IE 6.0 "Manage Add-Ons" and IBIS Toolbar
is not listed.

I never got this hit until the new defs dated 09/10/2005 (Spyware Definition
Version: 5753 (9/10/2005 8:26:51 AM)

I also got this same IBIS Toolbar Notification on my home PC. Again I ran
the usual gambit of "Spyware tools" and came up clean.

I am a "HijackThis" advisor on a few forums and know how to analyze a
HijackThis log. Both my home PC and my work PC logs come up clean.

Could this be a False Positive???

Thanks,

Kent

"NewBaol" wrote:

> Subject: Microsoft Anti spyware found malware: IBIS Toolbar
>
> I have XP Home and Microsoft Anti spyware found some malware (IBIS Toolbar) that was removed but on rescans, it shows up again, but now located in the restore points. I believe that I have to turn off System Restore and reboot and then turn restore back on and do a new restore point. Please advise. Thanks.
>
>
>

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

Yes, that is correct Turn off system restore then Download, install, update
and run all of the following.

Ad-Aware
http://www.pcbutts1.com/downloads/aawsepersonal.exe

Spybot search and destroy
http://www.pcbutts1.com/downloads/spybotsd14.exe

Ewido Security Suite Trial version
http://www.pcbutts1.com/downloads/ewidosetup.exe


If none of the above fixes the issue then download Hijack this, run it, save
a copy of the log file and cut and paste it back here to this group so that
I can analyze it. Ignore anyone especially the troll Leythos, who will tag
along a nonsense post to this message, who tells you to post it elsewhere. I
need to see it not them.


HijackThis
http://www.pcbutts1.com/downloads/HijackThis.zip


The authors of the above programs, with the exception of Microsoft has given
the owner of pcbutts1.com express written permission to redistribute their
software.

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com



"NewBaol" <NewBaol@SupportX.com> wrote in message
news:37869C372162@123456789.spx.com...
> Subject: Microsoft Anti spyware found malware: IBIS Toolbar
>
> I have XP Home and Microsoft Anti spyware found some malware (IBIS
> Toolbar) that was removed but on rescans, it shows up again, but now
> located in the restore points. I believe that I have to turn off System
> Restore and reboot and then turn restore back on and do a new restore
> point. Please advise. Thanks.
>
>

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

"NewBaol" <NewBaol@SupportX.com> wrote in message
news:37869C372162@123456789.spx.com...
> Subject: Microsoft Anti spyware found malware: IBIS Toolbar
>
> I have XP Home and Microsoft Anti spyware found some malware (IBIS Toolbar)
that was removed but on rescans, it shows up again, but now located in the
restore points. I believe that I have to turn off System Restore and reboot and
then turn restore back on and do a new restore point. Please advise. Thanks.
>
> Any restore points that were created after the removal of the malware should
not contain the malware. If it should be necessary to restore a point that
contains it, simply run the malware removal tool after the restore. That should
work. Dick M.

 

[z]

Archived from groups: microsoft.public.windowsxp.general (More info?)

NewBaol wrote:
> Subject: Microsoft Anti spyware found malware: IBIS Toolbar
>
> I have XP Home and Microsoft Anti spyware found some malware (IBIS
> Toolbar) that was removed but on rescans, it shows up again, but now
> located in the restore points. I believe that I have to turn off
> System Restore and reboot and then turn restore back on and do a new
> restore point. Please advise. Thanks.

re: "shows upon rescans"

Immediate rescans?

Immediate rescans after reboot?

Or rescans some days later?

 

[Kent]

Archived from groups: microsoft.public.windowsxp.general (More info?)

I answered my own question of the FP. A couple threads down, the
"unvise32qt.exe may not be spyware" thread mention that it is indeed a FP.

Thanks,

"Kent" wrote:

> Hi all...
>
> A collegue and I got notification this morning from MSAS that I have a "High
> Threat Level" with the "IBIS Toolbar (Adware)". The problem file is
> "C:\Windows\unvise32qt.exe".
>
> I believe that this is a False Positive. I ran the usual gambit of tools
> and I come up clean. I checked the IE 6.0 "Manage Add-Ons" and IBIS Toolbar
> is not listed.
>
> I never got this hit until the new defs dated 09/10/2005 (Spyware Definition
> Version: 5753 (9/10/2005 8:26:51 AM)
>
> I also got this same IBIS Toolbar Notification on my home PC. Again I ran
> the usual gambit of "Spyware tools" and came up clean.
>
> I am a "HijackThis" advisor on a few forums and know how to analyze a
> HijackThis log. Both my home PC and my work PC logs come up clean.
>
> Could this be a False Positive???
>
> Thanks,
>
> Kent
>
> "NewBaol" wrote:
>
> > Subject: Microsoft Anti spyware found malware: IBIS Toolbar
> >
> > I have XP Home and Microsoft Anti spyware found some malware (IBIS Toolbar) that was removed but on rescans, it shows up again, but now located in the restore points. I believe that I have to turn off System Restore and reboot and then turn restore back on and do a new restore point. Please advise. Thanks.
> >
> >
> >

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

If it identifies C:\Windows\unvise32qt.exe as IBIS Toolbar, it's a
False/Positive. UNVISE32QT.EXE is a legit QuickTime uninstaller.

Microsoft has established separate newsgroups for the Microsoft Windows
AntiSpyware Beta. Please post your query to:

http://communities.microsoft.com/newsgroups/default.asp?ICP=spyware&sLCID=us

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Shell/User, Security), AH-VSOP


NewBaol wrote:
> Subject: Microsoft Anti spyware found malware: IBIS Toolbar
>
> I have XP Home and Microsoft Anti spyware found some malware (IBIS
> Toolbar) that was removed but on rescans, it shows up again, but now
> located in the restore points. I believe that I have to turn off System
> Restore and reboot and then turn restore back on and do a new restore
> point. Please advise. Thanks.

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

Subject: Re: Microsoft Anti spyware found malware: IBIS Toolbar

It come up on a new scan after reboot, and every night when MS Antispyware runs automatically at 3 AM. The IBIS Toolbar ihas been removed from the computer but it's still is the Windows restore files.

 

[z]

Archived from groups: microsoft.public.windowsxp.general (More info?)

NewBaol wrote:
> It come up on a new scan after reboot, and every night when MS
> Antispyware runs automatically at 3 AM. The IBIS Toolbar ihas been
> removed from the computer but it's still is the Windows restore
> files.

If it's only showing up in the restore files, you can either delete the
files manually (delete only the infected ones) or (this will wipe your
entire restore tree) disable restore, reboot, enable restore and reboot
again.

 

[jonah]

Archived from groups: microsoft.public.windowsxp.general (More info?)

On Mon, 12 Sep 2005 18:14:54 -0400, "PA Bear" <PABearMVP@gmail.com>
wrote:

>If it identifies C:\Windows\unvise32qt.exe as IBIS Toolbar, it's a
>False/Positive. UNVISE32QT.EXE is a legit QuickTime uninstaller.
>
snip

UNVISE32QT.EXE is a legit QuickTime uninstaller

Ha! so its actually a spyware uninstaller then?



Jonah

 

[Guest]

Archived from groups: microsoft.public.windowsxp.general (More info?)

QuickTime is not spyware.
It is a legitimate player for QuickTime video files.
http://www.apple.com/quicktime/win.html
--
A Professional Amateur...If anyone knew it all, none of would be here!
"jonah" <jonah@nowhere.com> wrote in message
news:np3ci1dehbikc1mq5kll7jugk2o8qipjlm@4ax.com...
> On Mon, 12 Sep 2005 18:14:54 -0400, "PA Bear" <PABearMVP@gmail.com>
> wrote:
>
>>If it identifies C:\Windows\unvise32qt.exe as IBIS Toolbar, it's a
>>False/Positive. UNVISE32QT.EXE is a legit QuickTime uninstaller.
>>
> snip
>
> UNVISE32QT.EXE is a legit QuickTime uninstaller
>
> Ha! so its actually a spyware uninstaller then?
>
>
>
> Jonah
>