<html>
<body>
I have had good luck with BHODeamon (Browser Help Objects)... it watches
for things being added to IE and can catch things that SpyBot and Adware
done seem to be able to catch. It will give you a report and show
that you have things like Acrobat plugins and other objects, but does a
good job at letting you know the benign ones from the ones you should be
concerned about.<br>
<br>
<font size=2><a href="http://www.definitivesolutions.com/" eudora="autourl">www.definitivesolutions.com</a></font>
site is down, but the redirect will take you to PC Magazine for the
download<br><br>
<br>
At 09:59 AM 9/2/2004 -0400, Kerem B Limon wrote:<br>
<blockquote type=cite class=cite cite>Well, specifically you might want
to have the so-called "TeaTimer"<br>
auto-monitoring tool that comes with Spybot turned on. This will watch
for<br>
impending changes to the registry and ask you to accept or deny, in
addition to<br>
a confirmation to install that the 3rd party tool in question may or may
not<br>
present (and a lot do not, auto-installing on improperly configured
or<br>
unpatched versions of IE). So, it wasn't the MSN toolbar, after all,
then...<br><br>
Kerem<br><br>
<br>
Quoting Bob Kaynor <bkaynor@MIT.EDU>:<br><br>
> That did it! Thanks, Dave, I hadn't thought it look in
Add/Remove <br>
> Programs. The two programs I removed were "WebIQ"
and "WebSearch"; Spybot <br>
> now gives a clean bill of health. Per Kerem's earlier note
about <br>
> disallowing changes, I now recall being asked about installing the
search <br>
> toolbar. I allowed it because I wanted to test it. I
hadn't bargained on <br>
> all the associated "features"...<br>
> <br>
> Thanks again.<br>
> <br>
> -RKK<br>
> <br>
> At 09:02 AM 9/2/2004 -0400, you wrote:<br>
> >Hi,<br>
> ><br>
> >Check for entries in 'Add or Remove Programs', and remove any
suspicious<br>
> >ones. I had this problem with spyware tool bars.
See<br>
> ><br>
> >
<a href="http://www.pchell.com/support/huntbar.shtml" eudora="autourl">http://www.pchell.com/support/huntbar.shtml</a><br>
> ><br>
>
>
Dave<br>
> ><br>
> >On Thu, 2 Sep 2004, Bob Kaynor wrote:<br>
> ><br>
> > > Kerem: When I rechecked Spybot the two HuntBar
entries (which I had<br>
> > > "fixed" previously) had returned. I
elected to fix the two HuntBar <br>
> > entries<br>
> > > (again) along with the three IE registry changes.
Spybot reported that <br>
> > the<br>
> > > fixes had been made, but when scanned again (after
rebooting), all five <br>
> > had<br>
> > > returned. This is a little distressing, particularly
since the HuntBar<br>
> > > bots capture forms entry re- purchases, etc (according to
the Spybot<br>
> info;<br>
> > > there's nothing for the IE entries).<br>
> > ><br>
> > > I don't have time now to explore the registry changes or
possible fixes<br>
> > > further, but any info would be greatly appreciated.
The persistence of <br>
> > the<br>
> > > HuntBar stuff make this more than just an annoyance, as
far as I'm<br>
> > > concerned. Are those likely related to the IE
registry changes? I've<br>
> > > appended a .PDF file with the Spybot report from my
machine, if it's of <br>
> > any<br>
> > > help.<br>
> > ><br>
> > > Thanks.<br>
> > ><br>
> > > -RKK<br>
> > ><br>
> > > At 06:33 PM 9/1/2004 -0400, Kerem B Limon wrote:<br>
> > > >Hmm...Spybotn tells me when I enable the MSN toolbar,
a registry key <br>
> > is added,<br>
> > > >which is hard to read at the moment. I presume it may
be that this is<br>
> the<br>
> > > >persistent part (I deny the change). You could try the
same tool.<br>
> > > ><br>
> > > >Kerem<br>
> > > ><br>
> > > ><br>
> <br>
> <br>
> _______________________________________________<br>
> winpartners mailing list<br>
> winpartners@mit.edu<br>
>
<a href="http://mailman.mit.edu/mailman/listinfo/winpartners" eudora="autourl">http://mailman.mit.edu/mailman/listinfo/winpartners</a><br>
> <br><br>
<br>
Kerem B. Limon<br>
kerem.limon@mit.edu /e-mail<br><br>
_______________________________________________<br>
winpartners mailing list<br>
winpartners@mit.edu<br>
<a href="http://mailman.mit.edu/mailman/listinfo/winpartners" eudora="autourl">http://mailman.mit.edu/mailman/listinfo/winpartners</a>
</blockquote></body>
<br>
</html>