Page 1 of 4 1234 LastLast
Results 1 to 10 of 33

Thread: win32.isbar.450

  1. #1
    srikandi Guest

    Default win32.isbar.450

    My ZA logged a Trojan called Win32.Isbar.450 today, then quarantined and deleted it. Does anybody know anything about this thing, and whether I should be alarmed? Is it really gone from my computer if ZA claims to have deleted it?

    Operating System:Windows XP Home Edition
    Product Name:ZoneAlarm Internet Security Suite

  2. #2
    Join Date
    Dec 2005
    Posts
    9,056

    Default Re: win32.isbar.450

    Rescan once again, preferrablely in the safe mode. If it shows again, it will have better detection and removal in the safe mode. If it does not appear again, then it was cleaned the first time.

    For some second opinion freeware scanners try these>

    http://www.emsisoft.com/en/software/free/

    http://www.superantispyware.com/

    Cheers,

    Oldsod
    Best regards.
    oldsod

  3. #3
    srikandi Guest

    Default Re: win32.isbar.450

    Thanks. I have rescanned several times (not in safe mode) with ZA (as well as with eTrust Pest Patrol, Ad-Aware, Spybot Search & Destroy) and nothing has come up - so I can then assume my computer is ok?

    I've just had bad experiences with thinking the computer's clean when it really wasn't (but that was with Norton).

  4. #4
    Join Date
    Dec 2005
    Posts
    9,056

    Default Re: win32.isbar.450

    JMHO, but I would consider the freeware scanners suggested earlier to be somewhat superior to the ones you are using. It is very possible your PC is clean anyways.

    I checked for details about this trojan, but could not find any information. The only lead to finding out about this trojan would be the actual file and it's location.

    BTW I seldom use any spyware scanners. They have not found anything in the last few years. But every two or three months I do one or two on-demand antispyware scans just for re-assurance.

    Prevention itself is a much better security application than that provided by any security application.

    Cheers,
    Oldsod
    Best regards.
    oldsod

  5. #5
    srikandi Guest

    Default Re: win32.isbar.450

    Exactly, I couldn't find any information either. The file itself tracked back to Nullsoft and an ActiveX application (both of which were deleted by ZoneAlarm).

  6. #6
    srikandi Guest

    Default Re: win32.isbar.450

    well, I followed your advice and downloaded the EMSI Software (a squared). Running that scan did not find anything either. Should I assume I'm in the clear?

  7. #7
    arali Guest

    Default Re: win32.isbar.450

    Zonelabs antivirus/spyware scanning detected today also this Trojan on my computer. I deleted it with the delete option, but as you say, it might still be on the computer.As I have already Zonelabs Antivirus installed on my computer I am concerned to download a second antivirus programm because 2 antivirus programs might crash the system, I heard.
    Is that right? Thanks for help!!

  8. #8
    stroye Guest

    Default Re: win32.isbar.450

    Just had this Trojan flagged up on my latest Anti-spyware scan today. DAT file version 01.200707.2035
    I believe that in my case this is a False Positive. I accepted to quarantine it, only after, to find it only concerns a Nullsoft ActiveX component, and a WinAmp dll file called AmpX.dll, of which quarantining deletes.
    Actually, the Nullsoft software in my case was legitimately installed as part of AOL s RadioNetscape years ago (on 13 August 2004), and hasn t changed since. As I no longer use RadioNetscape, and don t have any other AOL components installed, quarantining or even deleting this, will not cause me any problems.
    You could look at the following
    ZoneAlarm log file under your main Windows folder called... Internet Logs\ZALog.txt having the same date that your Anti-spyware scan flagged this Trojan (Win32.Isbar.450). Then check if you have something similar to me... please see following text below:







    Win32.Isbar.450,Trojan,Manual

    File Name-C:\Program Files\Common Files\Nullsoft\ActiveX\2.0\AmpX.dll

    GUID-{FA3662C3-B8E8-11D6-A667-0010B556D978}

    RegistryKey-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FA3662C 3-B8E8-11D6-A667-0010B556D978}

    RegistryKey-HKEY_LOCAL_MACHINE\Software\Classes\WinAmpX.IWinAm pActiveX

    Directory-C:\Program Files\Common Files\Nullsoft

    RegistryKey-HKEY_LOCAL_MACHINE\SOFTWARE\AOL

    RegistryKey-HKEY_LOCAL_MACHINE\SOFTWARE\AOL\Nullsoft ActiveX Control

    RegistryKey-HKEY_LOCAL_MACHINE\Software\Classes\WinAmpX.IWinAm pActiveX.2
    You may have a similar problem, if so, it
    might put your mind at rest.

  9. #9
    srikandi Guest

    Default Re: win32.isbar.450

    I do indeed. Thank you very much!

  10. #10
    Join Date
    Dec 2005
    Posts
    9,056

    Default Re: win32.isbar.450

    Hi Arali and Stroye

    It seesm that the correct conclusion is indeed the detection is a false positive. You may have to re-install the previous soft or it's plugins if the nullsoft applications does not work properly.

    Do not use a second AV on the PC. It is never adviseable to use two at the same, even if one is for resident and the other is for on-demand. Ir is a very good suggestion to do an online scan- with the resident AntiVirus turned off and also doing the online scan using the Internet Explorer (they all use a "safe" activeX).

    Two suggestions are;

    http://www.bitdefender.com/scan8/ie.html

    http://us.mcafee.com/root/mfs/default.asp?affid=294

    I would suppose your PC to be clean. Almost every AntiVirus vendor has an online scan engine available for free use.

    Cheers,
    Oldsod
    Best regards.
    oldsod

Page 1 of 4 1234 LastLast

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •