IronInstall F/Ps

[mikey]

IronInstall.Toolbar.Amazon: [SBI $3146A941] Root class (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AlxTB2.ToolBarProxy

IronInstall.Toolbar.Amazon: [SBI $3146A941] Root class (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AlxTB2.ToolBarProxy.1

IronInstall.Toolbar.Amazon: [SBI $3146A941] Root class (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AlxTB2.ToolBarProxy.1

IronInstall.Toolbar.Amazon: [SBI $3146A941] Root class (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AlxTB2.ToolBarProxy

IronInstall.Toolbar.Amazon: [SBI $384F4A6A] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{0923E315-2D8B-48CE-A37C-AE9A42F9711C}

IronInstall.Toolbar.Amazon: [SBI $384F4A6A] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{0923E315-2D8B-48CE-A37C-AE9A42F9711C}

IronInstall.Toolbar.Amazon: [SBI $0F322758] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{1A1BBE49-C6F1-40EA-9D2F-262F0AF6DDE3}

IronInstall.Toolbar.Amazon: [SBI $0F322758] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{1A1BBE49-C6F1-40EA-9D2F-262F0AF6DDE3}

IronInstall.Toolbar.Amazon: [SBI $B4B906BF] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{2022154E-7E3E-4809-871E-1B45A6FC7058}

IronInstall.Toolbar.Amazon: [SBI $B4B906BF] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{2022154E-7E3E-4809-871E-1B45A6FC7058}

IronInstall.Toolbar.Amazon: [SBI $1CE79BF6] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{292ECB89-350E-45D2-816F-52C15305B144}

IronInstall.Toolbar.Amazon: [SBI $1CE79BF6] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{292ECB89-350E-45D2-816F-52C15305B144}

IronInstall.Toolbar.Amazon: [SBI $DEC64730] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{36CC2180-B6BF-4951-9578-6B0C40044AAA}

IronInstall.Toolbar.Amazon: [SBI $DEC64730] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{36CC2180-B6BF-4951-9578-6B0C40044AAA}

IronInstall.Toolbar.Amazon: [SBI $38FD0806] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{44A36944-22C6-4A08-BC7C-161F3E540DBF}

IronInstall.Toolbar.Amazon: [SBI $38FD0806] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{44A36944-22C6-4A08-BC7C-161F3E540DBF}

IronInstall.Toolbar.Amazon: [SBI $02C28952] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{6247DD2C-8CF9-4041-A235-93691D71B8B4}

IronInstall.Toolbar.Amazon: [SBI $02C28952] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{6247DD2C-8CF9-4041-A235-93691D71B8B4}

IronInstall.Toolbar.Amazon: [SBI $590DCD79] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{835BED79-DF7E-4096-B355-ED43FA2EA87B}

IronInstall.Toolbar.Amazon: [SBI $590DCD79] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{835BED79-DF7E-4096-B355-ED43FA2EA87B}

IronInstall.Toolbar.Amazon: [SBI $195CCE1D] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{8E863BD6-50DE-47D0-A6F1-3C1F6DB72451}

IronInstall.Toolbar.Amazon: [SBI $195CCE1D] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{8E863BD6-50DE-47D0-A6F1-3C1F6DB72451}

IronInstall.Toolbar.Amazon: [SBI $1359A61E] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{9DD36F1E-5111-41C5-ADED-A2A11A2FF3E4}

IronInstall.Toolbar.Amazon: [SBI $1359A61E] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{9DD36F1E-5111-41C5-ADED-A2A11A2FF3E4}

IronInstall.Toolbar.Amazon: [SBI $CFEBA5AF] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{A2FB8217-E320-434E-BA79-513E357AD54F}

IronInstall.Toolbar.Amazon: [SBI $CFEBA5AF] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{A2FB8217-E320-434E-BA79-513E357AD54F}

IronInstall.Toolbar.Amazon: [SBI $A7A01E60] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{A9CEBBF4-9129-479A-9231-E833ED3D3A8F}

IronInstall.Toolbar.Amazon: [SBI $A7A01E60] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{A9CEBBF4-9129-479A-9231-E833ED3D3A8F}

IronInstall.Toolbar.Amazon: [SBI $06E274D6] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{AFD4D1F9-167C-4884-95AE-B5A9797B0D16}

IronInstall.Toolbar.Amazon: [SBI $06E274D6] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{AFD4D1F9-167C-4884-95AE-B5A9797B0D16}

IronInstall.Toolbar.Amazon: [SBI $4F91D613] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{C47788B1-9604-4D7A-A684-F4D450F2D7D2}

IronInstall.Toolbar.Amazon: [SBI $4F91D613] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{C47788B1-9604-4D7A-A684-F4D450F2D7D2}

IronInstall.Toolbar.Amazon: [SBI $B50F966C] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{CA3B41D0-D4C1-4808-B248-75DA27238828}

IronInstall.Toolbar.Amazon: [SBI $B50F966C] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{CA3B41D0-D4C1-4808-B248-75DA27238828}

IronInstall.Toolbar.Amazon: [SBI $778FFAF2] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{D4A2FF6C-087F-4D40-8DFE-92AAD484BFB8}

IronInstall.Toolbar.Amazon: [SBI $778FFAF2] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{D4A2FF6C-087F-4D40-8DFE-92AAD484BFB8}

IronInstall.Toolbar.Amazon: [SBI $CA0FD7EB] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{D88B9D5C-A9CF-4C69-906D-1CCA5D85A2EF}

IronInstall.Toolbar.Amazon: [SBI $CA0FD7EB] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{D88B9D5C-A9CF-4C69-906D-1CCA5D85A2EF}

IronInstall.Toolbar.Amazon: [SBI $CA9389AB] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{F83AF01C-AA2F-469F-8BE7-D178FB15FD07}

IronInstall.Toolbar.Amazon: [SBI $CA9389AB] Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{F83AF01C-AA2F-469F-8BE7-D178FB15FD07}

 

[micha]

Thank you for reporting this false positive. It will be fixed with the next detection update.

 

[micha]

Sorry, we have retested this issue. This is not a false positive!
IronInstall.Toolbar.Amazon is a version of the Amazon Toolbar installed by IronInstall. The EULA and privacy policy cannot be read correctly since the IronInstaller stays on top of the browser window showing these items. If the toolbar installation is started without IronInstall, installation fails but system information are transmitted to a third party anyway. The IronInstall.Toolbar.Amazon differs from the original Amazon Toolbar available at the Amazon websites. There is also no uninstall entry in the Windows control panel.

 

[aasalem]

IronInstall: AlxTB2.ToolBarProxy

Does not look false positive to me also. Although, In April 2014 seems to be very late for a permanent fix at TCP\IP or application level.
It could be the free version of this antivirus! version 2.2.18.0 update: 2.2.18.91

Any Help!

-------------------------------------------------------------/
IronInstall.Toolbar.Amazon: [SBI $3146A941] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AlxTB2.ToolBarProxy

IronInstall.Toolbar.Amazon: [SBI $3146A941] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AlxTB2.ToolBarProxy.1

IronInstall.Toolbar.Amazon: [SBI $3146A941] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AlxTB2.ToolBarProxy.1

IronInstall.Toolbar.Amazon: [SBI $3146A941] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AlxTB2.ToolBarProxy
------------------------------------------------------------------------------------------/

It show fixed when selecting the Fix button then it comes back after few browsing sessions.

 

[tashi]

Hello aasalem,

For someone to take a look at the system please start a topic in the Malware Removal Forum and a volunteer analyst will advise when available.

First see that forum's FAQ which also includes instructions in post #2 on how to provide DDS and aswMBR logs, which are used in the preliminary analysis.
http://forums.spybot.info/showthread.php?t=288

Best regards.

Edit
http://forums.spybot.info/showthread.php?70480-Regarding-Tool-Bar-Proxy&p=452379#post452379