A file named AutoTBar.exe keeps inserting itself into the Startup file
in my Start Menu on XP Pro.  I have deleted it several times but it
always comes back after a week or so.  Is AutoTBar.exe a normal
Windows file or some kind of spyware (I am already running three
spyware programs) and how do I permanently stop it from inserting
itself into my Startup file?

---

Request for Question Clarification by rainbow-ga on 20 Sep 2005 11:12 PDT

Please read the following:
http://www.bleepingcomputer.com/startups/autotbar.exe-439.html

To disable this program at startup, go to Run.

Type msconfig. Click on Startup and uncheck the file.

Please let me know if this helps.

Best regards,
Rainbow

---

Request for Question Clarification by livioflores-ga on 20 Sep 2005 20:10 PDT

Hi!!

If the problems persist after follow the good advices given at
comments and by my fellow researcher rainbow-ga, please do the
folowing:
- Download and install Hijackthis; just download the following file and run it:
http://www.thespykiller.co.uk/files/hijackthis_sfx.exe

- Run Hijackthis.exe (normally installed at C:\Program
Files\HijackThis\) and click on the "Do a system scan and save a
logfile" button. A Notepad window with the log will be displayed.

- WITHOUT FIX ANYTHING (IMPORTANT!!) Copy and paste the text on the
logfile in a request for an answer clarification to make it available
to me.

- I will analyze your log and let you know the necessary steps to fix
your computer in an answer clarification.

For additional references see:
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42

See this section first:
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42#HowToUse

Regards,
livioflores-ga

sounds like you have spyware.  the reason i say this, is cause it
comes back on a weekly basis; after being deleted.

download cccleaner from http://www.ccleaner.com

after installed, go to the "tools" applet on the left (looks like
gears). next, click the "startup" button.  find the file, the AutoTBar
program.  click the "delete entry" button.  now exit the program.

now go download (if you dont already have it) ad-aware by lavasoft. it
can be found at http://www.lavasoftusa.com/support/download/

install it. when done, make sure you update the definition file. (it
will ask you).  when thats done, scan your computer. do this to get
rid of the spyware. then restart your computer.

let me know if it works.

It does seem like you have Spyware.

Your best bet and quickest cleanup option would be to download Spybot
Search and Destroy.

If you go here:
http://www.download.com/Spybot-Search-Destroy/3000-8022_4-10401314.html?tag=lst-0-1

you will see a link to download it. 

Click on that link. It will take you to a page that will include some
tips for installation. The process will basically back up your
registry (to basically make sure you will be alright), scan for
spyware, and remove the spyware for you. Near the end you may be
required to restart in order for SpyBot to finish cleaning out your
spyware. After restarting, you will see it finish its work and you
will be taken back to Windows.

That's it. You don't have to mess with any commands or worry about
messing up your registry. Best of all, the tool is free and has a
mechanism to update as new spyware is created. I use this tool
exclusively as it has no ads and it seems to do the best job (I have
found it to clean up more than Ad-Aware).

By the way, SpyBot will make sure that you don't get Spyware again. 

I haven't ran a manual scan of my system for over 4 months and it came
back clean after I updated! It's a great tool.

Lots of utilities to get rid of spyware.  If you use Hijackthis, be
careful that you don't delete the wrong keys in your registry.  I
wrote a short article on Spyware if you wish to visit:

http://65.24.134.81/KipSolutions/SpywareVirus/SpywareVirus.htm

AutoTbar is connected to HP View, and will keep reinserting itself
into your Startup List (Run Keys).  It automatically arranges your IE
Toolbar.  I don't run it myself, but if you uninstall HP View, this
might get rid of your problem.  Or, just disable HP View....  that
could do it also...

http://greatis.com/appdata/a/a/autotbar.exe.htm

FE