IST2 bar spyware

  • Thread starter Thread starter philwil
  • Start date Start date
P

philwil

Every time my daughter logs off her account and I switch
to mine, AS tells me it's detected
IST.Bar.ContentMatchControl, and asks if I want to delete
it. I click yes. AS tells me it's deleted it. Next time,
there it is again.

This happens EVERY SINGLE TIME we change users, but not
if just one of us uses our individual account. Even if my
daughter simply opens her account and does nothing, just
switches users immediately, the same thing happens. It's
been going on for about four months now.

Why is it not being properly deleted? (I've switched
off/deleted Restore, so it's not hidden in there)

Anyone know what I can do? And what is ISTbar
 
Hi Andy,

Thanks for the detailed reply. Unfortunately, though I've
followed your instructions to the letter, the problem
persists. I found none of the files, in Registry or
elsewhere, but when I logged back on to my account from
my daughter's, MSAS gave me the same red box warning. So
I've deleted it yet again, but am mystified as the IST
folder just doesn't seem to exist on my pc.

Any other suggestions ?
 
Hi Andy,

Do you have Spybot's TeaTimer running?? I had a similar
problem with YourSiteBar popping up everytime I logged on
and would have MSAS remove it, but it would still show up
the next time. I found that if I turned off TeaTimer (Run
Spybot, Mode > Advanced> Tools > Resident, Then uncheck
TeaTimer box) and turned it back on by checking the box
again, the Red warning box popped up imediately.

It turns out that there was a bug in version 1.3 that would
silently "allow" something that was denied with the
"remember this" option set. I upgraded to version 1.4 and
it solved the problem. It can be found here:
http://net-integration.net/spybotsd.html

Hope this helps.

Gary
 
Hi Guys

Sorry just seen the replies, I dont have a problem with
IST but have cleaned it afew times but its hard to know
what you have if you cannot find any of the files, Garys
post is true any real time protection features can
restore settings even after you delete them, Adaware's
Adwatch, Spybots TeaTimer,MSAS RealTime protection etc..
so its always advised to disable them when dealing with
malware to make they go first time, Either that or run
fixes in safe mode which prevents these programs starting
but it sounds like you dont have the files there,

Ive not experienced this where its showing IST but no
files exist there was a similar post on here about IST's
xxx.toolbar, MSAS kept showing it trying to install for
the user but they couldnt find any of the files either.Im
not thinking there may be registry commands to load the
files from the prefetch folder so make sure you delete
them,

It would be good if I could recreate this to work out the
problem but when I cleaned IST a couple of weeks ago it
didnt come back but the files and folders were all in the
locations I posted so it was easily killed once I found
the entries.

All I can suggest really is to double check the
downloaded program files folder for any suspicious
ActiveX (Start menu> c:drive> Windows folder then the
Downloaded program files folder) and right click each and
view properties to make sure they are all genuine.If not
or your unsure remove them as they will just be
downloaded again from the site that installed it when
needed.

All the steps I posted need to be done on each user
account as the folders will be visable on one and not the
other. Then clear all temp files on your system and
prefetch files

To clear Prefetch files goto start then run and type

prefetch

delete the contents of this folder

For Temp files

goto control panel then Internet Options > press delete
files and include all offline content then ok

Then goto start and run and type

%temp%

then delete the contents of this folder(If you cannot
remove some it means they are in use but are only temp
files so can be removed, You could shut down all icons in
the Taskbar near the clock then remove the temp files)

If this continues to show pop ups can you post it as a
new topic so it doesnt get lost with all the other posts
and hopefully one of the helpers here can help you out
with this

Thanks Andy
 
I really should read through my posts before sending
them :)

I meant to put Im now thinking there may be registry
commands to load this from the prefetch folder so make
sure you delete them but typed not instead which makes it
look confusing.

Hi Gary just saw your second post and realize now your
post was meant for phil (I need some fresh air ;)

Let us know phil if this continues and we can try other
things or get feedback from other helpers on here

Andy
 
Hi Guys,

Again thanks for the help. An interesting result. Gary, I
took your advice and upgraded Spybot. Hadn't realised my
v1.2 was totally out of date, as the auto-update never
informed me of new versions.

Well, v1.4 detected three instances of IST-related
folders which MS AntiSpy and Ewido (as well as Spybot 1.2
and AdAware, plus my anti-virus s/ware) had failed to
find. I deleted these and, so far, the problem has not
reoccurred.

So that's great. Just hope it continues. But the question
it raises is, How many different Anti Spyware programs
does a person need? I now have four, plus Avast
Antivirus. Seems a little excessive.

Anyway, thanks again for the support.

Phil
 
Back
Top