YourSiteBar

  • Thread starter Thread starter John
  • Start date Start date
J

John

YourSiteBar seems to be removed almost every day from my
computer. Why? Does this software really fully remove
it or how is it being re-introduced?
 
-----Original Message-----
YourSiteBar seems to be removed almost every day from my
computer. Why? Does this software really fully remove
it or how is it being re-introduced?
.
Click to expand...
 
Goto Add/Remove programs from the control panel then
remove YourSiteBar,ISTsvc,Sidefind,Cramtoolbar if found
same in the program files area

Download this ISTbar removal tool from Symantec for ISTbar

http://securityresponse.symantec.com/avcenter/FxIstbar.exe

Then reboot into safe mode (Reboot and keep tapping F8
then choose safe mode from the list)

In safe mode double click the removal tool and let it
finish scanning then use MS Antspy on a full system scan
and remove anything found,

Then Delete temp files :

Goto Start Menu then Control Panel then to Internet
Options.

In the Temporary Internet Files section, then click the
Delete Files button.
Include all offline content when deleting files and then
click OK.

Then reset web settings :

Click Start Menu then Control Panel

Select Internet Options
Select the Programs tab
Click Reset Web Settings
Click OK
Exit Control Panel

That should be the end of Yoursitebar but let us know if
you have problems

Regards

Andy
 
Hi John I cannot fully Answer that , I do not represent
Microsoft in any way so think its unfair for me to
comment,

Maybe it's because the files are running on your system
while you are trying to remove them which is preventing
full removal,

Maybe you have a trojan downloader on your system that
reinstalls it as soon as you reboot the machine, I would
have to download it to fully answer your question but
since all the crack and serial sites were shut down last
week Im not even sure where to get it again now.

If you can run a scan in safe mode it may remove it first
time and that could be a end to it(Reboot and keep
tapping F8 then choose safe mode from the list)Removing
the entries from Add/Remove screen would also help.

If you think there maybe a Trojan then download Ewido
Security Suite and run a full scan with that. With Ewido
it says its only a 14 day trial but it still works fine
after that has expired and you can still update it
manually whenever you want. The only thing that changes
after the 14 days is the real time protection and
automatic updates which isnt a problem.

Good Luck

Andy
 
Hi Again

I Just got YourSiteBar , The Crack Sites are back up and
running, doesnt take them long they were only shut down
last week, Maybe they just had server problems trying to
write all these trojans into thier pages, Ive got the bar
and various other junk so will test MS Antispy now and
see how it does and repost.
 
Hi John

Sorry for the delay ,MS Antispy found all the files and
cleaned them all without problems and removed the toolbar
first try, It said at the end of the scan it needed to be
rebooted so I did which then reset the homepage back to
msn and removed all the junk .

Ive got to say its missed alot of files and folders but I
noticed when I tried to clean up the first time it said
it was sending about 20 or more files to spynet so it can
only help them for future upgrades but that didnt effect
it cleaning ISTbar who make YourSiteBar and removing the
toolbar from my system so I suggest you run a scan in
safe mode with both MSAS & Ewido, Ive no doubt when I
scan in a minute using Ewido that it will find trojans
that have been missed by MS Antispy but thats really
because Ewido targets them and MS target spyware so I
think you may need both with this if it keeps coming back

Let me know if you have problems though

Regards Andy
 
I see this everytime I boot up too. It pops up a red
warning box that says MySiteBar is trying to install. I
select remove and it seems to, but it shows up again the
next time. When it does a scan it finds the registry entry
"[HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\MenuExt\&SearchIt Toolbar search]" which is a
folder but it's empty. I also remove and it shows up again
the next time. I don't use IE much so it doesn't worry me.

I have turned off System Restore and tried in Safe Mode to
no avail and they don't show up in Add/Remove programs.

I've also ran Spybot S&D, Lavasoft Ad-Aware and the
Symantec FixISTbar removal tool and they don't ever find
anything.

The thing that worrys me is I've seen a few addresses in my
Linksys Incoming log that trace to Shanghai or China (with
no DNS name associated) around the time I boot. I would
like to find out what's going on with that.

The Outgoing log only showed Weatherbug addresses/names and
I've tried turning that off at startup. It doesn't show up
anymore, but the incoming addresses still do and MSAS still
showed that MySiteBar was trying to install. So I don't
think Weatherbug is the cause.

I'm going to try turning off other things at startup to see
if I can find it.

Any ideas??

Gary
 
My problem was caused by Spybot's TeaTimer. I had version
1.3 and there's a bug in the "Remembered" allow/deny list
which would allow a change "silently" (no popup) if it was
already denied. See this thread for details:
http://forums.net-integration.net/index.php?showtopic=23715&st=30

The fix is to install the latest version (1.4) of Spybot
S&D which you can get here:
http://net-integration.net/spybotsd.html

Once I downloaded and installed it with all the updates, I
no longer get the warning when I boot that YourSiteBar is
trying to install.

You may need to check the RegKeyWhite file to make sure
that it's not there (allowed) it can be found in the
following directory on XP Pro: C:\Documents and
Settings\All Users\Application Data\Spybot - Search &
Destroy\Excludes\ That's the file that Spybot uses to
"remember" allowed registry changes. (You might want to
check the other things that are listed there. I deleted
everything and will allow new changes as nescessary)

Edit it using Notepad and remove any line that has
{771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} or
{86227D9C-0EFE-4f8a-AA55-30386A3F5686}

Hope this helps someone else.

Gary

P.S I still don't know what's causing the addresses from
China to show up in my incoming router log. At one point I
turned off ALL System Services and ALL Startup Items in
msconfig and they still showed up. That one is still a mystery.

-----Original Message-----
I see this everytime I boot up too. It pops up a red
warning box that says MySiteBar is trying to install. I
select remove and it seems to, but it shows up again the
next time. When it does a scan it finds the registry entry
"[HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\MenuExt\&SearchIt Toolbar search]" which is a
folder but it's empty. I also remove and it shows up again
the next time. I don't use IE much so it doesn't worry me.

I have turned off System Restore and tried in Safe Mode to
no avail and they don't show up in Add/Remove programs.

I've also ran Spybot S&D, Lavasoft Ad-Aware and the
Symantec FixISTbar removal tool and they don't ever find
anything.

The thing that worrys me is I've seen a few addresses in my
Linksys Incoming log that trace to Shanghai or China (with
no DNS name associated) around the time I boot. I would
like to find out what's going on with that.

The Outgoing log only showed Weatherbug addresses/names and
I've tried turning that off at startup. It doesn't show up
anymore, but the incoming addresses still do and MSAS still
showed that MySiteBar was trying to install. So I don't
think Weatherbug is the cause.

I'm going to try turning off other things at startup to see
if I can find it.

Any ideas??

Gary

-----Original Message-----
YourSiteBar seems to be removed almost every day from my
computer. Why? Does this software really fully remove
it or how is it being re-introduced?
.
Click to expand...
.
Click to expand...
 
Back
Top