Home>Tips & Articles>Remove Adware & Spyware>
Remove ISTbar Spyware
About ISTbar
ISTbar is a homepage and search hijacking adware. It adds a toolbar to Internet Explorer and displays popup ads that come mainly from porn sites. This adware is distributed by Integrated Search Technologies/CDT Inc. It may also install third-party adware and spyware on the computer.
How to Remove ISTbar Spyware?
Remove this spyware using Spyware Doctor
Adware ISTbar has the following variants:
- MSCache : also uses TinyBar, along with a Browser Helper Object called mscache.dll used to load updates. The controlling server is www2.skoobidoo.com.
- XXXToolbar : is an update based around pornography. It uses its own toolbar based on the Pugi toolbar. The hijacker is aimed at its controlling server xxxtoolbar.com, and slotch.com; distribution is controlled by toolbarcash.com. It opens pop-ups as directed by its controlling server.
- CSearch
- MCInstL
- AUpdate :installs a TinyBar variant to implement its toolbar. The hijacker is aimed at my-internet.info and blazefind.com; distribution is managed by searchbarcash.com, its controlling server.
Although there is a entry in Add/Remove Programs for 'MS AUpdate' (AUpdate variant), 'MS Updates' (MSCache variant), or 'ISTbar' (ISTbar variant), it does not appear to work very well or work at all. You can remove this spyware using PestPatrol , or use the following steps carefully to remove it manually. Before proceeding on, we strongly recommend you backup your system using WinBackup.
AUpdate variant:
- Open the registry editor (click Start > Run, and enter 'regedit').
- Find the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Delete the 'AutoUpdater' entry on the right (pointing to aupdate.exe).
- Find the key HKEY_CLASSES_ROOT\CLSID, and delete the subkey '
{69550BE2-9A78-11D2-BA91-00600827878D}
'. Delete the subkey of the same name from HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars, and the entry of the same name from HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar.
- Restart the computer.
- Delete the files 'aupdate.exe', 'aupdate.conf', 'aupdate.trk' and (if it is there) 'aupdate_uninstall.exe' from the System folder. (The System folder can be found inside the Windows folder; it is called 'System32' on Windows NT/2000/XP or just 'System' on Windows 95/98/Me.)
- Restore your normal search settings (Internet Options->Programs->Reset Web Settings).
MSCache variant:
- Open a DOS command prompt window (Start->Programs->Accessories) and enter the following commands:
cd "%WinDir%\System"
regsvr32 /u ../mscache.dll
- Open the registry editor (click Start > Run and enter 'regedit').
- Find the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Delete the 'MS Updates' entry on the right (pointing to mscache.exe).
- Find the key HKEY_CLASSES_ROOT\CLSID, and delete the subkey '
{69550BE2-9A78-11D2-BA91-00600827878D}
'. Delete the subkey of the same name from HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars, and the entry of the same name from HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar.
- Restart the computer.
- Delete the files 'mscache.exe', and 'mscache.dll' from the Windows folder.
- Restore your normal search settings (Internet Options->Programs->Reset Web Settings).
XXXToolbar variant:
- Open the registry editor (click Start > Run and enter 'regedit').
- Find the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Delete the 'IST Service' entry, if it is there. (Some early releases of XXXToolbar did not include this.)
- Delete the following registry keys ( if present ):
HKEY_CURRENT_USER\Software\ISTbar HKEY_CLASSES_ROOT\Pugi.PugiObj (and .1)
HKEY_LOCAL_MACHINE\Software\ISTsvc
HKEY_CURRENT_USER\Software\IST
- Open a DOS command prompt window (Start->Programs->Accessories) and enter the following commands:
cd "%WinDir%\System"
regsvr32 /u "\Program Files\ISTbar\istbar.dll" Or
regsvr32 /u "\Program Files\ISTSVc\istbar.dll"
- Restart the computer.
- Delete the 'ISTbar' folder inside Program Files, and the 'istsvc.exe' file inside the Windows folder or "C:\Program Files\ISTsvc" folder.
- Restore your normal search settings (Internet Options->Programs->Reset Web Settings).
Remove this spyware using Spyware Doctor
Remove other Spyware:
