IST.Bar

[Mark Brakel]

Hi,

For several days and actually quite a large amount of my
weekend I have tried to remove the IST.Bar. The Microsoft
Antispyware program detects it at start-up, asks me if I
want it removed but after removalI get a page saying that
I have successfully installed the toolbar. I
also continiously get virus warnings from my AntiVirus
program (Norman), plus the following new entries have
appeared in my 'Currently Installed Programs'
list: "AdTools Service", "Sidefind" and "Slotchbar". I
have also tried to use Spybot S&D but that doesn't help
either.

Hoping someone can help me,

Mark Brakel

P.S. I have added the hijackthis report, maybe that'll
help:

--BEGIN---

Logfile of HijackThis v1.99.1
Scan saved at 5:42:40 PM, on 2/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norman\bin\ZANDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRAM FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
C:\Program Files\Norman\bin\NJEEVES.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\AcerGoto.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\RAM Idle\RAM_XP.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0
\gnotify.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnd.exe
C:\Program Files\Norman\bin\ZLH.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\sqgoggpa.exe
C:\WINDOWS\system32\wini.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnf.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Magic Keyboard\MagicKey.exe
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Magic Keyboard\V3D.exe
C:\Program Files\Magic Keyboard\OSD.EXE
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Loesje\My
Documents\Other\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL
=

http://www.fountianofyouth.com
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Bar =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local
Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local
Page =
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-
206D7942484F} - (no file)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-
4ED8E67DBBB8} -

C:\Program Files\SideFind\sfbho.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-
FADC6B084872} - (no

file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-
009027A5CD4F} -

c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-
B72A4567E486} -

C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32
\AcerGoto.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program
Files\RAM

Idle\RAM_XP.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-
b109a192b4c2}] C:\Program

Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon]
C:\Program

Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32
\\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Program
Files\Norman\bin\ZLH.EXE

/LOAD /SPLASH
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft

AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QeAd] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [<°ÜZJÝYMÝlY«Q°aÆ+À¼C:\Program

Files\ISTsvc\istsvc.exe] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [virtual-machine] wini.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program
Files\AdTools

Service\AdTools.exe
O4 - HKLM\..\Run: [IST Service] C:\Program
Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power
Scan\powerscan.exe
O4 - HKLM\..\RunServices: [virtual-machine] wini.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32
\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe"

/background
O4 - HKCU\..\Run: [win-xp] winis.exe
O4 - HKCU\..\Run: [virtual-machine] wini.exe
O4 - HKCU\..\RunServices: [win-xp] winis.exe
O4 - HKCU\..\RunServices: [virtual-machine] wini.exe
O4 - Global Startup: Magic Keyboard.lnk = C:\Program
Files\Magic

Keyboard\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft

Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Control Panel present
O8 - Extra context menu item: &Google Search -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -


res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} -

C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-
B3F6EC39B807} -

C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C}
(Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -

http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {11111111-1111-1111-1111-111111111147} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine

Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C}
(ICSScannerLight

Class) -
http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E}
(Microsoft PID

Sniffer) -
https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B}
(FilePlanet

Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} -

http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
(WUWebControl

Class) -

http://v5.windowsupdate.microsoft.com/v5consumer/V5Control
s/en/x86/client/wuw

eb_site.cab?1097256290328
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClient.
cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125}
(mhLabel Class) -

http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539}
(Crucial cpcScan)

- http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46}
(IMDownloader

Class) -
http://www2.incredimail.com/contents/setup/downloader/imlo
ader.cab
O23 - Service: Norman API-hooking helper (NipSvc) -
Unknown owner -

C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner -
C:\Program

Files\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Program

Files\Norman\bin\ZANDA.EXE
O23 - Service: Norman Virus Control on-access component
(nvcoas) - Norman

ASA - C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler
(NVCScheduler) - Norman Data

Defense Systems - C:\PROGRAM
FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32
\HPZipm12.exe

---END---

 

[Chris Newman]

Goto Symantecs' web site and get the removal tool (and instructions on
manual removal).

Hi,

For several days and actually quite a large amount of my
weekend I have tried to remove the IST.Bar. The Microsoft
Antispyware program detects it at start-up, asks me if I
want it removed but after removalI get a page saying that
I have successfully installed the toolbar. I
also continiously get virus warnings from my AntiVirus
program (Norman), plus the following new entries have
appeared in my 'Currently Installed Programs'
list: "AdTools Service", "Sidefind" and "Slotchbar". I
have also tried to use Spybot S&D but that doesn't help
either.

Hoping someone can help me,

Mark Brakel

P.S. I have added the hijackthis report, maybe that'll
help:

--BEGIN---

Logfile of HijackThis v1.99.1
Scan saved at 5:42:40 PM, on 2/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norman\bin\ZANDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRAM FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
C:\Program Files\Norman\bin\NJEEVES.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\AcerGoto.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\RAM Idle\RAM_XP.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0
\gnotify.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnd.exe
C:\Program Files\Norman\bin\ZLH.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\sqgoggpa.exe
C:\WINDOWS\system32\wini.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnf.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Magic Keyboard\MagicKey.exe
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Magic Keyboard\V3D.exe
C:\Program Files\Magic Keyboard\OSD.EXE
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Loesje\My
Documents\Other\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL
=

http://www.fountianofyouth.com
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Bar =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local
Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local
Page =
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-
206D7942484F} - (no file)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-
4ED8E67DBBB8} -

C:\Program Files\SideFind\sfbho.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-
FADC6B084872} - (no

file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-
009027A5CD4F} -

c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-
B72A4567E486} -

C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32
\AcerGoto.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program
Files\RAM

Idle\RAM_XP.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-
b109a192b4c2}] C:\Program

Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon]
C:\Program

Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32
\\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Program
Files\Norman\bin\ZLH.EXE

/LOAD /SPLASH
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft

AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QeAd] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [<°ÜZJÝYMÝlY«Q°aÆ+À¼C:\Program

Files\ISTsvc\istsvc.exe] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [virtual-machine] wini.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program
Files\AdTools

Service\AdTools.exe
O4 - HKLM\..\Run: [IST Service] C:\Program
Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power
Scan\powerscan.exe
O4 - HKLM\..\RunServices: [virtual-machine] wini.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32
\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe"

/background
O4 - HKCU\..\Run: [win-xp] winis.exe
O4 - HKCU\..\Run: [virtual-machine] wini.exe
O4 - HKCU\..\RunServices: [win-xp] winis.exe
O4 - HKCU\..\RunServices: [virtual-machine] wini.exe
O4 - Global Startup: Magic Keyboard.lnk = C:\Program
Files\Magic

Keyboard\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft

Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Control Panel present
O8 - Extra context menu item: &Google Search -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -


res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} -

C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-
B3F6EC39B807} -

C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C}
(Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -

http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {11111111-1111-1111-1111-111111111147} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine

Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C}
(ICSScannerLight

Class) -
http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E}
(Microsoft PID

Sniffer) -
https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B}
(FilePlanet

Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} -

http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
(WUWebControl

Class) -

http://v5.windowsupdate.microsoft.com/v5consumer/V5Control
s/en/x86/client/wuw

eb_site.cab?1097256290328
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClient.
cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125}
(mhLabel Class) -

http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539}
(Crucial cpcScan)

- http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46}
(IMDownloader

Class) -
http://www2.incredimail.com/contents/setup/downloader/imlo
ader.cab
O23 - Service: Norman API-hooking helper (NipSvc) -
Unknown owner -

C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner -
C:\Program

Files\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Program

Files\Norman\bin\ZANDA.EXE
O23 - Service: Norman Virus Control on-access component
(nvcoas) - Norman

ASA - C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler
(NVCScheduler) - Norman Data

Defense Systems - C:\PROGRAM
FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32
\HPZipm12.exe

---END---

 

[Guest]

I have tried this tool but it doesn't end the problem.

-----Original Message-----
Goto Symantecs' web site and get the removal tool (and instructions on
manual removal).

Hi,

For several days and actually quite a large amount of my
weekend I have tried to remove the IST.Bar. The Microsoft
Antispyware program detects it at start-up, asks me if I
want it removed but after removalI get a page saying that
I have successfully installed the toolbar. I
also continiously get virus warnings from my AntiVirus
program (Norman), plus the following new entries have
appeared in my 'Currently Installed Programs'
list: "AdTools Service", "Sidefind" and "Slotchbar". I
have also tried to use Spybot S&D but that doesn't help
either.

Hoping someone can help me,

Mark Brakel

P.S. I have added the hijackthis report, maybe that'll
help:

--BEGIN---

Logfile of HijackThis v1.99.1
Scan saved at 5:42:40 PM, on 2/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norman\bin\ZANDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRAM FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
C:\Program Files\Norman\bin\NJEEVES.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\AcerGoto.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\RAM Idle\RAM_XP.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0
\gnotify.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnd.exe
C:\Program Files\Norman\bin\ZLH.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\sqgoggpa.exe
C:\WINDOWS\system32\wini.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnf.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Magic Keyboard\MagicKey.exe
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Magic Keyboard\V3D.exe
C:\Program Files\Magic Keyboard\OSD.EXE
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Loesje\My
Documents\Other\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL
=

http://www.fountianofyouth.com
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Bar =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local
Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local
Page =
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-
206D7942484F} - (no file)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-
4ED8E67DBBB8} -

C:\Program Files\SideFind\sfbho.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-
FADC6B084872} - (no

file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-
009027A5CD4F} -

c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-
B72A4567E486} -

C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32
\AcerGoto.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program
Files\RAM

Idle\RAM_XP.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-
b109a192b4c2}] C:\Program

Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon]
C:\Program

Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32
\\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Program
Files\Norman\bin\ZLH.EXE

/LOAD /SPLASH
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft

AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QeAd] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [<°ÜZJÝYMÝlY«Q°aÆ+À¼C:\Program

Files\ISTsvc\istsvc.exe] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [virtual-machine] wini.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program
Files\AdTools

Service\AdTools.exe
O4 - HKLM\..\Run: [IST Service] C:\Program
Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power
Scan\powerscan.exe
O4 - HKLM\..\RunServices: [virtual-machine] wini.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32
\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe"

/background
O4 - HKCU\..\Run: [win-xp] winis.exe
O4 - HKCU\..\Run: [virtual-machine] wini.exe
O4 - HKCU\..\RunServices: [win-xp] winis.exe
O4 - HKCU\..\RunServices: [virtual-machine] wini.exe
O4 - Global Startup: Magic Keyboard.lnk = C:\Program
Files\Magic

Keyboard\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft

Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Control Panel present
O8 - Extra context menu item: &Google Search -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -


res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} -

C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-
B3F6EC39B807} -

C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C}
(Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -

http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {11111111-1111-1111-1111-111111111147} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine

Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C}
(ICSScannerLight

Class) -
http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E}
(Microsoft PID

Sniffer) -
https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B}
(FilePlanet

Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} -

http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
(WUWebControl

Class) -

http://v5.windowsupdate.microsoft.com/v5consumer/V5Contro l
s/en/x86/client/wuw

eb_site.cab?1097256290328
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClient ..
cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125}
(mhLabel Class) -

http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539}
(Crucial cpcScan)

- http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46}
(IMDownloader

Class) -
http://www2.incredimail.com/contents/setup/downloader/iml o
ader.cab
O23 - Service: Norman API-hooking helper (NipSvc) -
Unknown owner -

C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner -
C:\Program

Files\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Program

Files\Norman\bin\ZANDA.EXE
O23 - Service: Norman Virus Control on-access component
(nvcoas) - Norman

ASA - C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler
(NVCScheduler) - Norman Data

Defense Systems - C:\PROGRAM
FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32
\HPZipm12.exe

---END---



.

 

[Mark Brakel]

I think my IST.Bar variant comes from the toolbarcash
company (www.toolbarcash), but I am not sure..all i know
is that the symantec tool doesn't work. Thans for ur
reply anyway.

-----Original Message-----
Goto Symantecs' web site and get the removal tool (and instructions on
manual removal).

Hi,

For several days and actually quite a large amount of my
weekend I have tried to remove the IST.Bar. The Microsoft
Antispyware program detects it at start-up, asks me if I
want it removed but after removalI get a page saying that
I have successfully installed the toolbar. I
also continiously get virus warnings from my AntiVirus
program (Norman), plus the following new entries have
appeared in my 'Currently Installed Programs'
list: "AdTools Service", "Sidefind" and "Slotchbar". I
have also tried to use Spybot S&D but that doesn't help
either.

Hoping someone can help me,

Mark Brakel

P.S. I have added the hijackthis report, maybe that'll
help:

--BEGIN---

Logfile of HijackThis v1.99.1
Scan saved at 5:42:40 PM, on 2/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norman\bin\ZANDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRAM FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
C:\Program Files\Norman\bin\NJEEVES.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\AcerGoto.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\RAM Idle\RAM_XP.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0
\gnotify.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnd.exe
C:\Program Files\Norman\bin\ZLH.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\sqgoggpa.exe
C:\WINDOWS\system32\wini.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnf.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Magic Keyboard\MagicKey.exe
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Magic Keyboard\V3D.exe
C:\Program Files\Magic Keyboard\OSD.EXE
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Loesje\My
Documents\Other\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL
=

http://www.fountianofyouth.com
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Bar =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local
Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local
Page =
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-
206D7942484F} - (no file)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-
4ED8E67DBBB8} -

C:\Program Files\SideFind\sfbho.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-
FADC6B084872} - (no

file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-
009027A5CD4F} -

c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-
B72A4567E486} -

C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32
\AcerGoto.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program
Files\RAM

Idle\RAM_XP.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-
b109a192b4c2}] C:\Program

Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon]
C:\Program

Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32
\\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Program
Files\Norman\bin\ZLH.EXE

/LOAD /SPLASH
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft

AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QeAd] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [<°ÜZJÝYMÝlY«Q°aÆ+À¼C:\Program

Files\ISTsvc\istsvc.exe] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [virtual-machine] wini.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program
Files\AdTools

Service\AdTools.exe
O4 - HKLM\..\Run: [IST Service] C:\Program
Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power
Scan\powerscan.exe
O4 - HKLM\..\RunServices: [virtual-machine] wini.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32
\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe"

/background
O4 - HKCU\..\Run: [win-xp] winis.exe
O4 - HKCU\..\Run: [virtual-machine] wini.exe
O4 - HKCU\..\RunServices: [win-xp] winis.exe
O4 - HKCU\..\RunServices: [virtual-machine] wini.exe
O4 - Global Startup: Magic Keyboard.lnk = C:\Program
Files\Magic

Keyboard\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft

Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Control Panel present
O8 - Extra context menu item: &Google Search -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -


res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} -

C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-
B3F6EC39B807} -

C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C}
(Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -

http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {11111111-1111-1111-1111-111111111147} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine

Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C}
(ICSScannerLight

Class) -
http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E}
(Microsoft PID

Sniffer) -
https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B}
(FilePlanet

Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} -

http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
(WUWebControl

Class) -

http://v5.windowsupdate.microsoft.com/v5consumer/V5Contro l
s/en/x86/client/wuw

eb_site.cab?1097256290328
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClient ..
cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125}
(mhLabel Class) -

http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539}
(Crucial cpcScan)

- http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46}
(IMDownloader

Class) -
http://www2.incredimail.com/contents/setup/downloader/iml o
ader.cab
O23 - Service: Norman API-hooking helper (NipSvc) -
Unknown owner -

C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner -
C:\Program

Files\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Program

Files\Norman\bin\ZANDA.EXE
O23 - Service: Norman Virus Control on-access component
(nvcoas) - Norman

ASA - C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler
(NVCScheduler) - Norman Data

Defense Systems - C:\PROGRAM
FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32
\HPZipm12.exe

---END---



.

 

[Chris Newman]

I must admit I did the manual removal, rather than the tool removal.

I think my IST.Bar variant comes from the toolbarcash
company (www.toolbarcash), but I am not sure..all i know
is that the symantec tool doesn't work. Thans for ur
reply anyway.

-----Original Message-----
Goto Symantecs' web site and get the removal tool (and instructions on
manual removal).

Hi,

For several days and actually quite a large amount of my
weekend I have tried to remove the IST.Bar. The Microsoft
Antispyware program detects it at start-up, asks me if I
want it removed but after removalI get a page saying that
I have successfully installed the toolbar. I
also continiously get virus warnings from my AntiVirus
program (Norman), plus the following new entries have
appeared in my 'Currently Installed Programs'
list: "AdTools Service", "Sidefind" and "Slotchbar". I
have also tried to use Spybot S&D but that doesn't help
either.

Hoping someone can help me,

Mark Brakel

P.S. I have added the hijackthis report, maybe that'll
help:

--BEGIN---

Logfile of HijackThis v1.99.1
Scan saved at 5:42:40 PM, on 2/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norman\bin\ZANDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRAM FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
C:\Program Files\Norman\bin\NJEEVES.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\AcerGoto.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\RAM Idle\RAM_XP.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0
\gnotify.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnd.exe
C:\Program Files\Norman\bin\ZLH.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\sqgoggpa.exe
C:\WINDOWS\system32\wini.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnf.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Magic Keyboard\MagicKey.exe
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Magic Keyboard\V3D.exe
C:\Program Files\Magic Keyboard\OSD.EXE
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Loesje\My
Documents\Other\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL
=

http://www.fountianofyouth.com
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Bar =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local
Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local
Page =
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-
206D7942484F} - (no file)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-
4ED8E67DBBB8} -

C:\Program Files\SideFind\sfbho.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-
FADC6B084872} - (no

file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-
009027A5CD4F} -

c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-
B72A4567E486} -

C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32
\AcerGoto.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program
Files\RAM

Idle\RAM_XP.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-
b109a192b4c2}] C:\Program

Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon]
C:\Program

Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32
\\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Program
Files\Norman\bin\ZLH.EXE

/LOAD /SPLASH
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft

AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QeAd] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [<°ÜZJÝYMÝlY«Q°aÆ+À¼C:\Program

Files\ISTsvc\istsvc.exe] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [virtual-machine] wini.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program
Files\AdTools

Service\AdTools.exe
O4 - HKLM\..\Run: [IST Service] C:\Program
Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power
Scan\powerscan.exe
O4 - HKLM\..\RunServices: [virtual-machine] wini.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32
\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe"

/background
O4 - HKCU\..\Run: [win-xp] winis.exe
O4 - HKCU\..\Run: [virtual-machine] wini.exe
O4 - HKCU\..\RunServices: [win-xp] winis.exe
O4 - HKCU\..\RunServices: [virtual-machine] wini.exe
O4 - Global Startup: Magic Keyboard.lnk = C:\Program
Files\Magic

Keyboard\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft

Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Control Panel present
O8 - Extra context menu item: &Google Search -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -


res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} -

C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-
B3F6EC39B807} -

C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C}
(Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -

http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {11111111-1111-1111-1111-111111111147} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine

Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C}
(ICSScannerLight

Class) -
http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E}
(Microsoft PID

Sniffer) -
https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B}
(FilePlanet

Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} -

http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
(WUWebControl

Class) -

http://v5.windowsupdate.microsoft.com/v5consumer/V5Contro l
s/en/x86/client/wuw

eb_site.cab?1097256290328
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClient ..
cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125}
(mhLabel Class) -

http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539}
(Crucial cpcScan)

- http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46}
(IMDownloader

Class) -
http://www2.incredimail.com/contents/setup/downloader/iml o
ader.cab
O23 - Service: Norman API-hooking helper (NipSvc) -
Unknown owner -

C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner -
C:\Program

Files\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Program

Files\Norman\bin\ZANDA.EXE
O23 - Service: Norman Virus Control on-access component
(nvcoas) - Norman

ASA - C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler
(NVCScheduler) - Norman Data

Defense Systems - C:\PROGRAM
FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32
\HPZipm12.exe

---END---



.

 

[Mark Brakel]

Thanx for the fast reply but even the manual process i
just tried doesn't work. Some registry keys I had to
delete where there, some weren't; after deletting them
all in Safe Mode without networking and doing two
Microsoft Anitispyware scans and one Spybot S&D scan plus
a restart the 'WARNING! Microsoft Antispywar Alert!"
dialogs popped up again, asking me to delete IST.ISTbar
Browser Modifier, Sidefind, etc. Hope anyone can help em
further...

-----Original Message-----
I must admit I did the manual removal, rather than the tool removal.

I think my IST.Bar variant comes from the toolbarcash
company (www.toolbarcash), but I am not sure..all i know
is that the symantec tool doesn't work. Thans for ur
reply anyway.

-----Original Message-----
Goto Symantecs' web site and get the removal tool (and instructions on
manual removal).

Hi,

For several days and actually quite a large amount of my
weekend I have tried to remove the IST.Bar. The Microsoft
Antispyware program detects it at start-up, asks me if I
want it removed but after removalI get a page saying that
I have successfully installed the toolbar. I
also continiously get virus warnings from my AntiVirus
program (Norman), plus the following new entries have
appeared in my 'Currently Installed Programs'
list: "AdTools Service", "Sidefind" and "Slotchbar". I
have also tried to use Spybot S&D but that doesn't help
either.

Hoping someone can help me,

Mark Brakel

P.S. I have added the hijackthis report, maybe that'll
help:

--BEGIN---

Logfile of HijackThis v1.99.1
Scan saved at 5:42:40 PM, on 2/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norman\bin\ZANDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRAM FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
C:\Program Files\Norman\bin\NJEEVES.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\AcerGoto.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\RAM Idle\RAM_XP.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0
\gnotify.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnd.exe
C:\Program Files\Norman\bin\ZLH.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\sqgoggpa.exe
C:\WINDOWS\system32\wini.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnf.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Magic Keyboard\MagicKey.exe
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Magic Keyboard\V3D.exe
C:\Program Files\Magic Keyboard\OSD.EXE
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Loesje\My
Documents\Other\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL
=

http://www.fountianofyouth.com
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Bar =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local
Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local
Page =
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-
206D7942484F} - (no file)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-
4ED8E67DBBB8} -

C:\Program Files\SideFind\sfbho.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-
FADC6B084872} - (no

file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-
009027A5CD4F} -

c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-
B72A4567E486} -

C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32
\AcerGoto.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program
Files\RAM

Idle\RAM_XP.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-
b109a192b4c2}] C:\Program

Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon]
C:\Program

Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32
\\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Program
Files\Norman\bin\ZLH.EXE

/LOAD /SPLASH
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft

AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QeAd] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [<°ÜZJÝYMÝlY«Q°aÆ+À¼C:\Program

Files\ISTsvc\istsvc.exe] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [virtual-machine] wini.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program
Files\AdTools

Service\AdTools.exe
O4 - HKLM\..\Run: [IST Service] C:\Program
Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power
Scan\powerscan.exe
O4 - HKLM\..\RunServices: [virtual-machine] wini.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32
\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe"

/background
O4 - HKCU\..\Run: [win-xp] winis.exe
O4 - HKCU\..\Run: [virtual-machine] wini.exe
O4 - HKCU\..\RunServices: [win-xp] winis.exe
O4 - HKCU\..\RunServices: [virtual-machine] wini.exe
O4 - Global Startup: Magic Keyboard.lnk = C:\Program
Files\Magic

Keyboard\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft

Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Control Panel present
O8 - Extra context menu item: &Google Search -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -


res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} -

C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-
B3F6EC39B807} -

C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C}
(Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -

http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {11111111-1111-1111-1111-111111111147} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine

Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C}
(ICSScannerLight

Class) -
http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E}
(Microsoft PID

Sniffer) -
https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B}
(FilePlanet

Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} -

http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
(WUWebControl

Class) -

http://v5.windowsupdate.microsoft.com/v5consumer/V5Contr

o

l
s/en/x86/client/wuw

eb_site.cab?1097256290328
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClien

t

..
cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125}
(mhLabel Class) -

http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539}
(Crucial cpcScan)

- http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46}
(IMDownloader

Class) -
http://www2.incredimail.com/contents/setup/downloader/im

l

o
ader.cab
O23 - Service: Norman API-hooking helper (NipSvc) -
Unknown owner -

C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner -
C:\Program

Files\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Program

Files\Norman\bin\ZANDA.EXE
O23 - Service: Norman Virus Control on-access component
(nvcoas) - Norman

ASA - C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler
(NVCScheduler) - Norman Data

Defense Systems - C:\PROGRAM
FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32
\HPZipm12.exe

---END---



.

.

 

[Chris Newman]

http://www.spyany.com/program/article_spy_rm_ISTbar.html suggests using
Spyware Doctor!

Ive had the damn thing reappear again and ive noticed a few more .exe files
with random letter-filenames in the windows folder. i did think of (with XP
Pro) getting its ISTSvc folder and removing all the security permissions -
thus denying access to the folder!!

Thanx for the fast reply but even the manual process i
just tried doesn't work. Some registry keys I had to
delete where there, some weren't; after deletting them
all in Safe Mode without networking and doing two
Microsoft Anitispyware scans and one Spybot S&D scan plus
a restart the 'WARNING! Microsoft Antispywar Alert!"
dialogs popped up again, asking me to delete IST.ISTbar
Browser Modifier, Sidefind, etc. Hope anyone can help em
further...

-----Original Message-----
I must admit I did the manual removal, rather than the tool removal.

I think my IST.Bar variant comes from the toolbarcash
company (www.toolbarcash), but I am not sure..all i know
is that the symantec tool doesn't work. Thans for ur
reply anyway.

-----Original Message-----
Goto Symantecs' web site and get the removal tool (and instructions on
manual removal).

Hi,

For several days and actually quite a large amount of my
weekend I have tried to remove the IST.Bar. The Microsoft
Antispyware program detects it at start-up, asks me if I
want it removed but after removalI get a page saying that
I have successfully installed the toolbar. I
also continiously get virus warnings from my AntiVirus
program (Norman), plus the following new entries have
appeared in my 'Currently Installed Programs'
list: "AdTools Service", "Sidefind" and "Slotchbar". I
have also tried to use Spybot S&D but that doesn't help
either.

Hoping someone can help me,

Mark Brakel

P.S. I have added the hijackthis report, maybe that'll
help:

--BEGIN---

Logfile of HijackThis v1.99.1
Scan saved at 5:42:40 PM, on 2/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norman\bin\ZANDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRAM FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
C:\Program Files\Norman\bin\NJEEVES.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\AcerGoto.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\RAM Idle\RAM_XP.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0
\gnotify.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnd.exe
C:\Program Files\Norman\bin\ZLH.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\sqgoggpa.exe
C:\WINDOWS\system32\wini.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnf.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Magic Keyboard\MagicKey.exe
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Magic Keyboard\V3D.exe
C:\Program Files\Magic Keyboard\OSD.EXE
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Loesje\My
Documents\Other\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL
=

http://www.fountianofyouth.com
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Bar =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local
Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local
Page =
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-
206D7942484F} - (no file)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-
4ED8E67DBBB8} -

C:\Program Files\SideFind\sfbho.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-
FADC6B084872} - (no

file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-
009027A5CD4F} -

c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-
B72A4567E486} -

C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32
\AcerGoto.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program
Files\RAM

Idle\RAM_XP.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-
b109a192b4c2}] C:\Program

Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon]
C:\Program

Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32
\\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Program
Files\Norman\bin\ZLH.EXE

/LOAD /SPLASH
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft

AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QeAd] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [<°ÜZJÝYMÝlY«Q°aÆ+À¼C:\Program

Files\ISTsvc\istsvc.exe] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [virtual-machine] wini.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program
Files\AdTools

Service\AdTools.exe
O4 - HKLM\..\Run: [IST Service] C:\Program
Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power
Scan\powerscan.exe
O4 - HKLM\..\RunServices: [virtual-machine] wini.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32
\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe"

/background
O4 - HKCU\..\Run: [win-xp] winis.exe
O4 - HKCU\..\Run: [virtual-machine] wini.exe
O4 - HKCU\..\RunServices: [win-xp] winis.exe
O4 - HKCU\..\RunServices: [virtual-machine] wini.exe
O4 - Global Startup: Magic Keyboard.lnk = C:\Program
Files\Magic

Keyboard\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft

Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Control Panel present
O8 - Extra context menu item: &Google Search -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -


res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} -

C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-
B3F6EC39B807} -

C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C}
(Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -

http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {11111111-1111-1111-1111-111111111147} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine

Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C}
(ICSScannerLight

Class) -
http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E}
(Microsoft PID

Sniffer) -
https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B}
(FilePlanet

Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} -

http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
(WUWebControl

Class) -

http://v5.windowsupdate.microsoft.com/v5consumer/V5Contr

o

l
s/en/x86/client/wuw

eb_site.cab?1097256290328
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClien

t

..
cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125}
(mhLabel Class) -

http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539}
(Crucial cpcScan)

- http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46}
(IMDownloader

Class) -
http://www2.incredimail.com/contents/setup/downloader/im

l

o
ader.cab
O23 - Service: Norman API-hooking helper (NipSvc) -
Unknown owner -

C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner -
C:\Program

Files\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Program

Files\Norman\bin\ZANDA.EXE
O23 - Service: Norman Virus Control on-access component
(nvcoas) - Norman

ASA - C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler
(NVCScheduler) - Norman Data

Defense Systems - C:\PROGRAM
FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32
\HPZipm12.exe

---END---



.

.

 

[Jim Byrd]

Hi Mark and Chris - Do the Manual Removal steps at BOTH these pages:

http://www.kephyr.com/spywarescanner/library/isearch/index.phtml
http://64.251.25.168/parasite/ISTbar.html


Then, go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm or here:
http://inetexplorer.mvps.org/parasite.htm and wait a little bit (be
patient), while an analysis of a number of possible parasites on your
machine will be made to help you identify and remove them. NOTE: You will
need to disable Ad Blocking in Zone Alarm 3.x or later, if present or any
other Ad Blocking software which interferes with Java Scripting for this
scan to work. You should get a message between the two lines of **** giving
the results of the scan.


If you have further issues (and even if not, do at least Stinger and
SysClean and note the preventive measures at the end). Read carefully and
do each step exactly as written - don't omit any:


#########IMPORTANT#########
Before you try to remove spyware using any of the programs below, download
both a copy of LSPFIX here:

http://www.cexx.org/lspfix.htm

AND a copy of Winsockfix for W95, W98, and ME
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?ttid=257

or here for Win2k/XP http://files.webattack.com/localdl834/WinsockxpFix.exe
Info here: http://www.spychecker.com/program/winsockxpfix.html
Directions here: http://www.iup.edu/house/resnet/winfix.shtm

The process of removing certain malware may kill your internet connection.
If this should occur, these programs, LSPFIX and WINSOCKFIX, will enable you
to regain your connection.

NOTE: It is reported that in XP SP2, the Run command netsh winsock reset
will fix this problem without the need for these programs. (You can also
try this if you're on XP SP1. There has also been one, as yet unconfirmed,
report that this also works there.) Also, one MS technician suggested the
following sequence:

netsh int reset all
ipconfig /flushdns

See also: http://windowsxp.mvps.org/winsock.htm for additional XPSP2
info/approaches using the netsh command.
#########IMPORTANT#########



#########IMPORTANT#########
Show hidden files and run all of the following removal tools from Safe mode
or a "Clean Boot" when possible, logged on as an Administrator. BEFORE
running these tools, be sure to clear all Temp files and your Temporary
Internet Files (TIF)(including offline content.) Reboot and test if the
malware is fixed after using each tool.

HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339

Clean Boot - General Win2k/XP procedure, but see below for links for other
OS's (This for Win2k w/msconfig - you can obtain msconfig for Win2k here:
http://www.3feetunder.com/files/win2K_msconfig_setup.exe ):

1. StartRun enter msconfig.

2. On the General tab, click Selective Startup, and then clear the 'Process
System.ini File', 'Process Win.ini File', and 'Load Startup Items' check
boxes. Leave the 'boot.ini' boxes however they are currently set.

3. In the Services tab, check the "Hide All Microsoft Services" checkbox,
and then click the "Disable All" button. If you use a third party firewall
then re-check (enable) it. For example, if you use Zone Alarm, re-check the
True Vector Internet Monitor service (and you may also want to re-check
(enable) the zlclient on the Startup tab.) Equivalent services exist for
other third party firewalls. An alternative to this for XP users is to
enable at this time the XP native firewall (Internet Connection Firewall -
ICF). Be sure to turn it back off when you re-enable your non-MS services
and Startup tab programs and restore your normal msconfig configuration
after cleaning your machine.

4. Click OK and then reboot.

For additional information about how to clean boot your operating system,
click the following article numbers to view the articles in the Microsoft
Knowledge Base:
310353 How to Perform a Clean Boot in Windows XP http://support.microsoft.co
m/kb/310353
281770 How to Perform Clean-Boot Troubleshooting for Windows 2000
http://support.microsoft.com/kb/281770/EN-US/
267288 How to Perform a Clean Boot in Windows Millennium Edition
http://support.microsoft.com/kb/267288/EN-US/
192926 How to Perform Clean-Boot Troubleshooting for Windows 98
http://support.microsoft.com/kb/192926/EN-US/
243039 How to Perform a Clean Boot in Windows 95
http://support.microsoft.com/kb/243039/EN-US/
#########IMPORTANT#########


Download and run Stinger.exe, here:
http://download.nai.com/products/mcafee-avert/stinger.exe or from the link
on this page: http://vil.nai.com/vil/stinger/ ME/XP users be sure to read:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm


Download sysclean.com , from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp along with the latest pattern
file, here: http://www.trendmicro.com/download/pattern.asp. Be sure to read
the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt

(You might also want to get Art's updater, SYS-UP.Zip, here for future
updating of these: http://home.epix.net/~artnpeg/). The updater files plus a
short tutorial on using them and SysClean are also available in one package
here: http://www.ik-cs.com/Programs/virtools/SYSCLEAN UTILITY.exe (If you
download and use the updater from the beginning, it will automatically
handle downloading and unziping the other files.)

Place them in a dedicated folder after appropriate unzipping.
Show hidden and system files (HowTo here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)


If you're using WindowsME or WindowsXP, SysClean (and the other cleaning
tools below) may find infections within Restore Points which it will be
unable to clean. You may choose to disable Restore if you're on XP or ME
(directions here:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm) which will
eliminate ALL previous Restore Points, or alternatively, you can wait until
cleaning is completed and then use the procedure within the *********'s
below to delete all older, possibly infected Restore Points and save a new,
clean one. This approach is in the sprit of "keep what you've got" so that
you can recover to an at least operating albeit infected system if you
inadvertently delete something vital, and is the approach I recommend that
you take.

Then boot to Safe mode or a Clean Boot as above (HowTo here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)

Read tscreadme.txt carefully, then do a complete scan of your system
and clean or delete anything it finds. Reboot and re-run SysClean and
continue this procedure until you get a clean scan or nothing further can be
cleaned/removed. Now reboot to normal mode and re-run the scan again.

This scan may take a long time, as Sysclean is VERY extensive and thorough.
For example, one user reported that Sysclean found 69 hits that an
immediately prior Norton AV v. 11.0.2.4 run had missed.


Download and run the free or trial version of A2 Personal, here:
http://www.emsisoft.com/en/ Run from a Clean Boot or Safe Mode with Show
Hidden Files enabled as above.


Sometimes the tools below will find files which they are unable to delete
because they are in use. A program called Copylock, here,
http://noeld.com/programs.asp?cat=misc#CopyLock can aid in the process of
"replacing, moving, renaming or deleting one or many files which are
currently in use (e.g. system files like comctl32.dll, or virus/trojan
files.)" Another is Killbox, here:
http://www.downloads.subratam.org/KillBox.zip
A third which is a bit different but often useful is Delete Invalid File,
here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem


For the general hijack case, the best way to start is to get Ad-Aware SE
Personal Edition, here: http://www.lavasoftusa.com/support/download/.
UPDATE, set it up in accordance with this:
http://forum.aumha.org/viewtopic.php?t=5877 and run this regularly to get
rid of most "spyware/hijackware" on your machine. If it has to fix things,
be sure to re-boot and rerun AdAware again and repeat this cycle until you
get a clean scan. The reason is that it may have to remove things which
are currently "in use" before it can then clean up others.

Then, courtesy of NonSuch at Lockergnome, open Ad-aware then click the gear
wheel at the top and check these options to configure Ad-aware for a
customized scan:

General> activate these: "Automatically save log-file" and "Automatically
quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes",
"Scan registry", "Deep scan registry," "Scan my IE Favorites for banned
sites," and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during
scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister
objects prior to deletion" and "Let Windows remove files in use after
reboot."

Click "Proceed" to save your settings, then click "Start." Make sure
"Activate in-depth scan" is ticked green, then scan your system. When the
scan is finished, the screen will tell you if anything has been found, click
"Next." The bad files will be listed. Right click the pane and click "Select
all objects" - This will put a check mark in the box at the side, click
"Next" again and click "OK" at the prompt "# objects will be removed.
Continue?"

Courtesy of http://www.nondisputandum.com/html/anti_spyware.html: HINT: If
Ad Aware is automatically shut-down by a malicious software, first run
AWCloak.exe, http://www.lavasoftnews.com/downloads/AAWCloak.exe, before
opening Ad Aware. When AAWCloak is open, click "Activate Cloak". Then open
Ad Aware and scan your system.



Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. Tutorial
here: http://www.safer-networking.org/en/index.html I recommend using both
normally. Be sure and use the Default (NOT Advanced or Beta) Mode in
Settings.

After UPDATING and fixing ONLY RED things with SpyBot S&D, be sure to
re-boot and rerun SpyBot again and repeat this cycle until you get a clean
"no red" scan. The reason is that SpyBot sometimes has to remove things
which are currently "in use" before it can then clean up others. Note that
sometimes you need to make a judgement call about what these programs report
as spyware. See here, for example: http://www.imilly.com/alexa.htm

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm


A currently common parasite is some malware called CoolWebSearch. Do the
following:

Download, UPDATE before running, and run:
http://cwshredder.net/bin/CWSInstall.exe from this page:
http://www.intermute.com/spysubtract/cwshredder_download.html (The new v.2+
which will automatically install in C:\Program
Files\InterMute\SpySubtract\CWShredder.exe and put a shortcut on the
Desktop. UPDATE and run the program from this install location or the
shortcut after installation. This recommendation for CWShredder is NOT
automatically a recommendation for the other programs adverstised by
Intermute in conjunction with this install.) or from here:
http://www.aumha.org/downloads/cwshredder.exe (v.2+ standalone) or here:
http://www.softpedia.com/public/scripts/downloadhero/10-17-150/ (v.2+) to
remove the parasite. Try to run from Safe mode or a Clean Boot and be sure
to close ALL other programs to the extent possible, expecially ALL
instances of IE and OE.


There's a good tutorial about CWS and using CWShredder here:
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47#domain See
also: http://cwshredder.net/cwshredder/cwschronicles.html

BE SURE that you get v.1.59.0.1 or later or the new v.2! Note that
CWShredder may make deletions/changes to your HOSTS file (sometimes as false
positives) if you use your HOSTS file as a DNS cache rather than just for ad
blocking, and that after cleanup you may need to restore it with a fresh
copy of any local DNS and/or blocking entries or disable it before running
CWShredder.


You will need to show Hidden files first and then at the end clear the
malware garbage from your System Restore backups after you've cleaned up.
It's best to perform CWShredder (and most other malware fixers too) from
Safe mode and then reboot. AFTER cleaning things up, then you can disable
and then re-enable System Restore. See ******** below.

The following links give instructions on how to do these various functions:


HOW TO Restart in Safe Mode
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339

HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning or
use the suggested procedure for XP at the ******'s)
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039
(WinXP)
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239
(WinME)
or http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm (Both)



Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions if they've been affected (as they probably will have
been).


Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093

which blocks the exploit upon which this parasite family depends.


Lastly, there are extensive, detailed instructions for manual removal of CWS
variants here: http://www.pestpatrol.com/PestInfo/c/cws.asp You may want
to check these to be sure everything's been cleaned up.


When done, go to Start|Run and enter one line at a time (or even easier,
open a DOS box and copy the following in its entirety and then paste it into
the box):

regsvr32 hlink.dll
regsvr32 /i browseui.dll
regsvr32 /i shdocvw.dll
regsvr32 /i mshtml.dll
regsvr32 mshtmled.dll
regsvr32 actxprxy.dll
regsvr32 /i urlmon.dll
regsvr32 scrrun.dll
regsvr32 comcat.dll
regsvr32 Oleaut32.dll
regsvr32 /i Shell32.dll
regsvr32 Msoeacct.dll
regsvr32 "C:\Program Files\Outlook Express\Msoe.dll"
regsvr32 msjava.dll
regsvr32 jscript.dll
regsvr32 Olepro32.dll
regsvr32 Hlink.dll
regsvr32 Asctrls.ocx
regsvr32 Inetcpl.cpl /i
regsvr32 Dxtrans.dll
regsvr32 Dxtmsft.dll
regsvr32 Imgutil.dll
regsvr32 Msxml.dll
regsvr32 Msjava.dll
regsvr32 Jscript.dll
regsvr32 Softpub.dll
regsvr32 Wintrust.dll
regsvr32 Initpki.dll
regsvr32 Dssenh.dll
regsvr32 Rsaenh.dll
regsvr32 Gpkcsp.dll
regsvr32 Slbcsp.dll
regsvr32 Cryptdlg.dll
regsvr32 Msjet40.dll
regsvr32 pdm32.dll
regsvr32 Msjtor40.dll
regsvr32 Dao360.dll
regsvr32 Sccbase.dll


with a Return after each .dll. You'll get a message about successful
completion of the re-registration process after each one, then enter the
next (with the DOS box they'll be continuous except for the last one).

If you use Win98x and get an error on Shell32.dll, ignore it. Only the ME,
Win2k and XP versions of windows have shell32 as an object that needs
registering. (For these earlier operating systems, run "regsvr32
shdoc401.dll " instead of "regsvr32 Shell32.dll".) Depending on your
system, you may also get "not found" error messages on some or all of the
last five - if so, ignore them.

Re-start your computer when you've finished.


If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13 or here:
http://www.bleepingcomputer.com/files/spyware/hijackthis.zip

There's a good "How-to-Use" tutorial here:
http://computercops.biz/HijackThis.html

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Place HijackThis.exe or unzip HijackThis.zip into its own dedicated folder
at the root level such as C:\HijackThis (NOT in a Temp folder or on your
Desktop), reboot to Safe mode, start HT (have ONLY HT running - IE MUST be
closed) then press Scan. Click on SaveLog when it's finished which will
create hijackthis.log. Now click the Config button, then Misc Tools and
click on Generate StartupList.log which will create Startuplist.txt.

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

or Jim Eshelman's site here: http://forum.aumha.org/

or Bleepingcomputer here: http://www.bleepingcomputer.com/

Register if necessary, then sign in and READ THE DIRECTIONS at the beginning
of the particular sites HiJackThis forum, then copy and paste both files
into a message asking for assistance, Someone will answer with detailed
instructions for the removal of your parasite(s). Be sure you include at
the beginning of your post "What problem(s) you're trying to solve" and
"What steps you've already taken."



*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


Once you get this cleaned up, you might want to consider installing Eric
Howes' IESpyAds, SpywareBlaster and SpywareGuard here to help prevent this
kind of thing from happening in the future:

IESpyads - https://netfiles.uiuc.edu/ehowes/www/resource.htm "IE-SPYAD adds
a long list of sites and domains associated with known advertisers,
marketers, and crapware pushers to the Restricted sites zone of Internet
Explorer. Once you merge this list of sites and domains into the Registry,
the web sites for these companies will not be able to use cookies, ActiveX
controls, Java applets, or scripting to compromise your privacy or your PC
while you surf the Net. Nor will they be able to use your browser to push
unwanted pop-ups, cookies, or auto-installing programs on your PC." Read
carefully.

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWareBlaster is not memory resident ... no CPU or memory
load - but keep it UPDATED) The latest version as of this writing will
prevent installation or prevent the malware from running if it is already
installed, and it provides information and fixit-links for a variety of
parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. All three Very Highly Recommended

Next, install and keep updated a good HOSTS file. It can help you avoid
most adware/malware. See here: http://www.mvps.org/winhelp2002/hosts.htm
(Be sure it's named/renamed HOSTS - all caps, no extension) Additional
tutorials here:
http://www.bleepingcomputer.com/forums/index.php?s=14f3f9225081133297a8acdd11137c5b&showtutorial=51
(detailed) and here: http://www.spywarewarrior.com/viewtopic.php?t=410
(overview)

Finally, be sure that you have a good hardware or software firewall and an
AntiVirus installed, and bring your OS up-to-date with ALL Critical updates
from Windows Update.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

Thanx for the fast reply but even the manual process i
just tried doesn't work. Some registry keys I had to
delete where there, some weren't; after deletting them
all in Safe Mode without networking and doing two
Microsoft Anitispyware scans and one Spybot S&D scan plus
a restart the 'WARNING! Microsoft Antispywar Alert!"
dialogs popped up again, asking me to delete IST.ISTbar
Browser Modifier, Sidefind, etc. Hope anyone can help em
further...

-----Original Message-----
I must admit I did the manual removal, rather than the tool removal.

I think my IST.Bar variant comes from the toolbarcash
company (www.toolbarcash), but I am not sure..all i know
is that the symantec tool doesn't work. Thans for ur
reply anyway.

-----Original Message-----
Goto Symantecs' web site and get the removal tool (and instructions
on manual removal).

Hi,

For several days and actually quite a large amount of my
weekend I have tried to remove the IST.Bar. The Microsoft
Antispyware program detects it at start-up, asks me if I
want it removed but after removalI get a page saying that
I have successfully installed the toolbar. I
also continiously get virus warnings from my AntiVirus
program (Norman), plus the following new entries have
appeared in my 'Currently Installed Programs'
list: "AdTools Service", "Sidefind" and "Slotchbar". I
have also tried to use Spybot S&D but that doesn't help
either.

Hoping someone can help me,

Mark Brakel

P.S. I have added the hijackthis report, maybe that'll
help:

--BEGIN---

Logfile of HijackThis v1.99.1
Scan saved at 5:42:40 PM, on 2/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norman\bin\ZANDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRAM FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
C:\Program Files\Norman\bin\NJEEVES.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\AcerGoto.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\RAM Idle\RAM_XP.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0
\gnotify.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnd.exe
C:\Program Files\Norman\bin\ZLH.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\sqgoggpa.exe
C:\WINDOWS\system32\wini.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnf.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Magic Keyboard\MagicKey.exe
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Magic Keyboard\V3D.exe
C:\Program Files\Magic Keyboard\OSD.EXE
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Loesje\My
Documents\Other\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL
=

http://www.fountianofyouth.com
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Bar =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local
Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local
Page =
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-
206D7942484F} - (no file)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-
4ED8E67DBBB8} -

C:\Program Files\SideFind\sfbho.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-
FADC6B084872} - (no

file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-
009027A5CD4F} -

c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-
B72A4567E486} -

C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32
\AcerGoto.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program
Files\RAM

Idle\RAM_XP.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-
b109a192b4c2}] C:\Program

Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon]
C:\Program

Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32
\\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Program
Files\Norman\bin\ZLH.EXE

/LOAD /SPLASH
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft

AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QeAd] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [<°ÜZJÝYMÝlY«Q°aÆ+À¼C:\Program

Files\ISTsvc\istsvc.exe] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [virtual-machine] wini.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program
Files\AdTools

Service\AdTools.exe
O4 - HKLM\..\Run: [IST Service] C:\Program
Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power
Scan\powerscan.exe
O4 - HKLM\..\RunServices: [virtual-machine] wini.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32
\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe"

/background
O4 - HKCU\..\Run: [win-xp] winis.exe
O4 - HKCU\..\Run: [virtual-machine] wini.exe
O4 - HKCU\..\RunServices: [win-xp] winis.exe
O4 - HKCU\..\RunServices: [virtual-machine] wini.exe
O4 - Global Startup: Magic Keyboard.lnk = C:\Program
Files\Magic

Keyboard\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft

Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Control Panel present
O8 - Extra context menu item: &Google Search -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -


res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} -

C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-
B3F6EC39B807} -

C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C}
(Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -

http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {11111111-1111-1111-1111-111111111147} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine

Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C}
(ICSScannerLight

Class) -
http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E}
(Microsoft PID

Sniffer) -
https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B}
(FilePlanet

Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} -

http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
(WUWebControl

Class) -

http://v5.windowsupdate.microsoft.com/v5consumer/V5Contr o l
s/en/x86/client/wuw

eb_site.cab?1097256290328
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClien t ..
cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125}
(mhLabel Class) -

http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539}
(Crucial cpcScan)

- http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46}
(IMDownloader

Class) -
http://www2.incredimail.com/contents/setup/downloader/im l o
ader.cab
O23 - Service: Norman API-hooking helper (NipSvc) -
Unknown owner -

C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner -
C:\Program

Files\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Program

Files\Norman\bin\ZANDA.EXE
O23 - Service: Norman Virus Control on-access component
(nvcoas) - Norman

ASA - C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler
(NVCScheduler) - Norman Data

Defense Systems - C:\PROGRAM
FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32
\HPZipm12.exe

---END---



.

.

 

[Gerry Cornell]

Mark

Try posting your latest (new) HijackThis log here:

http://aumha.net/

The HijackThis logs forum.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~


Thanx for the fast reply but even the manual process i
just tried doesn't work. Some registry keys I had to
delete where there, some weren't; after deletting them
all in Safe Mode without networking and doing two
Microsoft Anitispyware scans and one Spybot S&D scan plus
a restart the 'WARNING! Microsoft Antispywar Alert!"
dialogs popped up again, asking me to delete IST.ISTbar
Browser Modifier, Sidefind, etc. Hope anyone can help em
further...

-----Original Message-----
I must admit I did the manual removal, rather than the tool removal.

I think my IST.Bar variant comes from the toolbarcash
company (www.toolbarcash), but I am not sure..all i know
is that the symantec tool doesn't work. Thans for ur
reply anyway.

-----Original Message-----
Goto Symantecs' web site and get the removal tool (and instructions on
manual removal).

Hi,

For several days and actually quite a large amount of my
weekend I have tried to remove the IST.Bar. The Microsoft
Antispyware program detects it at start-up, asks me if I
want it removed but after removalI get a page saying that
I have successfully installed the toolbar. I
also continiously get virus warnings from my AntiVirus
program (Norman), plus the following new entries have
appeared in my 'Currently Installed Programs'
list: "AdTools Service", "Sidefind" and "Slotchbar". I
have also tried to use Spybot S&D but that doesn't help
either.

Hoping someone can help me,

Mark Brakel

P.S. I have added the hijackthis report, maybe that'll
help:

--BEGIN---

Logfile of HijackThis v1.99.1
Scan saved at 5:42:40 PM, on 2/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norman\bin\ZANDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRAM FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
C:\Program Files\Norman\bin\NJEEVES.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\AcerGoto.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\RAM Idle\RAM_XP.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0
\gnotify.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnd.exe
C:\Program Files\Norman\bin\ZLH.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\sqgoggpa.exe
C:\WINDOWS\system32\wini.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnf.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Magic Keyboard\MagicKey.exe
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Magic Keyboard\V3D.exe
C:\Program Files\Magic Keyboard\OSD.EXE
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Loesje\My
Documents\Other\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL
=

http://www.fountianofyouth.com
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Bar =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local
Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local
Page =
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-
206D7942484F} - (no file)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-
4ED8E67DBBB8} -

C:\Program Files\SideFind\sfbho.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-
FADC6B084872} - (no

file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-
009027A5CD4F} -

c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-
B72A4567E486} -

C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32
\AcerGoto.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program
Files\RAM

Idle\RAM_XP.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-
b109a192b4c2}] C:\Program

Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon]
C:\Program

Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32
\\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Program
Files\Norman\bin\ZLH.EXE

/LOAD /SPLASH
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft

AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QeAd] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [<°ÜZJÝYMÝlY«Q°aÆ+À¼C:\Program

Files\ISTsvc\istsvc.exe] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [virtual-machine] wini.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program
Files\AdTools

Service\AdTools.exe
O4 - HKLM\..\Run: [IST Service] C:\Program
Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power
Scan\powerscan.exe
O4 - HKLM\..\RunServices: [virtual-machine] wini.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32
\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe"

/background
O4 - HKCU\..\Run: [win-xp] winis.exe
O4 - HKCU\..\Run: [virtual-machine] wini.exe
O4 - HKCU\..\RunServices: [win-xp] winis.exe
O4 - HKCU\..\RunServices: [virtual-machine] wini.exe
O4 - Global Startup: Magic Keyboard.lnk = C:\Program
Files\Magic

Keyboard\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft

Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Control Panel present
O8 - Extra context menu item: &Google Search -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -


res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} -

C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-
B3F6EC39B807} -

C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C}
(Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -

http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {11111111-1111-1111-1111-111111111147} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine

Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C}
(ICSScannerLight

Class) -
http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E}
(Microsoft PID

Sniffer) -
https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B}
(FilePlanet

Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} -

http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
(WUWebControl

Class) -

http://v5.windowsupdate.microsoft.com/v5consumer/V5Contr

o

l
s/en/x86/client/wuw

eb_site.cab?1097256290328
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClien

t

..
cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125}
(mhLabel Class) -

http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539}
(Crucial cpcScan)

- http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46}
(IMDownloader

Class) -
http://www2.incredimail.com/contents/setup/downloader/im

l

o
ader.cab
O23 - Service: Norman API-hooking helper (NipSvc) -
Unknown owner -

C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner -
C:\Program

Files\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Program

Files\Norman\bin\ZANDA.EXE
O23 - Service: Norman Virus Control on-access component
(nvcoas) - Norman

ASA - C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler
(NVCScheduler) - Norman Data

Defense Systems - C:\PROGRAM
FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32
\HPZipm12.exe

---END---



.

.

 

[Chuck Wakelee]

Hi,

I was able to stop ist.bar. In the
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run] wbkfassb.exe is in there twice
c:\winnt\wbkfassb.exe and c:\winnt\wbkfassb.exe with 5
hex chars. I killed both. I then searched the registry
for wbkfassb, the fool that put this new varient
together also placed a key "GreatAntiSpywareSoftware" it
think this was the name, I killed the key. Also deleted
the program in c:\winnt\wbkfassb.exe.

I hope this helps,
Chuck Wakelee

 

[Mark Brakel]

Thanx every1 but I think (it may always pop back up
again) that I have solved the issue, this is what I did;

-I *turned of system restore on all drives* (the most
essential procedure as I think my version of the IST.Bar
re-appeared from here) by right-clicking my computer,
selecting properties, clicking the 'system restore' tab
and ticking the box 'turn of system restore on all drives'
-Next i openened msconfig (Run> msconfig, ok) and
selected safeboot under the boot.ini tab.
-In safe mode I went to the control panel selected
add/remove programs and removed any reference to the
spyware (adtools, sidefind, IST bar)
-I then went to the register (run> regedit, ok) and did a
search on IST, istsvc.exe, istbar, sidefind and adtools.
I deleted all keys found and made a back-up.
(file>export)
-Did the same with the Start> Search windows search
engine. Also deleted everything here.
-Then I ran a Microsoft Antispyware scan (Full), a spybot
S&D scan (www.safer-networking.org/en/index.html), a
dclean scan (http://www.xs4all.nl/~mp2004/) to clean
cache, etc., a Norman Anti-Virus scan, i guess any virus
scan will do. and finally another Microsoft Antispyware
Scan (Fast) to check if everything was gone.
- Finally I opened internet explore, went to tools>Reset
Web Settings.
-When the spyware is removed go to msconfig (see
instructions at the top) and deselect safeboot under
boot.ini.
-Restart.
-Do a Microft Anitspyware Scan to dubble check everything
is gone.

Hope this solution will work for others,

Mark Brakel

-----Original Message-----
Mark

Try posting your latest (new) HijackThis log here:

http://aumha.net/

The HijackThis logs forum.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~


Thanx for the fast reply but even the manual process i
just tried doesn't work. Some registry keys I had to
delete where there, some weren't; after deletting them
all in Safe Mode without networking and doing two
Microsoft Anitispyware scans and one Spybot S&D scan plus
a restart the 'WARNING! Microsoft Antispywar Alert!"
dialogs popped up again, asking me to delete IST.ISTbar
Browser Modifier, Sidefind, etc. Hope anyone can help em
further...

-----Original Message-----
I must admit I did the manual removal, rather than the tool removal.

I think my IST.Bar variant comes from the toolbarcash
company (www.toolbarcash), but I am not sure..all i know
is that the symantec tool doesn't work. Thans for ur
reply anyway.

-----Original Message-----
Goto Symantecs' web site and get the removal tool (and instructions on
manual removal).

Hi,

For several days and actually quite a large amount of my
weekend I have tried to remove the IST.Bar. The Microsoft
Antispyware program detects it at start-up, asks me if I
want it removed but after removalI get a page saying that
I have successfully installed the toolbar. I
also continiously get virus warnings from my AntiVirus
program (Norman), plus the following new entries have
appeared in my 'Currently Installed Programs'
list: "AdTools Service", "Sidefind" and "Slotchbar". I
have also tried to use Spybot S&D but that doesn't help
either.

Hoping someone can help me,

Mark Brakel

P.S. I have added the hijackthis report, maybe that'll
help:

--BEGIN---

Logfile of HijackThis v1.99.1
Scan saved at 5:42:40 PM, on 2/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norman\bin\ZANDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRAM FILES\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nipsvc.exe
C:\Program Files\Norman\bin\NJEEVES.EXE
C:\PROGRAM FILES\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\AcerGoto.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\RAM Idle\RAM_XP.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0
\gnotify.exe
C:\WINDOWS\soundman.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnd.exe
C:\Program Files\Norman\bin\ZLH.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\sqgoggpa.exe
C:\WINDOWS\system32\wini.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-
Web\hpgs2wnf.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Magic Keyboard\MagicKey.exe
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\Magic Keyboard\V3D.exe
C:\Program Files\Magic Keyboard\OSD.EXE
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Loesje\My
Documents\Other\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL
=

http://www.fountianofyouth.com
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Bar =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R1 - HKCU\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =

http://www.couldnotfind.com/search_page.html?
&account_id=157986
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local
Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local
Page =
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-
206D7942484F} - (no file)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-
4ED8E67DBBB8} -

C:\Program Files\SideFind\sfbho.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-
FADC6B084872} - (no

file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-
009027A5CD4F} -

c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-
B72A4567E486} -

C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32
\AcerGoto.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program
Files\RAM

Idle\RAM_XP.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-
b109a192b4c2}] C:\Program

Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon]
C:\Program

Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32
\\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Program
Files\Norman\bin\ZLH.EXE

/LOAD /SPLASH
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft

AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QeAd] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [<°ÜZJÝYMÝlY«Q°aÆ+À¼C:\Program

Files\ISTsvc\istsvc.exe] C:\WINDOWS\sqgoggpa.exe
O4 - HKLM\..\Run: [virtual-machine] wini.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program
Files\AdTools

Service\AdTools.exe
O4 - HKLM\..\Run: [IST Service] C:\Program
Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power
Scan\powerscan.exe
O4 - HKLM\..\RunServices: [virtual-machine] wini.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32
\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN
Messenger\msnmsgr.exe"

/background
O4 - HKCU\..\Run: [win-xp] winis.exe
O4 - HKCU\..\Run: [virtual-machine] wini.exe
O4 - HKCU\..\RunServices: [win-xp] winis.exe
O4 - HKCU\..\RunServices: [virtual-machine] wini.exe
O4 - Global Startup: Magic Keyboard.lnk = C:\Program
Files\Magic

Keyboard\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft

Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet
Explorer\Control Panel present
O8 - Extra context menu item: &Google Search -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -


res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://C:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF- AAA5-
00401C608501} -

C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-
B3F6EC39B807} -

C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Turbo Memory Charger -

{ECC5778A-6E89-BFCE-13CE-81F134789E7B} -

C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2- BB9E-
00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C}
(Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -

http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {11111111-1111-1111-1111-111111111147} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine

Advantage Validation Tool) -

http://go.microsoft.com/fwlink/? linkid=34738&clcid=0x409
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C}
(ICSScannerLight

Class) -
http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E}
(Microsoft PID

Sniffer) -
https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B}
(FilePlanet

Download Control Class) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.ca b
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} -

http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
(WUWebControl

Class) -

http://v5.windowsupdate.microsoft.com/v5consumer/V5Cont

r

o

n

t

m

l


.

.

 

[Alexander Graf]

Hi,

since I had the exact same problem I rather quarantened the downloader (in
your case wbkfassb.exe) so MS can add it to their specs...

I'll attach it here in the hope someone from MS will read this post.

PS: Please do _not_ execute the attached files if you don't know what you're
doing ;-)

Regards,
Alexander Graf

 

[Gerry Cornell]

Alexander

Not that I want a copy but Outlook Express automatically removed the
unsafe attachment!

--


Regards.

Gerry

~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~

Hi,

since I had the exact same problem I rather quarantened the downloader
(in
your case wbkfassb.exe) so MS can add it to their specs...

I'll attach it here in the hope someone from MS will read this post.

PS: Please do _not_ execute the attached files if you don't know what
you're
doing ;-)

Regards,
Alexander Graf

Hi,

I was able to stop ist.bar. In the
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run] wbkfassb.exe is in there twice
c:\winnt\wbkfassb.exe and c:\winnt\wbkfassb.exe with 5
hex chars. I killed both. I then searched the registry
for wbkfassb, the fool that put this new varient
together also placed a key "GreatAntiSpywareSoftware" it
think this was the name, I killed the key. Also deleted
the program in c:\winnt\wbkfassb.exe.

I hope this helps,
Chuck Wakelee

 

[Bill Sanderson]

Alexander - thanks for trying to be helpful, but please don't do this. It
can be dangerous to other folks in the groups and annoying to those on slow
dialup connections. If you provide email contact information, we can get in
touch with you and get the file to Microsoft.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

Hi,

since I had the exact same problem I rather quarantened the downloader (in
your case wbkfassb.exe) so MS can add it to their specs...

I'll attach it here in the hope someone from MS will read this post.

PS: Please do _not_ execute the attached files if you don't know what
you're
doing ;-)

Regards,
Alexander Graf

Hi,

I was able to stop ist.bar. In the
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run] wbkfassb.exe is in there twice
c:\winnt\wbkfassb.exe and c:\winnt\wbkfassb.exe with 5
hex chars. I killed both. I then searched the registry
for wbkfassb, the fool that put this new varient
together also placed a key "GreatAntiSpywareSoftware" it
think this was the name, I killed the key. Also deleted
the program in c:\winnt\wbkfassb.exe.

I hope this helps,
Chuck Wakelee

 

[Steve Wechsler [MVP]]

It's the Win32.SillyDl.FH trojan. And, it should have been deleted by now.

Steve Wechsler (akaMowGreen)

MS-MVP 2004-2005
Windows Server - Software Distribution
Windows - Security

Hi,

since I had the exact same problem I rather quarantened the downloader (in
your case wbkfassb.exe) so MS can add it to their specs...

I'll attach it here in the hope someone from MS will read this post.

PS: Please do _not_ execute the attached files if you don't know what you're
doing ;-)

Regards,
Alexander Graf

Hi,

I was able to stop ist.bar. In the
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run] wbkfassb.exe is in there twice
c:\winnt\wbkfassb.exe and c:\winnt\wbkfassb.exe with 5
hex chars. I killed both. I then searched the registry
for wbkfassb, the fool that put this new varient
together also placed a key "GreatAntiSpywareSoftware" it
think this was the name, I killed the key. Also deleted
the program in c:\winnt\wbkfassb.exe.

I hope this helps,
Chuck Wakelee