ISTBAR

  • Thread starter Thread starter Walter
  • Start date Start date
W

Walter

The MS AntiSpy is working and finds the ISTBAR and other
related files and reg entries. But it keeps coming back :(
I have searched the registery and harddrive for
IST.ISTBAR, XRENOLDER, ISTSVC, IST.SLOTHBAR,
IST.XXXTOOLBAR, AUPDATE.* (.EXE, .CONF, .TRK) AND
PUGI.PUGIOBJ. DELETE COOKIES, DELETE TMP FILES, REBOOT, IT
STILL COMES BACK. ANY SUGGESTIONS?
 
ISTBAR is a difficult virus to remove entirely. There
are a number of files associated with the virus and the
Microsoft antispy software does not remove all of them.
I am doing all of this from memory, so bare with me.
This virus is associated with troj_istbar.sj and
troj_istbar.cm (again, from memory, so don't shoot me on
this one). Also, there is an associated file that needs
to be removed in the HARDDRIVE:\windows folder named
UFLFY.EXE. Delete that and also regedit search it and
delete it as well if it is in the Registry.

Also, (now this is weird), check the rundll32.exe file to
see if it has been corrupted or modified. This can happen
with ISTBAR too. There is a good technical write up
on this virus at the TRENDMICRO website.

Good luck.
 
-----Original Message-----
The MS AntiSpy is working and finds the ISTBAR and other
related files and reg entries. But it keeps coming back : (
I have searched the registery and harddrive for
IST.ISTBAR, XRENOLDER, ISTSVC, IST.SLOTHBAR,
IST.XXXTOOLBAR, AUPDATE.* (.EXE, .CONF, .TRK) AND
PUGI.PUGIOBJ. DELETE COOKIES, DELETE TMP FILES, REBOOT, IT
STILL COMES BACK. ANY SUGGESTIONS?
.
Click to expand...
I am having the same problem, only when I removed the
IST.ISTbar browser modifier my Internet explorer crashed
and totally will not load any pages. On the other hand
though my Mozilla Firefox works, it just constantly comes
up with popups from windows telling me the page is
encrypted and would I like to continue. If I
click "Cancel" Mozilla crashes, if I click "Ok" it goes to
where I want it to
 
Back
Top