IST service...major problem, pls help!!!

Please read the announcement and sticky threads. HJT logs should only be posted when requested and then they must be attachments to your message. Also standard cleanup procedures must be follow first.

You must also use only one antivirus application. So pick which of the three you want (AVG7, AntiVir, or Kasperksy) and uninstall the others. Do this before continuing.

Please run the steps below.

- Download and run the tool given here: http://symantec.com/avcenter/venc/data/adware.istbar.html

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem, boot into normal mode and make sure you follow these directions:


- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

 

It would be a good idea (as stated in the stickies) to not have the below running when using HijackThis.
C:\Documents and Settings\hansom\My Documents\Downloads\Programs\Bit Tornado\BitTornado\btdownloadgui.exe
C:\Documents and Settings\hansom\My Documents\Downloads\Programs\eMule\emule.exe
C:\Program Files\Mozilla Firefox\firefox.exe

You seem to have both AVG7 and AntiVir install. You should use only one antivirus application. Uninstall AntiVir (it looks like it was not installed or uninstalled properly anyway.)

Download LSP - Fix

Run LSP-Fix.

Check the Box labeled "I know what I'm doing" and then click on the xfire_lsp_9028.dll file (in the “Keep” section) to select it.

Then, Select the >> button to move xfire_lsp_9028.dll into the Remove section.

Now, click the Finish Button. When the Repair Summary box appears, click OK.
If it is already in the Remove section, just click Finish.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKLM\..\Run: [rdIqv] C:\WINDOWS\ndhmgw.exe
O4 - HKLM\..\Run: [rdIqvùõš/‚²ÆßfÏNbC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\ndhmgw.exe
O4 - HKLM\..\Run: [xgctvu] c:\windows\system32\kgdgqsw.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O15 - Trusted Zone: *.boxsearch.net
O15 - Trusted Zone: *.brdatahost.com

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\ISTsvc <--- the whole folder
C:\WINDOWS\ndhmgw.exe
c:\windows\system32\kgdgqsw.exe
If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

Sometimes you will not find files because HJT has already deleted them.
You are going to have to disable Ad-Aware's Ad-watch (or possibly uninstall Ad-Aware). I believe it is blocking some changes. Then repeat my previous instructions because all the registry entries are still there.

Does Antivir appear in Add/Remove programs? If so, try to uninstall it.

 

Ad-Aware is not uninstalled. I still see Ad-Watch in your log and it will block changes.

O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"

You must uninstall all of Ad-Aware including Ad-Watch and leave it uninstalled until we finish.
I may be a good idea to also uninstall PestPatrol for the same reasons.

O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PestPatrol\PPControl.exe

After uninstalling both of them double check to make sure you do not see either of them in your HJT log. Then continue with the below.

I want to first get rid of the below from AntiVir:
O23 - Service: AntiVir Update (AVWUpSrv) - Unknown owner - F:\Downloads\Programs\Spyware\AVWUPSRV.EXE (file missing)


Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
On the page that opens, scroll down to AntiVir Update (if that is not found, look for: AVWUpSrv). Then right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.


Next, run HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste the following into the box that opens, and press "OK":

AntiVir Update

If that does not work, use the short name: AVWUpSrv

Now exit HJT and do not reboot if it asks you to do so.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Now restart HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKLM\..\Run: [rdIqvùõš/‚²ÆßfÏNbC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\ndhmgw.exe
O4 - HKLM\..\Run: [xgctvu] c:\windows\system32\kgdgqsw.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete (make sure you tell me the results for each of these):
C:\Program Files\ISTsvc <--- delete the whole folder
C:\WINDOWS\ndhmgw.exe
c:\windows\system32\kgdgqsw.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

Everything is "sweet"! How is it running?

If everything is okay, it is time for you to reinstall Ad-Aware and work thru the below:

How to Protect yourself from malware!