Unable to get rid of spyware

Hello,
here is my problem.
Every time windows starts, these pop-up windows appear:
http://www.hot.ee/alex99/other/errors/script_error.gif

http://www.hot.ee/alex99/other/errors/script_error2.gif

I close them, but they appear every minute.

And my AdAware Ad-Watch detects these changes in registry:
http://www.hot.ee/alex99/other/errors/adwatch.gif

As you see this is ISTbar and some file named pffffgsy.exe.

I have WinPatrol programm as well and every minute it shows these windows:

http://www.hot.ee/alex99/other/errors/winpatrol3.gif

http://www.hot.ee/alex99/other/errors/winpatrol.gif

http://www.hot.ee/alex99/other/errors/winpatrol2.gif

I press No, but they appear all the time.

This is the list of my startup programs:

http://www.hot.ee/alex99/other/errors/startup.gif

Besides, when i want to go to microsoft.com site, browser redirects me to the msn.com page. Same happens when i just enter the word "microsoft" in any search engine.
Second problem is when i wanna open a link in new IE window, blank page appears and nothnig is loading.

Here is what I have tried already:
Download and scanned my PC with the latest versions of Ad-Aware Professional, SpyBot, SpySweeper, SpyWare Guard, Aluria Spyware Eliminaror.
Scanned my PC with BitDefender & Norton Antivirus too.
Ad-Aware & SpyBot find ISTbar and delete it (as they say so), but every time i restart computer it appears again!
I tried to delete ISTsvc folder manually from Program Files and from startup programs but it reappears again every time.
Please, help!

 

Download and install Microsoft® Windows AntiSpyware during the install make sure you get any updates BUT BEFORE YOU START THE SCAN: Print or save these instructions locally now because you will have to be disconnected with no browsers open in the following steps.

Please make sure ALL Browser Windows are Closed and also you should physically disconnect from the Internet by unplugging your cable. Do not reconnect or open a browser again until requested.

Now allow the Microsoft Antispyware program to run a full scan. After it completes, reboot again in normal boot mode and continue the below steps.




http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

Thanx for reply.
I tried to download Microsoft Anti-Spyware before and I tried again to follow your links to download MS Anti-Spyware (http://www.majorgeeks.com/download4466.html), but when new page starts to load it redirects immediatly to the msn.com page.
As i said before already, every time when i want to go to microsoft site, browser redirects me to the msn.com page. Same happens when i just enter the word "microsoft" in any search engine. I can't change it or get rid of it, it just doesn't allow me to open any microsoft pages.

And i found that i can't even post HijackThis log as attachment here, because, when i press Manage Attachments button, empty pop-up window opens and nothing happens. So sorry for breaking rules, but i post it as a link:
http://www.hot.ee/alex99/other/errors/hijackthis.log

 

The first thing that jumps out at me is that your OS is WAY out dated. After we get you cleaned up I suggest your going to windows updates and getting updated. You need to install Service Pack 2 for security purposes and other reasons.

But first lets see if we can knock some of this out so we can get your browser fixed.

Please look in Add or Remove Programs for the following and Uninstall them if found:

Istbar or IstSVC

Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

sox1.exe

C:\WINDOWS\svchost.exe

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - Default URLSearchHook is missing

O2 - BHO: - {1E6CE4CD-161B-4847-B8BF-E2EF72299D69} - C:\WINDOWS\System32\ib10.dll

O4 - HKLM\..\Run: [sox] C:\WINDOWS\System32\sox1.exe
O4 - HKLM\..\Run: [9as0Ô] C:\WINDOWS\pffffgsy.exe
O4 - HKLM\..\Run: [9as0Ô@Ô
ü]mú*^aæœQ?C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\pffffgsy.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe

O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)

O16 - DPF: {41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} (HHCtrl Object) - http://66.66.129.65:8180/006/hhctrl.ocx

O23 - Service: Aluria Spyware Eliminator Service (ASEService) - Unknown owner - C:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe (file missing)

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\Program Files\ISTsvc ←–– Delete this whole folder if it exist!

C:\WINDOWS\System32\sox1.exe

C:\WINDOWS\System32\ib10.dll

C:\WINDOWS\pffffgsy.exe

C:\WINDOWS\svchost.exe
Not to be confused with the legitamate C:\WINDOWS\system32\svchost.exe

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

Reboot to Normal Windows

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


After doing ALL of the above,

Download & Run this removal tool:
IstBar Removal Tool

After running this removal tool,
Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!

 

Thanx a lot bjgarrick! Your instructions relly helped me! Now everything works fine.
After all these procedures popups & error messages don't appear anymore. Internet Explorer actually still did't want to open links in new window, but i repaired it by going to Control Panel/Add-Remove Programs/ then i pressed add/remove Internet Explorer then FIX button. So now everything is workin even faster than before. You are genius, how do u know all that stuff? Because i was ready to reinstall Windows already, but now i don't need to do this.
I have printed your instructions and i recommend everyone to print this and put it on a wall, because noone could explain it better.
I wonder, what were these files sox1.exe, svchost.exe and pffffgsy.exe?
And these:
O16 - DPF: {41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} (HHCtrl Object)
O2 - BHO: - {1E6CE4CD-161B-4847-B8BF-E2EF72299D69} - C:\WINDOWS\System32\ib10.dll

And what should i do in order to avoid this situation again?
What programs should i chose to protect myself?
Now I use these programs for real-time protection:
MS Anti-Spyware
Outpost Firewall
Norton Antivirus 2005

And i have Ad-Aware and SpyBot programs aswell.

Now I post up my new HijackThis log.

 

Your current HJT log is clean!

Those items you mentioned are baddies! They come from browsing the web un-protected. Now that we have you cleaned up you need to do the below steps to prevent your from becoming reinfected.

1)Go to Windows Updates and download ALL critical updates.
Note: Be sure you install Service Pack 2

2)For protection see the thread below for a list of free programs.

How to Protect yourself from malware!

Browse Safely!