Unable to rid sys of ISTBAR - Help

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Sport9155, Jan 1, 2005.

  1. Sport9155

    Sport9155 Private E-2

    I have been trying to remove Istbar, with no luck. I have tried the remover from Symantec and it tells me that Istbar is not present.
    I run ADware and have it remove what it finds, but as soon as I reboot its back.
    I have followed yourj first step of instructions all the way through and Istbar still keeps comming back after rebooting. I have even tried to remove it manulally, but still no go.
    I am definitely in need of some help at this point. What can you suggest.
     
    Sport9155, Jan 1, 2005
    #1
  2. Novice

    Novice MajorGeek

    It is standard procedure to ask everyone to read the sticky's at the top of this forum page, follow all suggestions and advice, and then repost if the problem still exists! Welcome to MajorGeeks. :)
     
    Novice, Jan 1, 2005
    #2
  3. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.

    NOTE: In order to resolve the issues you are having it is very important that you at least try to perform all the steps as outlined. If you have any difficulty please post back letting us know what steps you have completed, what you found while doing the scans if anything and details about any problems you have encountered in completing the steps. The more details you can provide the better.

    After doing ALL of the above if you still have a problem:

    Make sure you have HijackThis 1.99 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

    Now post a HijackThis as a .txt file attachment to your message. All running programs should be closed,including your web browser, e-mail. Close before running Hijack This!

    Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT
     
    bjgarrick, Jan 1, 2005
    #3
  4. NEWGEEK2005

    NEWGEEK2005 Private E-2

    I have the same problem, i need help, the deskbar keep popping up and down and i don't know how to get rid of it. I tried everything also, but everytime i reboot, it comes back..SO ANNOYING!
     
    NEWGEEK2005, Jan 1, 2005
    #4
  5. NEWGEEK2005

    NEWGEEK2005 Private E-2

    SAME PROBLEM!...I NEED HELP i can't get rid of the deskbar behind the taskbar!!
     
    NEWGEEK2005, Jan 1, 2005
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    chaslang, Jan 2, 2005
    #6
  7. Sport9155

    Sport9155 Private E-2

    I have followed all actions suggested in the Stickey postings, and Adware still tells me I have ISTbar (IST Service) after rebooting. I am attaching the hijackthis log file. I have also tried the Symantec remover and it tells me that ISTbar was not found. Even if I boot up in safe mode and delete all traces of "ISTServices" from the registry and then delete the folder from c:\programs\ it still comes back after the reboot. I would rather not format the system partition, so I'm hopping that you will be able to guide me through this.
     

    Attached Files:

    Sport9155, Jan 2, 2005
    #7
  8. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Ok, lets start by removing the files, follow below:

    1) Boot into Safe Mode

    2) Be sure you have "View hidden files and folders" enable per the tutorial, Now go into the directory C:\Program Files and locate the folder below:

    C:\Program Files\ISTsvc <--- Delete the whole folder!

    3) Now go into the directory C:\WINDOWS\system32 and locate the file mfcwj32.dll and delete it.

    4) Reboot, and run HJT again, have it fix the below entries, Remember to close all browsers before fixing anything with HJT!

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
    R3 - Default URLSearchHook is missing (NOTE: Reset web settings after removal of this entry)
    O2 - BHO: (no name) - {08211965-D6A7-563C-FBDA-97E9626FA453} - C:\WINDOWS\system32\mfcwj32.dll
    O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
    O15 - Trusted Zone: *.frame.crazywinnings.com
    O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
    O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing)

    After removing these entries, reboot and post new log. Thanks!

    Let me know how things are running after this!
     
    bjgarrick, Jan 2, 2005
    #8
  9. PhilliePhan

    PhilliePhan Guest

    O4 - HKLM\..\Run: [760X8OQ] C:\WINDOWS\nhktmy.exe
    C:\WINDOWS\nhktmy.exe

    This looks iffy as well.
     
    PhilliePhan, Jan 2, 2005
    #9
  10. Sport9155

    Sport9155 Private E-2

    I went through the directions as listed and it still came back. But I think that Phillie may have something as now the file he has referenced is showing up with the IST.

    Have a look.
     

    Attached Files:

    Sport9155, Jan 2, 2005
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file move.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.)

    Double-click on the move.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to merge say yes.


    If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
    For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

    Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side.
    Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click     yes.
    C:\WINDOWS\nhktmy.exe
    C:\WINDOWS\system32\mswin32.cmd
    C:\Program Files\ISTsvc\istsvc.exe

    After killing all the above processes, click "Back".
    Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R3 - Default URLSearchHook is missing
    O4 - HKLM\..\Run: [760X8OQ] C:\WINDOWS\nhktmy.exe
    O4 - HKLM\..\Run: [WinTimer] "C:\WINDOWS\system32\mswin32.cmd"
    O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
    O4 - HKLM\..\Run: [7609¿Ì*ú]Mú*ÀaîžaaøC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\nhktmy.exe

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\WINDOWS\nhktmy.exe
    C:\WINDOWS\system32\mswin32.cmd
    C:\Program Files\ISTsvc\istsvc.exe

    Now reboot in normal mode and post a new HJT log. And tell us how things are working.
     
    chaslang, Jan 3, 2005
    #11
  12. Sport9155

    Sport9155 Private E-2

    I believe we are getting really close here, there just seems to be one line that keeps poping back after a reboot and it is referencing nhktmy.exe. Although, I have deleted as you asked. :)
     

    Attached Files:

    Sport9155, Jan 3, 2005
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The nhktmy.exe process does not appear to be loading. It may be a damage registry key.
    See if this folder is on your PC:
    C:\Program Files\ISTsvc

    If so, delete it. (Let me know)

    Boot into safe mode and have HJT fix:
    O4 - HKLM\..\Run: [7609¿Ì*ú]Mú*ÀaîžaaøC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\nhktmy.exe

    Then reboot and run HJT. See if the line is gone or did it come back.
     
    chaslang, Jan 3, 2005
    #13
  14. Sport9155

    Sport9155 Private E-2

    The folder C:\Program Files\ISTsvc was not there.
    But, line "O4 - HKLM\..\Run: [7609¿Ì*ú]Mú*ÀaîžaaøC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\nhktmy.exe"
    did come back.
     
    Sport9155, Jan 3, 2005
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Make sure you have these options set as follows (tell me if you have all of then set this way or not):
    Click Start and Select Explore
    Select the Tools menu and click Folder Options.
    Select the View Tab.
    Under the Hidden files and folders heading select Show hidden files and folders.
    Uncheck the Hide extensions for known file types option.
    Uncheck the Hide protected operating system files (recommended) option.
    Click Apply.
    Click OK.

    Using Windows Explorer can you see: C:\WINDOWS\nhktmy.exe

    Download GetService.zip from here: Getservice.zip

    Extract the file to a folder where you can find it, then go to the folder and double-click on the getservices.bat file. A notepad will open up. Please paste the contents of that notepad file as an attachment too. Call it service.txt.
     
    chaslang, Jan 3, 2005
    #15
  16. Sport9155

    Sport9155 Private E-2

    Folder settings are and were, the way you have specified so no changes there.
    This file, C:\WINDOWS\nhktmy.exe, does not exist. The only spot I can see that this is referenced at all is as a prefetch.

    Not sure about the last service noted, "Zeta" that file does not even exist anymore.
     

    Attached Files:

    Sport9155, Jan 4, 2005
    #16
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That's funny! Zeta did not appear in your previous HJT log. Check a log right now. If you find a line like this:
    O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing)

    Have HJT fix it. The take a look at the output from GetServices again and make sure it is gone.

    Click Start, Run, and enter regedit and click OK. This brings up the registry editor.

    Click Edit and Select Find then enter istsvc.exe to look for that O4 entry in your registry. It may be corrupted and that is why HJT cannot fix it. See what you find under the following registry key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

    also look in

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

    Also check for nhktmy.exe
     
    Last edited: Jan 4, 2005
    chaslang, Jan 4, 2005
    #17
  18. Sport9155

    Sport9155 Private E-2

    Zeta does not appear in the HJT log, but does show up in the serviceslog again.
    The 04 entry does show up in
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    But not in
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

    nhktmy.exe was found in the following keys:
    HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603 with a value name of 000 and the value nhktmy.exe

    again in
    HKEY_USERS\S-1-5-21-1960408961-413027322-682003330-1004\Software\Microsoft\Search Assistant\ACMru\5603
     
    Sport9155, Jan 4, 2005
    #18
  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Download Erunt , install it and use it to backup your registry before continuing. Then do the below steps.

    Run regedit again and delete the zeta entry in the following key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

    Do not delete the Run key, make sure you have Zeta selected in the right window pane. Right click on it and select delete.


    For the nhktmy.exe problem, select the following registry key:

    HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603
    make sure the bottom of the regedit shows that full path and then right click on it and select delete.

    Repeat for:

    HKEY_USERS\S-1-5-21-1960408961-413027322-682003330-1004\Software\Microsoft\Search Assistant\ACMru\5603
     
    chaslang, Jan 5, 2005
    #19
  20. Sport9155

    Sport9155 Private E-2

    Deleted the following:
    HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603

    But,
    HKEY_USERS\S-1-5-21-1960408961-413027322-682003330-1004\Software\Microsoft\Search Assistant\ACMru\5603, Did not exist, could it have been removed by me deleting the previous key first?

    Zeta did not exit here, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    But did find it referenced:
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ZESOFT\0000, as two values DeviceDesc, and Service
    Also here
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ZESOFT,
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_ZESOFT\0000,
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_ZESOFT\0000,
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ZESOFT,
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZESOFT\0000,
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZESOFT,

    Should I be deleting all these keys?
     
    Sport9155, Jan 5, 2005
    #20
  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes as long as you did the registry backup with Erunt, delete those ZESOFT entries. They are part of how the service itself was setup.
     
    chaslang, Jan 5, 2005
    #21
  22. Sport9155

    Sport9155 Private E-2

    When I tried to delet the following I would get an error saying that these were not deleted:

    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_ZESOFT\0000,
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_ZESOFT\0000,
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZESOFT\0000
    Basicaly the the ones that were not noted with legacy could be deleted and the others could not. It did how ever remove the zesoft entry from the serviceslog.
    One strange thing though, that one 04 entry from HJT that is located at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run keeps comming back.
     
    Sport9155, Jan 5, 2005
    #22
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Get into regedit again and for the above ZESOFT entries:
    Right click on the key name to highlight it and select Permission menu option. Then in the Security windows. Click Advanced . Now click on each user (one at a time) and click the Edit button. The make sure everyone has a check mark on "full control". Then press apply and ok and attempt to delete the key again.

    When we get all of this deleted try fixing the O4 line in HJT. Then reboot and rescan. See if it is gone.
     
    chaslang, Jan 6, 2005
    #23
  24. Sport9155

    Sport9155 Private E-2

    All seems to be in the clear now, I can scan the system and get a clean bill of health. I would like to thank you for all your help, I could not of avoided a reinstall with out your help.

    Thank you again. :)
     
    Sport9155, Jan 6, 2005
    #24
  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    chaslang, Jan 6, 2005
    #25

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds