What is ISTbar and how to remove this spyware
ISTbar is a malicious Internet Explorer search toolbar that hijacks a web browser by changing its default home and start pages and modifying related settings. It also adds numerous bookmarks leading to advertising resources, displays undesirable pop-up advertisements and pornographic content. ISTbar downloads and installs multiple third-party adware and spyware parasites without asking for user permission. It has the ability to silently update itself via the Internet. ISTbar is usually installed by some infamous advertising and pornographic web sites. The parasite automatically runs on every Windows startup.
How to remove ISTbar - Remove ISTbar
Instructions
|
Kill the following processes a834d85b5062f849e461b71c20bf78f8.exe, bb.exe, bundleinstall.exe, cxtpls_loader_ff.exe, dust.exe, games.exe, iinstall.exe, ist.exe, istinstall_154074.exe, istsvc[1].exe, l9lecc.exe, mcinstl.exe, penmzp.exe, ist_install.exe, istdnld.exe, naughty_setup.exe, naughtyplayer.exe, optimize.exe, istsvc.exe, mediaaccess.exe, mediaacck.exe, radio.exe, scan.exe, srcle32.exe, ssdbkup.exe, 70tovmto.exe, espam.exe, fon14100.exe, fyd.exe, msbb.exe, mscache.exe, penoghih.exe, ap9h4qmo.exe, aupdate.exe, aupdate_uninstall.exe, bln02nqv.exe, dbm42.exe, dgrdntld.exe, gamma.exe, kmisxk.exe, loudc.exe, mqtqtz32.exe, msyutils.exe, nah.exe, trkgif.exe, unregister.exe, tinybar.exe, unstsa3.exe, trojandownloader.win32.istbar.aj.exe, trojandownloader.win32.istbar.aj[2].exe, trojandownloader.win32.istbar.bm.exe, trojandownloader.win32.istbar.bp.exe, trojandownloader.win32.istbar.bu.exe, trojandownloader.win32.istbar.bx.exe, trojandownloader.win32.istbar.cl.exe, trojandownloader.win32.istbar.i.exe, trojandownloader.win32.istbar.u.exe, uveu42at.exe, ymhfvu.exe |
|
Unregister the following DLLs and reboot csearch.dll, intrigue.dll, istbar_mainstream[1].dll, lhqibp.dll, mcinstl.dll, msbe.dll, trojandownloader.win32.istbar.ap.dll, trojandownloader.win32.istbar.dh_(40).dll, trojandownloader.win32.istbar.p.dll, vic32.dll, ysbactivex.dll. flashplayer.dll, gzlib.dll in c:\spedia\ mediaaccc.dll in Program Files\media access\ mscache.dll, nem218.dll in Windows\ acsproxy.dll, fwntoolbar.dll, imgconv.dll, istbar.dll, srchbar.dll in Windows\system32\ istbar.dll in Windows\system\ istbar.dll in Windows\temp\
|
|
Delete these registry entries HKEY_CLASSES_ROOT\appid\loaderx.exe HKEY_CLASSES_ROOT\clsid\ HKEY_CLASSES_ROOT\clsid\ HKEY_CLASSES_ROOT\clsid\ HKEY_CLASSES_ROOT\clsid\ HKEY_CLASSES_ROOT\clsid\ HKEY_CLASSES_ROOT\clsid\ HKEY_CLASSES_ROOT\clsid\ HKEY_CLASSES_ROOT\interface\ HKEY_CLASSES_ROOT\istactivex.installer HKEY_CLASSES_ROOT\istactivex.installer.2 HKEY_CLASSES_ROOT\istactivex.installer\curver istactivex.installer.2\url search optimization HKEY_CLASSES_ROOT\istbar.barobj HKEY_CLASSES_ROOT\istx.installer HKEY_CLASSES_ROOT\mediaaccess.installer HKEY_CLASSES_ROOT\mediaaccx.installer\clsid\ HKEY_CLASSES_ROOT\mediaaccx.installer\mediaaccx.installer HKEY_CLASSES_ROOT\pugi.pugiobj HKEY_CLASSES_ROOT\typelib\ HKEY_CLASSES_ROOT\typelib\ HKEY_CLASSES_ROOT\typelib\ HKEY_CLASSES_ROOT\typelib\ HKEY_CLASSES_ROOT\typelib\ HKEY_CLASSES_ROOT\typelib\ HKEY_CLASSES_ROOT\typelib\ HKEY_CLASSES_ROOT\ysbactivex.installer HKEY_CURRENT_USER\softwarestbar HKEY_CURRENT_USER\software\iesearchbar HKEY_CURRENT_USER\software\ist HKEY_CURRENT_USER\software\ist_exe_start HKEY_CURRENT_USER\software\istbar HKEY_CURRENT_USER\software\microsoft\internet explorer\extensions\cmdmappinge42047-deb9-4535-a118-b3f6ec39b807 HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\ HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\ HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\faa356e4-d317-42a6-ab41-a3021c6e7d52 HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\ms aupdate HKEY_LOCAL_MACHINE\hardware\resourcemap\pnp manager\pnpmanager\device\resource008659.raw HKEY_LOCAL_MACHINE\hardware\resourcemap\pnp manager\pnpmanager\device\resource008659.translated HKEY_LOCAL_MACHINE\software\classes\clsid\ HKEY_LOCAL_MACHINE\software\classes\clsid\ HKEY_LOCAL_MACHINE\software\classes\clsid\ HKEY_LOCAL_MACHINE\software\classes\clsid\ HKEY_LOCAL_MACHINE\software\classes\imgconv.clsimgconv HKEY_LOCAL_MACHINE\software\classes\interface\ HKEY_LOCAL_MACHINE\software\classes\interface\ HKEY_LOCAL_MACHINE\software\classes\interface\ HKEY_LOCAL_MACHINE\software\classes\interface\ HKEY_LOCAL_MACHINE\software\classes\interface\ HKEY_LOCAL_MACHINE\software\classes\interface\ HKEY_LOCAL_MACHINE\software\classes\interface\ HKEY_LOCAL_MACHINE\software\classes\istactivex.installer HKEY_LOCAL_MACHINE\software\classes\istactivex.installer.2 HKEY_LOCAL_MACHINE\software\classes\istactivex.installer\clsid HKEY_LOCAL_MACHINE\software\classes\istactivex.installer\curver HKEY_LOCAL_MACHINE\software\classes\typelib\ HKEY_LOCAL_MACHINE\software\classes\typelib\ HKEY_LOCAL_MACHINE\software\classes\typelib\ HKEY_LOCAL_MACHINE\software\classes\typelib\ HKEY_LOCAL_MACHINE\software\istbar HKEY_LOCAL_MACHINE\software\istsvc HKEY_LOCAL_MACHINE\software\lycos\sidesearch\locale HKEY_LOCAL_MACHINE\software\lycos\sidesearch\partner HKEY_LOCAL_MACHINE\software\lycos\sidesearch\silentwelcome HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\ HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\ HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\\installer HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\\systemcomponent HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\\bandclsid HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\\buttontext HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\\clsid HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\\default visible HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\\hoticon HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\\icon HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shstyle HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\mediaswitch HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/istactivex.dll HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/istactivex.dll\ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/winnt/downloaded program files/istactivex.dll\.owner HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/winnt/downloaded program files/istactivex.dll\ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/winnt/downloaded program files/pcpowerscan.exe\.owner HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/winnt/downloaded program files/pcpowerscan.exe\ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ist service HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ms updates HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls\c:\windows\downloaded program files\istactivex.dll HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shell extensions\approved\ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\iesearchbariesearchbar HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\istbar\_ HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\istbaristbar HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\istsvc HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\lycos sidesearch\displayicon HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\lycos sidesearch\displayname HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\lycos sidesearch\helplink HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\lycos sidesearch\nomodify HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\lycos sidesearch\norepair HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\lycos sidesearch\uninstallstring HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\lycos sidesearch\urlinfoabout HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\search bar\displayname HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\search bar\uninstallstring HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\wsem update\displayname HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\wsem update\uninstallstring HKEY_LOCAL_MACHINE\typelib\
|
|
Remove the following files a834d85b5062f849e461b71c20bf78f8.exe, amature.mpg, bb.exe, bundleinstall.exe, chat.dat, checks.040617-1442.log, csearch.dll, default.skn, dust.exe, ezines.dat, games.exe, home.dat, hot_tarts_au.lnk, iinstall.exe, install.log, intrigue.dll, ist.exe, ist.inf, istactivex.inf, istbar.txt, istbar_mainstream[1].dll, istinstall_154074.exe, istsvc[1].exe, kyf.dat, l9lecc.exe, lhqibp.dll, mcinstl.dll, mcinstl.exe, mcinstl.inf, msbe.dll, olelib.tlb, paysites.dat, penmzp.exe, pics.dat, scan.exe, srchbar.dll.manifest, srcle32.exe, ssdbkup.exe, trojandownloader.win32.istbar.aj.exe, trojandownloader.win32.istbar.aj[2].exe, trojandownloader.win32.istbar.ap.dll, trojandownloader.win32.istbar.bm.exe, trojandownloader.win32.istbar.bp.exe, trojandownloader.win32.istbar.bu.exe, trojandownloader.win32.istbar.bx.exe, trojandownloader.win32.istbar.cl.exe, trojandownloader.win32.istbar.dh_(40).dll, trojandownloader.win32.istbar.i.exe, trojandownloader.win32.istbar.p.dll, trojandownloader.win32.istbar.u.exe, uveu42at.exe, vic32.dll, videos.dat, virtue.lnk, webupdate.txt, x.chm.lnk, x.zip.dir.lnk, xml_istbar.php, ymhfvu.exe, ysbactivex.dll. flashplayer.dll, fpfntdat.bin, gzlib.dll in c:\spedia\ cxtpls_loader_ff.exe in c:\temp\ free travel voucher.url in Desktop\ free amature movie.lnk in Documents and Settings\UserName\desktop\ istdnld.exe, ist_install.exe in Documents and Settings\UserName\local settings\temp\ in the vip.lnk in Favorites\adult sites\reality\ in the vip.lnk in Favorites\free adult content\daily pictures\ betting.lnk, casino palace.lnk, casino.lnk, games.lnk, horoscope.lnk in Favorites\fun & games\ air tickets.lnk in Favorites\going places\ ads.html, config.ini, naughtyplayer.exe, naughty_setup.exe in Program Files\free amature movie\ optimize.exe in Program Files\internet optimizer\ istsvc.exe in Program Files\istsvc\ mediaaccc.dll, mediaaccess.exe, mediaacck.exe in Program Files\media access\ radio.exe in Program Files\toolbar\ 70tovmto.exe, alchem.ini, espam.exe, fon14100.exe, fyd.exe, msbb.exe, mscache.dll, mscache.exe, nem218.dll, penoghih.exe, tinybar.exe, unstsa3.exe in Windows\ 70tovmto.ini, a95kfrhe.ini, acsproxy.dll, acsproxy.lib, aenhl3qr.html, ap9h4qmo.exe, ap9h4qmo.ini, aupdate.exe, aupdate_uninstall.exe, bln02nqv.exe, bln02nqv.ini, bw6mds51.ocx, dbm42.exe, dgrdntld.exe, fpuos7h2.html, fwntoolbar.dll, gah95on6.ini, gamma.exe, imgconv.dll, istbar.dll, kmisxk.exe, longtimer.ocx, loudc.exe, mciwndx.ocx, mqtqtz32.exe, msyutils.exe, nah.exe, srchbar.dll, trkgif.exe, unregister.exe in Windows\system32\ istbar.dll in Windows\system\ istbar.dll in Windows\temp\
|
|
Remove the following directories Program Files\common files\totem shared Program Files\free amature movie Program Files\istsvc Program Files\search bar
| |