Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

ISearchtech.sidefind and istbar [CLOSED]

Started by Dexter101 , Aug 07 2005 06:17 PM

This topic is locked

#1
Dexter101

Posted 07 August 2005 - 06:17 PM

Member

Member
15 posts

Hi!
I've followed all of the steps before posting my log. My problem is as follows: I scanned my computer for spyware with adaware and it came out with istbar registry key and spybot with isearchtech.sidefind ( it was a registry hey). I quarantined it then deleted it. Then scanned with spybot which told me it could delete after reboot. I reboot the computer but to no avail isearchtech.sidefind is still showing up in my scans and I cant seem to get rid of it. I've been rescanning and deleting the same registry key for hours now. I've also done a panda active scan and it came up with more spyware that neither adaware or spybot had detected is that normal? Here in attachment is the activescan report. Here is my hjt log:
Logfile of HijackThis v1.99.1
Scan saved at 20:08:27, on 2005-08-07
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
E:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SYSTEM32\USRshutA.exe
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Shorty - {11A4CA8C-A8B9-49c2-A6D3-3F64C9EEBAE6} - C:\Program Files\DNS\Catcher.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /firstlogon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://www.couleurjazz.com/qp2.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18....es/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1123458429249
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.bitdefend...bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab
O16 - DPF: {A67A5721-6834-11D3-A646-00500428A547} (DAVIconMod Class) - https://dc1.dawsonco...ml/DAVIcons.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab34246.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/...outLauncher.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/...fault/shapo.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/...aploader_v6.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe

Attached Files

Activescan.txt 2.49KB 100 downloads

Edited by Dexter101, 07 August 2005 - 06:19 PM.

#2
kool808

Posted 08 August 2005 - 04:34 PM

Visiting Staff

Member
1,690 posts

Hello and welcome to Geeks to Go! I'm kool808 and I will be helping you today.

I am working on your log. As soon as I made a good fix for this, I will post a reply. Thank you for your patience.

#3
kool808

Posted 08 August 2005 - 04:40 PM

Visiting Staff

Member
1,690 posts

Please SAVE THIS PAGE or secure a PRINT COPY of the instructions for reference.
++++++++++++++++++++++++++++++++++++++++++++

Open HijackThis
go to Config, then Misc Tools
Open Uninstall Manager, then click Save List...
Post the results here
close HJT

Open up NOTEPAD, then copy & paste the following commands. Save it to desktop as findpf.bat. Save it as file type all files.

@echo off
cd\
dir %System Root%\PROGRA~1 > pflist.txt
notepad pflist.txt

Now on your desktop double-click findpf.bat then post the results in your next reply.
(NOTE: You can delete this file afterwards.)

Please download the trial version of Ewido Security Suite 3.5 here:
http://www.ewido.net/en/download/

Please read Ewido Setup Instructions
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Ad-Aware SE Setup
Do NOT run the scan yet!

Reboot in SAFE MODE. (How to boot in Safe Mode...)

Uninstallation
We need to uninstall the following programs:
Go to Control Panel > Add/Remove Programs
Please locate if they exist
- FICHIERS COMMUNS (or something similar to it)
- Side search / IST BAR / Search Bar
- DNS
Click Uninstall
Confirm with OK

Open Ad-aware and do a full scan. Remove all it finds.

Run Ewido:

Click on scanner
Click Complete System Scan and the scan will begin.
During the scan it will prompt you to clean files, click OK
When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
When the scan is finished, click the Save report button at the bottom of the screen.
Save the report to your desktop

Close Ewido

Be sure to View Hidden and System Files.

Through Windows Explorer, delete the following folder(s) or files(s) if they exist (in bold):

C:\WINDOWS\SYSTEM32\exclean.exe
C:\PROGRAM FILES\FICHIERS COMMUNS\ <-- whole folder
C:\Program Files\DNS\ <-- whole folder

Finally, Empty Recycle Bin

Please close all remaining windows, disconnect from the internet, open HijackThis then click SCAN. Please put a check on the following items listed below:

O2 - BHO: Shorty - {11A4CA8C-A8B9-49c2-A6D3-3F64C9EEBAE6} - C:\Program Files\DNS\Catcher.dll (file missing)

Make sure to double check the items you have selected, then click Fix Checked.

reboot back in NORMAL MODE.

have another online scan with Panda Scan, save the report. (Do NOT attach it, just post it normally)

Close all windows, open HijackThis then SCAN.
Post a NEW HijackThis Log.
Please tell me how your system is working now.

Edited by kool808, 08 August 2005 - 04:42 PM.

#4
Dexter101

Posted 08 August 2005 - 07:56 PM

Member

Topic Starter
Member
15 posts

Hi!
Following instructions here is HJT open uninstall manager log:
a² free 1.1
Ad-Aware SE Personal
Adobe Photoshop Elements 2.0
Adobe Reader 6.0.1 - Français
Ares 1.8.1
avast! Antivirus
CleanUp!
Codec Pack - All In 1 6.0.2.2
Codeur Windows Media Série 9
Codeur Windows Media Série 9
Correctif pour le Lecteur Windows Media [Voir Q828026 pour plus d'informations]
Correctif Windows XP - Article Base de Connaissances 834707
Correctif Windows XP - KB823182
Correctif Windows XP - KB824105
Correctif Windows XP - KB824141
Correctif Windows XP - KB825119
Correctif Windows XP - KB826939
Correctif Windows XP - KB828035
Correctif Windows XP - KB828741
Correctif Windows XP - KB833987
Correctif Windows XP - KB835732
Correctif Windows XP - KB837001
Correctif Windows XP - KB839645
Correctif Windows XP - KB840315
Correctif Windows XP - KB840374
Correctif Windows XP - KB840987
Correctif Windows XP - KB841356
Correctif Windows XP - KB841533
Correctif Windows XP - KB841873
Correctif Windows XP - KB842773
Correctif Windows XP - KB867282
Correctif Windows XP - KB871250
Correctif Windows XP - KB873333
Correctif Windows XP - KB873339
Correctif Windows XP - KB873376
Correctif Windows XP - KB885250
Correctif Windows XP - KB885835
Correctif Windows XP - KB885836
Correctif Windows XP - KB887797
Correctif Windows XP - KB887811
Correctif Windows XP - KB888113
Correctif Windows XP - KB888302
Correctif Windows XP - KB889293
Correctif Windows XP - KB890047
Correctif Windows XP - KB890175
Correctif Windows XP - KB890859
Correctif Windows XP - KB890923
Correctif Windows XP - KB891711
Correctif Windows XP - KB891781
Correctif Windows XP - KB892944
Correctif Windows XP - KB893066
Correctif Windows XP - KB893086
Correctif Windows XP (SP2) Q819696
DivX Player
D-Link CIF Webcam
EasyCleaner
Google Gmail Notifier
HijackThis 1.99.1
iPod Updater 2004-11-15
iTunes
J2SE Runtime Environment 5.0 Update 1
J2SE Runtime Environment 5.0 Update 2
Java 2 Runtime Environment, SE v1.4.2
jv16 PowerTools 1.3
Lecteur Windows Media 10
LimeWire
LimeWire PRO 4.6.0
Macromedia Extension Manager
Macromedia Fireworks MX
Macromedia Flash MX
Macromedia Shockwave Player
MagicTune 2.5
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft Data Access Components KB870669
Microsoft Office PowerPoint 2003 Template Pack 1
Microsoft Office XP Professional with FrontPage
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)
Mise à jour pour Windows XP (KB898461)
Mozilla Firefox (1.0.3)
MSN Messenger 7.0
NVIDIA Windows 2000 Display Drivers
OpenMG Secure Module 3.4.01
Opera
Panda ActiveScan
PCI Audio Driver
PowerQuest PartitionMagic 8.0
QuickTime
RealPlayer
Services Off-line de Home'Bank
Slayers Online
SonicStage 2.0.02
SPBBC
Spybot - Search & Destroy 1.4
SpywareBlaster v3.4
Utilitaires Sierra
Visionneuse Journal Windows Microsoft
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
WinMX
WinRAR archiver

findpf.bat log:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est F80D-8742

R‚pertoire de C:\PROGRA~1

2005-08-08 17:59 <REP> .
2005-08-08 17:59 <REP> ..
2005-08-05 15:15 <REP> a2 free
2004-09-25 17:12 <REP> Accessories
2004-11-21 12:41 <REP> Adobe
2005-02-25 14:48 <REP> Alwil Software
2005-02-28 22:05 <REP> Ares
2004-12-05 22:20 <REP> BitComet
2005-07-17 11:38 <REP> CleanUp!
2004-12-18 14:28 <REP> Codec Pack - All In 1
2004-12-07 20:40 <REP> Common Files
2004-09-25 23:58 <REP> ComPlus Applications
2004-09-25 17:45 <REP> DirectX
2005-01-01 02:25 <REP> DivX
2005-08-08 17:59 <REP> ewido
2005-08-05 17:50 <REP> Fichiers communs
2004-11-18 20:28 <REP> FirstClass
2005-04-24 15:02 <REP> ING
2004-11-09 09:05 <REP> InterMute
2005-04-23 17:13 <REP> Internet Explorer
2005-04-09 12:54 <REP> iPod
2005-04-09 12:54 <REP> iTunes
2005-04-01 20:51 <REP> Java
2005-02-23 20:37 <REP> jv16 PowerTools
2004-09-26 21:53 <REP> Lavasoft
2005-01-24 21:45 <REP> LimeWire
2005-02-26 18:01 <REP> Messenger
2004-09-26 14:45 <REP> Microsoft ActiveSync
2004-09-26 00:08 <REP> microsoft frontpage
2004-09-26 14:41 <REP> Microsoft Office
2005-04-23 13:40 <REP> Microsoft SQL Server
2004-09-26 14:43 <REP> Microsoft Visual Studio
2004-09-26 00:01 <REP> Movie Maker
2004-09-25 23:58 <REP> MSN
2005-08-03 01:11 <REP> MSN Games
2004-09-25 23:57 <REP> MSN Gaming Zone
2005-08-03 01:15 <REP> MSN Messenger
2004-09-26 17:42 <REP> NetMeeting
2005-06-03 21:37 <REP> OfficeUpdate11
2005-08-07 16:51 <REP> Opera
2005-03-06 15:49 <REP> Outlook Express
2004-09-26 09:28 <REP> PowerQuest
2005-04-09 12:55 <REP> QuickTime
2004-09-26 21:59 <REP> Real
2004-12-26 19:51 <REP> Sony
2005-07-17 09:03 <REP> Spybot - Search & Destroy
2005-08-05 15:08 <REP> SpywareBlaster
2005-07-17 16:41 <REP> Theme-Pak
2005-07-17 11:56 <REP> ToniArts
2005-04-23 13:51 <REP> Vstplugins
2005-01-02 13:23 <REP> Windows Media Components
2004-10-10 16:41 <REP> Windows Media Player
2004-09-25 23:57 <REP> Windows NT
2004-12-01 18:31 <REP> WinMX
2005-04-26 22:19 <REP> WinRAR
2004-09-26 00:08 <REP> xerox
0 fichier(s) 0 octets
56 R‚p(s) 4ÿ821ÿ061ÿ632 octets libres

Still following instructions...
thnkx

#5
kool808

Posted 09 August 2005 - 05:06 AM

Visiting Staff

Member
1,690 posts

okay looking very good, just make sure to review your P2P networking programs here:
http://www.spywareinfo.com/articles/p2p/

If you determined that your program is infected then you should uninstall it through Add/Remove programs in Safe Mode then delete their respective folders!

Are you still having problems with your system? How is everything running?

I have NOT seen the latest logs taken from both the Ewido as well as from Panda Scans? Can you post them...

Please post a fresh new Hijackthis log. :tazz:

#6
Dexter101

Posted 09 August 2005 - 10:07 AM

Member

Topic Starter
Member
15 posts

Hi!
Here is the log of ewido. It did find infected files; cleaned them and quarantined them but for ISTBar infected files it said there had been an error during cleaning

( does that mean these registry keys dont exist any more?):
ewido security suite - Rapport de scan
---------------------------------------------------------

+ Créé le: 07:40:56, 2005-08-09
+ Somme de contrôle: 2C9DC29B

+ Résultats du scan:

HKLM\SOFTWARE\ISTbar -> Spyware.ISTBar : Erreur durant le nettoyage
HKLM\SOFTWARE\ISTbar\Historyfiles -> Spyware.ISTBar : Erreur durant le nettoyage
HKLM\SOFTWARE\ISTbar\Historystring -> Spyware.ISTBar : Erreur durant le nettoyage
C:\Documents and Settings\gracia\Cookies\gracia@burstnet[2].txt -> Spyware.Cookie.Burstnet : Nettoyer et sauvegarder
C:\Documents and Settings\gracia\Cookies\[email protected][1].txt -> Spyware.Cookie.Adjuggler : Nettoyer et sauvegarder
C:\Documents and Settings\gracia\Cookies\[email protected][2].txt -> Spyware.Cookie.Myaffiliateprogram : Nettoyer et sauvegarder
C:\Program Files\Fichiers communs\system32.dll/Catcher.dll -> Spyware.Maxifiles : Nettoyer et sauvegarder
C:\Program Files\Fichiers communs\system32.dll/gui.exe -> TrojanDownloader.Agent.rv : Nettoyer et sauvegarder

::Fin du rapport

Panda activescan bugged on me. I tried to scan my entire computer but after 3 minutes waiting the scan still hadn't started. So I decided to try again but this time only scanning a specific folder from my computer and it did work. I tried again by scanning My Documents and it worked again but when I tried for My Computer nothing happened; so if its any help I scanned my RAV here is the log:
Scan started at 2005-08-09 09:18:18

Scanning memory...
Scanning boot sectors...
Scanning files...

Scanned
============================
Objects: 34809
Directories: 3802
Archives: 1975
Size(Kb): -1921862
Infected files: 0

Found
============================
Viruses found: 0
Suspicious files: 0
Disinfected files: 0
Mail files: 596

Here is the HJT log:
ogfile of HijackThis v1.99.1
Scan saved at 11:56:19, on 2005-08-09
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
E:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SYSTEM32\USRshutA.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /firstlogon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://www.couleurjazz.com/qp2.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18....es/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1123458429249
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.bitdefend...bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab
O16 - DPF: {A67A5721-6834-11D3-A646-00500428A547} (DAVIconMod Class) - https://dc1.dawsonco...ml/DAVIcons.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab34246.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsec...scan/axscan.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/...outLauncher.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/...fault/shapo.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/...aploader_v6.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: PACSPTISVR - Unknown owner - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\PACSPT~1.EXE (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)
O23 - Service: Sony SPTI Service (SPTISRV) - Unknown owner - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe (file missing)

I'd also like to mention that since this morning Windows Installer has been prompting me to configure my win office xp with frontpage

. I kept on canceling but every time I would open any window the message would come back so I did it. Also, can i permanently delete the objects in quarantined in ad-aware and ewido? I want to get rid of these ISTBar registrey keys

Thnkx

Edited by Dexter101, 09 August 2005 - 10:14 AM.

#7
kool808

Posted 09 August 2005 - 04:31 PM

Visiting Staff

Member
1,690 posts

Please download http://securityresponse.symantec.com/avcenter/FxIstbar.exe. Save it on your Desktop. Do NOT run it yet.

Open up NOTEPAD, then copy & paste the follwing codes (starting from REGEDIT4). Save it on desktop as fixme.reg. Choose file types as ALL FILES.

REGEDIT4

[-HKLM\SOFTWARE\ISTbar]

[-HKLM\SOFTWARE\ISTbar\Historyfiles]

[-HKLM\SOFTWARE\ISTbar\Historystring]

Now double-click fixme.reg then allow it to merge to the system.

Reboot in SAFE MODE. (How to boot in Safe Mode...)

Now run the FxIstbar.exe

Run the fixme.reg again, allow it to merge.
(NOTE: You can delete this file afterwards.)

Delete this folders:

C:\Program Files\Fichiers communs\ <-- whole folder

empty recycle bin.

Run the Ewido again to verify that the fix worked.

Reboot in NORMAL MODE.

let me know how everything works.

#8
Dexter101

Posted 09 August 2005 - 05:01 PM

Member

Topic Starter
Member
15 posts

Hi!
I just wanted to ask before I do all of this. The folder fichiers communs contains folders like microsoft shared. If I delete won't I have to reinstall it? I think thats what happened today when Windows installer prompted me to configure my office xp with frontpage and probably reinstalled this folder...
Anyway, I'll follow your instructions

Thnkx again! :tazz:

#9
kool808

Posted 09 August 2005 - 05:17 PM

Visiting Staff

Member
1,690 posts

yes you must re-install it after everything is clean :tazz:

#10
Dexter101

Posted 10 August 2005 - 11:34 AM

Member

Topic Starter
Member
15 posts

Hey!
Ran removal tool, said istbar was not present in my computer.
Ewido still found the 3 infected registry keys by istbar. Says it disfincted them but log says otherwise

. Here is log:
---------------------------------------------------------
ewido security suite - Rapport de scan
---------------------------------------------------------

+ Créé le: 09:28:18, 2005-08-10
+ Somme de contrôle: 63F477E

+ Résultats du scan:

HKLM\SOFTWARE\ISTbar -> Spyware.ISTBar : Erreur durant le nettoyage
HKLM\SOFTWARE\ISTbar\Historyfiles -> Spyware.ISTBar : Erreur durant le nettoyage
HKLM\SOFTWARE\ISTbar\Historystring -> Spyware.ISTBar : Erreur durant le nettoyage

::Fin du rapport

Otherwise, today outlook express refuses to open here is the error message:
Outlook Express could not be started. The application was unable to open the Outlook Express message store. Your computer may be out of memory or your disk is full. Contact Microsoft support for further assistance. (0x8007007E,126)
followed by:
Outlook Express could not be started because MSOE.DLL could not be initialized. Outlook Express may not be installed correctly.

Did my research on micorsoft.com and this error is seen when you start outlook express after windows 2K has been installed but i am running xp. According to article cause is:
This issue can occur if you have changed the ProgramFilesDir value in the following registry key to install programs on a different drive than the operating system:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
If you change this key before you install Windows 2000 SP1, Outlook Express no longer functions. A new, empty folder named Outlook Express is created in the folder that the ProgramFilesDir value points to; however, the program is still located in the C:\Program Files\Outlook Express folder. The shortcuts to start Outlook Express point to the empty folder.
RESOLUTION
To resolve this issue, modify your shortcuts to point to the correct location.

Does that make any sense????
Thnkx :tazz:

#11
kool808

Posted 10 August 2005 - 04:39 PM

Visiting Staff

Member
1,690 posts

just uninstall your MS Office, reboot then re-install it again. You need to have the disk installer.

Let us try doing the registry editing again, just overwrite the existing file if present.
(This must be done correctly, if you have any questions please feel free to ask. After a successful saving of the file fixme.reg the icon should look like a big green cube with smaller pieces of cubes)

Open up NOTEPAD, then copy & paste the follwing codes (starting from REGEDIT4). Save it on desktop as fixme.reg. Choose file types as ALL FILES.

REGEDIT4

[-HKLM\SOFTWARE\ISTbar]

Now double-click fixme.reg then allow it to merge to the system.
(NOTE: You can delete this file afterwards.)

#12
Dexter101

Posted 10 August 2005 - 05:19 PM

Member

Topic Starter
Member
15 posts

Hey!

let me get this straight: once have uninstalled then installed again MSoffice. I do the registry editing. correct?
Once I reinstalled MSoffice it will erase every single message that was in the outlook express right? and when i unistall msoffice will that effect in anyway any of my word documents?

thnkx :tazz:

Edited by Dexter101, 10 August 2005 - 05:37 PM.

#13
kool808

Posted 10 August 2005 - 06:02 PM

Visiting Staff

Member
1,690 posts

yes that is correct email messages will be erased. You can save them before you uninstall. You can have these as reference to retrieve emails:
http://www.geekstogo...NE-t30854.html#

For the word documents, the files are safely saved on your hardisk. After the fresh reinstall you can still recover them.

You do the registry editing first then the uninstall. :tazz:

#14
Dexter101

Posted 11 August 2005 - 01:19 PM

Member

Topic Starter
Member
15 posts

Hey!

thnkx for the reference in trying to help me save all my e-mails but becca77 created a new profile. Do I need to create a new profile? do I save them on my desktop or a new folder i'll create?

thnkx

sorry i am such a newbie :tazz:

#15
kool808

Posted 11 August 2005 - 06:00 PM

Visiting Staff

Member
1,690 posts

when you re-install MS Office it will be creating a new set of database for the new profile. The files for the emails are there existing, the only thing we need is to update its location and preferrences :tazz:

Would it bother you if you create a new profile? The idea there is to overwrite the present profiles with the previously setup profiles which contains your email locations and preferrences.

Give it a try, let me know how it worked.