Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


How To Remove Istbar + Istsvc Hijackers

  • Please log in to reply
No replies to this topic

#1 -David-


  • Members
  • 10,603 posts
  • Gender:Male
  • Location:London
  • Local time:06:27 PM

Posted 30 November 2005 - 03:17 PM

How to Remove the Ist Bar

What this program does:

Adware.Istbar is an adware component, which does one or more of the following:
  • Installs an Internet Explorer toolbar
  • Acts as a Home page and search hijacker
Tools needed for this fix: Related Tutorials:How to use HijackThis to remove Browser Hijackers & Spyware
Symptoms in a HijackThis Log

O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [}z[8C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\pwkctgec.exe

Note: Any 04 entry that leads to "C:\Program Files\ISTsvc\istsvc.exe" with random characters before hand (e.g. [‰u0])

Please do both of the following before we start if possible!:

1) Please print off these instructions - they will be needed later when internet access is not available.
2) Save these instructions in word/notepad to the desktop where they can be easily found for the same reasons as above.
At the moment you may feel like you battling with your computer to keep it running smoothly, but doing the following things should most certainly help getting it back to how it was

:step1:Download the Norton Removal Tool for fixing Istbar. When you have done that please run the tool and exit when it has finished!

:thumbsup: Click here to download hijackthis_sfx.exe
Save hijackthis_sfx.exe to your desktop.
  • Double click on the hijackthis_sfx.exe icon on your desktop then click the Unzip button. Then close the Self-Extractor window.
  • Using My Computer/Windows Explorer, navigate to C:\Program Files\Hijack This and double click on HijackThis.exe to run it.
  • If you would like to make a shortcut for your Desktop so it's more easily accessable, right click HijackThis.exe and choose Send To > Desktop (create shortcut).
  • Click "Do a system scan only". HijackThis will make a quick scan and show you a list of entries.

:flowers: Fix the following entries if they are still there:

O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
04 - HKLM\..\Run: [}z[8C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\pwkctgec.exe

(note - the characters for the third line will be random and not exactly as shown above)

:step4:Find and manually delete these folders if present:

C:\Program Files\ISTsvc
C:\Program Files\ISTbar

:trumpet: Run HijackThis again and see if the IST entries are now gone from the HijackThis log.

IstBar is typically installed with other malware. If you have concerns that some other malware may still be present, please go here:
........and post a topic with your problem, and HijackThis log.

This is a self-help guide. Use at your own risk.

BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can post a HijackThis log in our HijackThis Logs and Analysis forum.

If you have any questions about this self-help guide then please post those questions in our AntiVirus, Firewall and Privacy Products and Protection Methods forum and someone will help you

Edited by Grinler, 19 November 2006 - 07:18 AM.

BC AdBot (Login to Remove)


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users