MSN search bar.

[Adam Bishop]

2 main questions. I have been infected with a piece of
spyware that logs keys, generates traffic for websites etc.

The spyware has been sucessfully removed. But some of
it's effects are prensent still. It went by an alias of
ISTsvc and IST bar.

1.) When right clicking the toolbar, it brings up the
toolbar options. At the bottom, ISTbar still exists.
Does anyone know where the reg entry is to remove the
link. It doesn't do anything anymore, but it is still
damned annoying.

2.) The MSN address bar feature has been disabled. I have
restored the registry entires to the correct addresses,
but it still does not come up.

When you type a search phrase, it comes up with a self-
generated 404. Even if you type 'Search for "search
item"' it comes up with a 404 error at http:///? Search%
20for%20"Search%20Item"

It may be I have the wrong addresses, but it is doubtful.

So far, I have restored internet explorer defaults, ran
the ie repair tool, manually repaired the registry entry,
combined my registry with the following:

[HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Main]
"Search Bar"="http://www.msn.com/access/allinone.htm"
"Search Page"="http://www.msn.com/access/allinone.htm"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/
{SUB_RFC1766}/srchasst/srchasst.htm"
"CustomizeSearch"="http://ie.search.msn.com/
{SUB_RFC1766}/srchasst/srchcust.htm"

So. I am stuck for ideas. The only thing I can think of
is it is either still there (unlikely) or there is
something that I have not tried (very likely).

Any and all help greatly appreciated.

 

[Sandi - Microsoft MVP]

Those addresses aren't correct I think:
http://www.mvps.org/inetexplorer/answers4.htm#search_engine

Regarding the toolbar link, check out this URL:
http://www.mvps.org/inetexplorer/answers_5.htm#menu

--
Install the latest IE cumulative patch for protection against QHost:
http://www.microsoft.com/security/security_bulletins/ms03-040.asp
More information about QHosts can be found here:
http://www.mvps.org/inetexplorer/darnit_3.htm#qhost
________________________________________
Sandi - Microsoft MVP since 1999 (IE/OE)
http://www.mvps.org/inetexplorer

 

[jnnyc]

This link could maybe help you :
http://www.spywareinfo.com/~merijn/index.html

Download the "hijackthis", open and scan. There, you can delete the
suspect files.
But at least you will found there the registery adress of the IE Main
start page, defaut search, defaut page,...

They have a forum too

Enjoy

PS : I have wrote an other message to answer to you, I think you will
find it under "IST bar" subject.