Internet Security Threats

Trojan-Downloader.Win32.IstBar.bo

RISK LEVEL:2

Once launched, the Trojan searches the system registry for the following keys:

[HKLM\Software\ISTsvc]"popup_url" = "http://www.slotch.com/ist/scripts/istsvc_***_data.php""version""account_id""app_date"

If the Trojan does not find the first key shown below, it will create it.

The Trojan will then attempt to connect to the Internet. If it is unableto establish a connection, it will cease running. If the Trojan does establisha connection, it will download a file called “istsvc.exe” from thefollowing address:

This file will be saved to the current user’s temporary directory:

%Documents and Settings%\%Current_user%\Local Settings\Temp\istsvc.exe

The Trojan then creates a directory called “%Program Files%\ISTsvc".It copies the downloaded file to this directorz and launches it for execution.It then deletes the file from the temporarz directory and ceases running.

If your computer does not have an up-to-date antivirus, or does not have anantivirus solution at all, follow the instructions below to delete the maliciousprogram:

1. Delete the original Trojan file (the location will depend onhow the program originally penetrated the victim machine).
2. Delete the following registry keys:

   [HKLM\Software\ISTsvc]"popup_url" = "http://www.slotch.com/ist/scripts/istsvc_***_data.php""version""account_id""app_date"

3. Delete the following directory and its contents:

   Program Files%\ISTsvc

4. Delete the following file (if the Trojan program has not alreadydeleted it):

   %Documents and Settings%\%Current_user%\Local Settings\Temp\istsvc.exe

5. Update your antivirus databases and perform a full scan of thecomputer (download a trial version of Kaspersky Anti-Virus).