Browser Hijack?

[Ken Moore]

A short time ago my browswer (IE5.5, recently upgraded from 5.0) started showing evidence of being hijacked. Sometimes when it started up and sometimes during use it would link to one of a number of pages and thence on to various porn sites. In fact on start up it would sometimes do this even though not connected to the internet.

The original links seen have been to pages on www7.paypopup.com, kathic.offshorechicks.com, www.xtrocash.org,www.exitorcash.com,www.cashexits.com.

Scans with AdAware and SpyBot Search and Destry have revealed nothing in particular and currently I've got my machine protected by AdSubtract and PopUpCop, which are doing fine in closing down the windows but are also having a detrimental effect of closing things I might want.

I have been a little suspicious of a module IstSVCwnd because I don't know what it is or where it came from and it sometimes is the cauise of machine hangs.

A recent connection also gave cause for doubt (incuding the word 'ist') when PopupCop said that a site was trying to download 'FREE SEX-XXXTOOLBAR' with a requesting web page of http://www.slotch.com/ist/scripts/istsvc_ads.php?version=1005...etc
and a download location of http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab


I'm running Win2000pro behing Outpost firewall and with (up to date) AVG virus scanner.

Any suggestions would be appreciated.