Similar to the earlier variant TROJ_ISTBAR.B, this memory-resident Trojan is downloaded as an Internet Explorer (IE) toolbar from the following Web site:

http://xxxto<BLOCKED>bar.com/ist/scripts/istsvc_config.php
Once installed, it creates a folder named ISTsvc, where it drops an exact copy of itself as ISTSVC.EXE, in the program directory.


This Trojan drops several links, most of which point to pornographic Web sites, in the Internet Explorer Favorite folders.



Source, a list of all links are on this page

http://www.trendmicro.com/vinfo/viru...=TROJ_ISTBAR.C

i found the url for istbar.a, but i dont think its a good idea to post it , message me if u want it




Thats all i could turn up