Malicious file
istsvc.exe: the ISTBar adware process and how to remove it
istsvc.exe is a background process of the ISTBar adware, a browser toolbar tied to pornographic and commercial redirects. It restarts itself after you end it, so the file has to be removed as well. The genuine ISTBar location is C:\Program Files\ISTsvc\; a copy anywhere else may be something worse.
Prefer to do it yourself? The manual steps follow.
istsvc.exe is part of ISTBar, an adware program, and should be terminated as soon as it is found. Ending the process is not enough, because it may start again unless the file is removed too.
If the file is in C:\Program Files\ISTsvc\, it is the adware itself, a potentially unwanted program. If it is stored somewhere else, you may be dealing with more damaging threats such as trojans or keyloggers using the name.
- Type
- Adware (potentially unwanted program), part of the ISTBar toolbar
- Process name
- istsvc.exe, a file and a process of the same name
- Expected folder
- C:\Program Files\ISTsvc\
- Visible effects
- A toolbar in Internet Explorer and other browsing apps; redirects to pornographic and commercial content
- Developer named by a security site
- Integrated Search Technologies (Neuber describes it as ISTbar spyware)
- Detection names on file.net
- Adware.Istbar (Symantec) and TROJ_DLOADE.BQG (Trend Micro)
- Restarts itself
- Yes, it may start again after the process is ended
What istsvc.exe does
istsvc.exe is a file and a process of the same name that is part of the ISTBar adware. It is seen running in the background, so the problems a user notices, such as redirects and a slower browser, can be traced to this file.
ISTBar is adware connected with pornographic material and with commercial content redirects. It appears as a toolbar in the Internet Explorer web browser and in other internet surfing apps. Internet Explorer was retired on 15 June 2022, so on a current PC the toolbar now turns up in other browsers or as an old leftover.
The process is harmful and may damage the system, so it should be terminated immediately after detection. Because it can restart itself after you kill it, the problematic file has to be removed too.
About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.
How it gets on a PC
Adware like ISTBar usually comes bundled with other free programs, with toolbars that offer extra search features, or with downloads from untrusted sites. The old report does not name the installer, so treat any program you do not remember installing as a suspect.
Download programs only from the publisher's own site, and use the custom install option so you can untick bundled toolbars.
How to find it
Start with where the file lives, because the folder separates the adware from worse threats.
- Look for the process Press Ctrl + Shift + Esc, open the Details tab and look for istsvc.exe. Right-click it and choose Open file location.
- Make sure the folder is C:\Program Files\ISTsvc\ That is where the ISTBar adware keeps istsvc.exe. If the file is located elsewhere, you might have a more damaging threat, such as a trojan or a keylogger, instead of a potentially unwanted program.
- Search for the file by name In Command Prompt, list every copy on the system drive.
dir /s /b C:\istsvc.exe - Check startup and scheduled tasks Open Autoruns from Microsoft Sysinternals and search for istsvc, or look at Task Manager > Startup apps and Task Scheduler. A service or run entry that restarts the file is why it keeps coming back.
- Look at your browser Check the extensions or toolbars of every browser for an ISTBar toolbar.
The file name alone is not proof, and the folder is not either: malware can copy any name. A detection by a scanner or a missing program in Settings > Apps settles it.
How to remove istsvc.exe
Make sure the file is not part of any system program first: istsvc.exe is not a Windows file, so removing it is safe. Work in this order so it cannot restart.
- End the process In Task Manager open the Details tab, select istsvc.exe and choose End task.
- Uninstall the program Open Settings > Apps > Installed apps and uninstall ISTBar or anything from Integrated Search Technologies that you do not recognise.
- Remove startup entries In Autoruns, untick or delete any entry that points to istsvc.exe, and delete matching tasks in Task Scheduler.
- Delete the file and folder Delete istsvc.exe and the C:\Program Files\ISTsvc\ folder, then empty the Recycle Bin. If Windows says the file is in use, restart in Safe Mode and delete it there.
- Run a full Microsoft Defender scan Open Windows Security > Virus & threat protection > Scan options, select Full scan and remove everything it finds.
- Run Microsoft Defender Offline scan In the same list choose Microsoft Defender Offline scan. The PC restarts and scans before Windows loads, which finds components that hide from a normal scan.
Warning signs
| What you see | What it means |
|---|---|
| A toolbar you did not add in the browser | ISTBar shows up as a toolbar in Internet Explorer and other browsing apps. |
| Redirects to adult or advertising pages | ISTBar is tied to pornographic material and commercial content redirects. |
| istsvc.exe returns after you end it | The process may restart itself; the file and its startup entry are still there. |
| istsvc.exe outside C:\Program Files\ISTsvc\ | Not the adware's own location, so a trojan or keylogger may be using the name. |
| Slow browsing and extra network traffic | The old report calls the process harmful to the system; unexplained load is a sign to scan. |
Questions people ask
What is istsvc.exe?
It is the background process of the ISTBar adware. The file and the process have the same name. ISTBar is a toolbar tied to pornographic material and commercial redirects, and the process may restart itself after you kill it. Remove the program, its startup entries and the file, then run a Microsoft Defender full scan and an offline scan.
Is istsvc.exe a virus?
It is adware, which security vendors list as a potentially unwanted program rather than a classic virus. The file.net page lists Symantec's name Adware.Istbar and Trend Micro's TROJ_DLOADE.BQG for it. The behaviour is still harmful, so remove it. A copy outside C:\Program Files\ISTsvc\ may be a trojan or a keylogger instead.
Is it safe to delete istsvc.exe?
Yes. It is not a Windows or system file, and the old report advises removing it once you know it is not associated with any system program. End the process first and delete the file and its folder, or it can restart and recreate itself.
Why does istsvc.exe keep coming back?
Because the process can restart itself after you end it, and the program that installed it usually still has a startup entry. Uninstall ISTBar in Settings > Apps, remove entries pointing to istsvc.exe in Autoruns, delete the folder, and scan with Microsoft Defender Offline scan to catch leftovers.
Where should istsvc.exe be located?
The ISTBar adware keeps it in C:\Program Files\ISTsvc\. Check that location through Task Manager: right-click istsvc.exe on the Details tab and choose Open file location. If it is anywhere else, you may have a more damaging threat such as a trojan or a keylogger.
Does ISTBar work in current browsers?
The old report describes a toolbar for Internet Explorer and other internet surfing apps. Internet Explorer was retired on 15 June 2022. Even so, leftover ISTBar files and startup entries can remain on an old installation, so inspect the extensions of every browser and run the removal steps.
Sources
- Neuber: istsvc.exe process description (ISTbar, Integrated Search Technologies)
- File.net: istsvc.exe and its antivirus detection names
- Microsoft Sysinternals: Autoruns
- Microsoft Learn: Microsoft Defender Offline scan
Version data read on Oct 5, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…