ISTbar Embedded in Registry

[AttaGirl42]

Hello

I need some help and advice on how to safely remove ISTbar from my system. It currently shows up in:

HKEY_CLASSES_ROOT\aspfile\persistenthandler

I have detected it using Spy Emergency 2005. It removes it, or atleast it shows it does, and if I run another scan after removing it, it does not detect it. But, the next day, when I run a regular scan again, there it is....in the same place.

I also run Ad-Aware, AVG, Xoftspy, Spyware Doctor. None of these seem to detect it. Only the Spy Emergency 2005 seems to find it.

I know that the persistent handler has to do with functions like copy and paste and I wonder if this is why, lately, I run my mouse over something to copy and it takes several swipes to get it all highlighted so I can copy?

Any help will be greatly appreciated. If you need any other information, just let me know!

Thanks So Very Much!!!!

[SpywareDr]

Ad-Aware, AVG and Spyware Doctor are known-good, respectable products. Spy Emergency and XoftSpy, on the other hand, have both had some problems. And XoftSpy has used questionable tactics.

Rogue/Suspect Anti-Spyware Products
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Note on Spy Emergency 2005: Spy Emergency was listed on this page because of concerns with false positives and the nature of its detections. In late March 2005, a new version of Spy Emergency was released. Testing with this new version indicates that the problems with earlier versions have been satisfactorily resolved. Thus, we can no longer consider Spy Emergency to be "rogue/suspect" anti-spyware.

Note on XoftSpy: XoftSpy was listed on this page because of concerns with false positives (1, 2, 3, 4), questionable license terms, and the use of aggressive, deceptive advertising (1, 2), including exploitation of the name "spybot" by affiliates. Earlier versions of XoftSpy were also Ad-aware knockoffs. (There was clone of XoftSpy named SpyBurn, but that application is no longer available.)

Over the past few months, XoftSpy has taken aggressive steps to reign in its affiliates (who were primarily responsible for the unsavory advertising), revised its license text, and released a new version of XoftSpy (version 4.0) that addresses our concerns with false positves. Given these changes we can no longer regard XoftSpy as "rogue/suspect" anti-spyware.

(Note: other domains associated with XoftSpy include: adware-destroyer.com, adware-elimination.com, adwarekillers.com, adware-real-free-scan.com, adwares.net, anti-adware.net, antispywares.com, deletespyware.net, nomorespyware.net, removespyware.net, softspy.net, softwho.com, spywarebest.com, spyware-detection.net, spywareprof.com, spywarepurge.com, spywarerem.com, spywareremoval.net) [A: 6-26-04 / U: 12-7-04]

[AttaGirl42]

Thanks for the info! I wasn't aware of these things. My version of Xsoftspy is 4.15 and my version of Spy Emergency is 2005 Build 2.0.290.

Since posting, I downloaded Kaspersky for the 30 day trial and ran a complete scan...oh my goodness....I had it check every little file and it took a couple of hours. LOL But.... it found 3 trojan ISTbars I didn't know I had and now it seems my system is spic and span! Guess I'll be buying a license for Kaspersky and maybe let it be my main one!

Thanks!!