|
| Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free! |
HOTBAR nightmare
|
Original Message
|
Name: computerDummy
Date: March 15, 2004 at 20:17:27 Pacific
Subject: HOTBAR nightmare OS: 98 CPU/Ram: 128
|
Comment: Please help as I am a computer idiot. I guess that is why I have hotbar nightmares now. I continue to delete all of it from Spybot and I have gone to the registry to delete all signs as well... and it continues to infest my computer!!! Please help me!!! I am computer illiterate
Report Offensive Message For Removal
|
|
Response Number 1
|
Name: bonfire62
Date: March 15, 2004 at 20:52:55 Pacific
|
Reply: OK, after you use Spybot's "check for problems", Use Spybot's Immunize feature, which will block all the gay spyware
Report Offensive Follow Up For Removal
|
|
Response Number 2
|
Name: computerDummy
Date: March 15, 2004 at 21:29:19 Pacific
|
Reply: thanks bonfire62, but it has already been immunized. This hotbar has to be detected, deleted and immunized every day. It is embedded into my registry keys/files (whatever) and continues to update itself and I need to know how to get rid of it FOREVER and ever. Can ya think of anything else to try?? All help is so much appreciated!! I am computer illiterate
Report Offensive Follow Up For Removal
|
|
Response Number 3
|
Name: blender
Date: March 15, 2004 at 22:05:06 Pacific
|
Reply: ComputerDummy I think I worked with you on another problem a while back... You still have Hijackthis? If you do...run its scan, scan button changes to save log button, click save log, click save, when it opens up in notepad, hit ctrl+a keys to select all, right click in the window, select copy, right click in this window, select paste. If it asks you if you want to replace the other log you have say yes. In case you dont have hijackthis... Hijackthis! 1st file in the list. Make sure you make a seperate folder for it; call the folder hijack, and put hijackthis in that folder. _________________________________________ I never give up!Windows Update
Report Offensive Follow Up For Removal
|
|
Response Number 4
|
Name: computerDummy
Date: March 16, 2004 at 20:47:29 Pacific
|
Reply: Blender: Thanks so much! I have not worked with this program "Hijackthis" before. I will try what you said and download it etc.. but it says beofre I download it that it is intended for advanced users only. Can I mess anything up? Should I go word for word on your directions? Thanks again!! I am computer illiterate
Report Offensive Follow Up For Removal
|
|
Response Number 5
|
Name: blender
Date: March 17, 2004 at 08:21:31 Pacific
|
Reply: HI Computer D. Yes alot can be messed up with HijackThis if used improperly. Basically put Hijack is a program that will show what is starting up with windows...good and bad. It will show what toolbars are installed like google, yahoo, and your hotbar problem. It shows a pile of other stuff most users have a hard time understanding...but I study these "log files" several hours a day and am an advanced user. I fix problems like this on peoples computer almost every day. By doing what I told you above...you are not going to mess anything up...all you are doing at this point is making a log file for me to read. Once I read the file, I make a plan to remove whatever nasties you have installed the easiest, safest way possible. As long as you put it in its own folder like I told you above...if something does go wrong...we can recover it. You said above..you even tried deleting hotbar out of the registry....now that is a place to stay away from...you can do ALOT of damage there...HijackThis is safer. Yes when I tell you what to fix with hijack...follow exactly what I tell you and everything will be fine. When you download the hijackthis file; it will likely go to your desktop. Right click HijackThis.zip Select "extract to hijackthis1977" Now you have a folder on desktop called hijackthis1977. Open that folder and double click hijackthis.exe. Click scan Click save log Click save at the next window The log will popup in notepad Hit the "ctrl" key and "a" keys at same time All the text will go grey Right click the text Click copy Right click in this window Select paste. Wait for me to reply back...never mind anyone else. _______________________________________ I never give up!Windows Update
Report Offensive Follow Up For Removal
|
|
Response Number 6
|
Name: computerDummy
Date: March 18, 2004 at 11:46:27 Pacific
|
Reply: Logfile of HijackThis v1.97.7 Scan saved at 1:39:05 PM, on 3/18/04 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\PROGRAM FILES\NORTON UTILITIES\NPROTECT.EXE C:\WINDOWS\SYSTEM\TEXBUTIL.EXE C:\PROGRAM FILES\CISCO SYSTEMS\VPN CLIENT\CVPND.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\LAUNCHER.EXE C:\MOUSE\SYSTEM\EM_EXEC.EXE C:\WINDOWS\LOADQM.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\PROGRAM FILES\WINZIP\WINZIP32.EXE C:\WINDOWS\TEMP\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Program Files\Copernic 2001 Basic\Search Bar.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?p=%s O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL (file missing) O2 - BHO: ctor - {204F937E-519E-4597-96FA-8F1F59F3CB6D} - C:\WINDOWS\SYSTEM\CTOR.DLL O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [IrMon] IrMon.exe O4 - HKLM\..\Run: [PrimaLauncher] C:\WINDOWS\SYSTEM\Launcher.exe O4 - HKLM\..\Run: [EM_EXEC] C:\MOUSE\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton Utilities\NPROTECT.EXE O4 - HKLM\..\RunServices: [TExBUtil] TExBUtil.Exe O4 - HKLM\..\RunServices: [CVPND] "C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe" start O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup O8 - Extra context menu item: Search Using Copernic - C:\Program Files\Copernic 2001 Basic\Search Extension.htm O9 - Extra button: Copernic (HKLM) O9 - Extra 'Tools' menuitem: Launch Copernic 2001 (HKLM) O9 - Extra button: Translate (HKLM) O9 - Extra 'Tools' menuitem: &Translate Using Gist-In-Time (HKLM) O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O16 - DPF: {70A89DB7-5EC2-4790-AC34-0018FC2E61CB} (oucv3 Class) - http://officeupdate.microsoft.com/v3content/ouv3is.cab O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37915.816724537 O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe O16 - DPF: {999715EC-EDC8-44A7-8521-17A2EC4A755B} - http://download-ak.systemsoap.com/instilla/instilla-1.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinstc.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab I am computer illiterate
Report Offensive Follow Up For Removal
|
|
Response Number 7
|
Name: blender
Date: March 18, 2004 at 14:08:37 Pacific
|
Reply: Hi Computer D. Start hijackthis again and place a check beside the following entries: O2 - BHO: (no name) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL (file missing) O2 - BHO: ctor - {204F937E-519E-4597-96FA-8F1F59F3CB6D} - C:\WINDOWS\SYSTEM\CTOR.DLL O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup <- Spykiller is considered a questionable program, considered by most to be not very good. Some say it actually installs spyware so you will buy it for it to clean it. O16 - DPF: {999715EC-EDC8-44A7-8521-17A2EC4A755B} - http://download-ak.systemsoap.com/instilla/instilla-1.cab Once all are checked, close all open windows except hijack and click the "fix checked" button. Reboot the computer Since Spykiller is not a recommended program...you can uninstall it by going to add/remove programs in the control panel. To get there: Double click "my computer" on desktop Double click "control panel" Double click "add/remove programs" Scroll down the list until you see Spykiller Click spykiller once Click the "remove" button When it asks if you are sure you want to remove it...click Yes If you are told to reboot....then reboot the computer. Next we need to remove some folders: Double click "my computer" Double click the C: drive Double click the "program files" folder Right click the folder "spykiller" Select delete Click yes at the prompt Right click the folder "mywebsearch" Select delete Click yes at the prompt Close all those windows That's it! Keep spybot...it is a good program. Just to make sure you have no more hotbar....post a fresh hijack log. ________________________________________ I never give up!Windows Update
Report Offensive Follow Up For Removal
|
|
Response Number 8
|
Name: computerDummy
Date: March 18, 2004 at 20:42:18 Pacific
|
Reply: Logfile of HijackThis v1.97.7 Scan saved at 10:34:01 PM, on 3/18/04 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\PROGRAM FILES\NORTON UTILITIES\NPROTECT.EXE C:\WINDOWS\SYSTEM\TEXBUTIL.EXE C:\PROGRAM FILES\CISCO SYSTEMS\VPN CLIENT\CVPND.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\LAUNCHER.EXE C:\MOUSE\SYSTEM\EM_EXEC.EXE C:\WINDOWS\LOADQM.EXE C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Program Files\Copernic 2001 Basic\Search Bar.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?p=%s O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [IrMon] IrMon.exe O4 - HKLM\..\Run: [PrimaLauncher] C:\WINDOWS\SYSTEM\Launcher.exe O4 - HKLM\..\Run: [EM_EXEC] C:\MOUSE\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton Utilities\NPROTECT.EXE O4 - HKLM\..\RunServices: [TExBUtil] TExBUtil.Exe O4 - HKLM\..\RunServices: [CVPND] "C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe" start O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background O8 - Extra context menu item: Search Using Copernic - C:\Program Files\Copernic 2001 Basic\Search Extension.htm O9 - Extra button: Copernic (HKLM) O9 - Extra 'Tools' menuitem: Launch Copernic 2001 (HKLM) O9 - Extra button: Translate (HKLM) O9 - Extra 'Tools' menuitem: &Translate Using Gist-In-Time (HKLM) O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O16 - DPF: {70A89DB7-5EC2-4790-AC34-0018FC2E61CB} (oucv3 Class) - http://officeupdate.microsoft.com/v3content/ouv3is.cab O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37915.816724537 O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinstc.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab I am computer illiterate
Report Offensive Follow Up For Removal
|
|
Response Number 9
|
Name: computerDummy
Date: March 18, 2004 at 20:45:20 Pacific
|
Reply: Blender: there is the new logfile... I had already removed Spykiller and Spybot before you posted. When I went to Program Files to delete my websearch, there was no folder, but there WAS Hotbar!!! I want to sue this company big time. Hopefully your WONDERFUL and MUCH APPRECIATED help has worked and it is gone?? I am computer illiterate
Report Offensive Follow Up For Removal
|
|
Response Number 10
|
Name: blender
Date: March 18, 2004 at 21:45:05 Pacific
|
Reply: Computer D Looks like it has gone...Your log is clean. You said you saw a folder in your programs folder called hotbar....delete that too! Just go to my computer Double click on c: Double click the program files folder Right click the hotbar folder Select delete and yes at the prompt. Spybot is one program you should have kept...it is a good one. If you want to download it again...here is the link: Spybot Don't forget to keep it up to date. There is another program I recommend to help block this stuff like hotbar and 1200 other bad products from installing. Called Spywareblaster; it's small, free and doesn't use any memory. It just blocks bad downloads. You can download it here: Spywareblaster Choose any of the 4 sites listed at the bottom of the page. Once you install it, click "check for updates" Install all updates listed. Near the bottom of the spywareblaster window click the "select all" button, then click the "protect from selected items" button. You know you are protected when all the items in the list go from red to grey. No all those things in the list are not on your computer..it is just a list of stuff it blocks. Check that program for updates about once a week to stay protected. Each time you update you will need to click "select all" and protect from checked items" buttons again. Take care and all the best! ______________________________________ I never give up!Windows Update
Report Offensive Follow Up For Removal
|
|
Response Number 11
|
Name: computerDummy
Date: March 19, 2004 at 21:20:10 Pacific
|
Reply: Blender, I just did Adware scan and I still have Hotbar registry, and two tracking cookies from DoubleClick and Tribalfusion. Why is Hotbar able to reinvent itself on my system? It is still alive and well... any other solutions/suggestions to try?? I am computer illiterate
Report Offensive Follow Up For Removal
|
|
Response Number 12
|
Name: blender
Date: March 20, 2004 at 10:04:30 Pacific
|
Reply: Computer D As for the tracking cookies..I get those all the time just browsing the net. I do an ad-aware scan about once a week to clean those out...I have never considered them a big issue. I don't get too many though because of spywareblaster. Did you install spywareblaster? The Hotbar thing in the registry...If you just updated ad-aware and ran a scan; likely ad-aware didn't know about that registry key before...the varient you had was new. With the new update you got it was able to find it and remove it. Sometimes it takes a week or so for ad-aware and spybot to update their programs to remove spyware. The things I had told you to remove with Hijack just removed the files so hotbar couldn't run. You finished the cleanup by running Ad-aware. If you rescanned with ad-aware after having it remove those items and come up clean...you should be ok. If you didn't install spywareblaster yet...I would do it...that will help keep the junk off your computer. Just like I said above, you will need to remember to keep spywareblaster up to date as well to stay protected. ___________________________________ I never give up!Windows Update
Report Offensive Follow Up For Removal
|
|
Response Number 13
|
Name: computerDummy
Date: March 20, 2004 at 21:50:19 Pacific
|
Reply: Blender, I appreciate all of your help. I have run adware twice since "hijackthis" was done... Hotbar continues to be isolated and deleted and it keeps coming back!! It keeps coming back.. did I mention that it continues to come back?? Please see latest: Ad-aware 6 Scanning Result, 3-20-04 11:40:36 PM Created with Ad-aware Personal, free for private use. Vendor Type Category Object Comment HotBar RegKey Data Miner HKEY_CLASSES_ROOT:CLSID\{354382db-df55-4da9-85a3-41696a0f510f}\ HotBar RegKey Data Miner HKEY_CLASSES_ROOT:ctor.rter\ HotBar RegKey Data Miner HKEY_CLASSES_ROOT:ctor.rter.1\ HotBar RegKey Data Miner HKEY_CLASSES_ROOT:TYPELIB\{8c704add-1778-4609-b9a1-17915b67d45c}\ HotBar RegKey Data Miner HKEY_CLASSES_ROOT:CLSID\{6FB2639A-4BA3-4531-8DB8-FAB03E0A8FFD}\ HotBar RegKey Data Miner HKEY_CLASSES_ROOT:CLSID\{2873D2A1-0147-4802-BDC9-FF58F12F0787}\ HotBar RegKey Data Miner HKEY_CLASSES_ROOT:Interface\{2873D2A1-0147-4802-BDC9-FF58F12F0787}\ Tracking Cookie File Data Miner c:\windows\cookies\coolhires@questionmarket[3].txt Tracking Cookie File Data Miner c:\windows\cookies\coolhires@doubleclick[1].txt Tracking Cookie File Data Miner c:\windows\cookies\coolhires@atdmt[2].txt Tracking Cookie File Data Miner c:\windows\cookies\coolhires@mediaplex[1].txt Tracking Cookie File Data Miner c:\windows\cookies\coolhires@tribalfusion[1].txt Tracking Cookie File Data Miner c:\windows\cookies\coolhires@bluestreak[1].txt Tracking Cookie File Data Miner c:\windows\cookies\coolhires@findwhat[1].txt Tracking Cookie File Data Miner c:\windows\cookies\coolhires@dbbsrv[1].txt Tracking Cookie File Data Miner c:\windows\cookies\coolhires@2o7[1].txt Tracking Cookie File Data Miner c:\windows\cookies\coolhires@questionmarket[1].txt Tracking Cookie File Data Miner c:\windows\cookies\coolhires@edge.ru4[2].txt HotBar RegKey Data Miner HKEY_CLASSES_ROOT:AppID\{986B8017-1554-4BFB-A976-2DA7462C5C3D}\ HotBar RegKey Data Miner HKEY_CLASSES_ROOT:Interface\{7138714C-9819-4AB1-9A86-E7C413C9A99E}\ HotBar RegKey Data Miner HKEY_CLASSES_ROOT:Interface\{927420A3-7259-4A74-B402-9329177EC3FC}\ HotBar RegKey Data Miner HKEY_CLASSES_ROOT:Interface\{BC2025DC-136B-492F-AEFF-31D0BA8B98DA}\ HotBar RegKey Data Miner HKEY_CLASSES_ROOT:AppID\ctor.DLL\ I am computer illiterate
Report Offensive Follow Up For Removal
|
|
Response Number 14
|
Name: epolanowskirn
Date: March 21, 2004 at 18:08:45 Pacific
|
Reply: I have recently been infested with hotbar, and had the same trouble with reinstal as you describe. Locate ctor.dll in windows1\system32 file and delete it. re-run spybot or adaware, delete the keys it identifies. They wont reinstal
Report Offensive Follow Up For Removal
|
|
Response Number 15
|
Name: blender
Date: March 21, 2004 at 21:26:30 Pacific
|
Reply: Computer D There must be a program that does not show up in hijack that keeps loading that hotbar... Can you give me a list of the programs on your computer? Click start Point to settings Click control panel Double click add remove programs. If "Hotbar" or "Web Tools by Hotbar" is there again hilight it and click remove. There might be another program to remove that is re infecting you with hotbar so I will need the whole list from your add/remove programs. Then run ad-aware again to remove the registry entries. They have another update available. I never give up!Windows Update
Report Offensive Follow Up For Removal
|
|
Response Number 17
|
Name: computerDummy
Date: March 22, 2004 at 19:31:36 Pacific
|
Reply: Blender has done it again!!!! Right on!!! Thank you so very much! You rock!!! I am computer illiterate
Report Offensive Follow Up For Removal
|
|
Response Number 19
|
Name: johnnywasnaked
Date: April 6, 2004 at 19:03:56 Pacific
|
Reply: hahahahah hahahahaha hahah. ahem. i personally would reformat and reinstall.
Report Offensive Follow Up For Removal
|
|
Response Number 20
|
Name: CompIdiot
Date: April 10, 2004 at 23:41:25 Pacific
|
Reply: why would you reformat and reinstall? WHAT would you reformat and reinstall?? I am computer illiterate
Report Offensive Follow Up For Removal
|
|
Response Number 21
|
Name: Tigerlily23
Date: April 14, 2004 at 13:19:51 Pacific
|
Reply: I was also a victim of the hotbar nightmare. I went into the control panel and removed the programs. I downloaded ad-aware 6.0 and it found 40-some items which I deleted. It seems to have fixed the hotbar problem. However, everytime I restart my computer I get two messages 1.) Cannot locate bridge.dll 2.) Cannot locate Instilla.exe Any suggestions to make this stop happening would be greatly appreciated!. Thanks.
Report Offensive Follow Up For Removal
|
|
Response Number 22
|
Name: hkuhl
Date: April 22, 2004 at 05:36:38 Pacific
|
Reply: Ask Blender for the link to CWShredder, and try that. I never installed Hotbar, cause I looked at it, and I saw that it was too good to be true, and it was just a bunch of spyware crap.
Report Offensive Follow Up For Removal
|

Post Locked
This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
Go to Security and Virus Forum Home
Results for: HOTBAR nightmare
Help me get rid of HOTBAR.. please! Summary: Please help as I am a computer idiot. I guess that is why I have hotbar nightmares now. I continue to delete all of it from Spybot and I have gone to the registry to delete all signs as well... and it... www.computing.net/answers/security/help-me-get-rid-of-hotbar-please/10524.html
W32.apolre Summary: hi carrol, if the worm is aplore and not apolre, here's some info for you: This worm combines a VBS mass-mailing routine and includes an IRC bot which may allow an attacker to gain remote access to th... www.computing.net/answers/security/w32apolre/2848.html
virus alert!!!!! Summary: nortons alert on swen it sounds bad becarefull What is W32.Swen.A@mm and how does it affect me? W32.Swen.A@mm is a mass-mailing worm that uses its own SMTP engine to spread itself. It attempts to spre... www.computing.net/answers/security/virus-alert/6536.html
|
|

|