Computing.Net > Forums > Security and Virus > HOTBAR nightmare

Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free!

HOTBAR nightmare

Reply to Message Icon

Original Message
Name: computerDummy
Date: March 15, 2004 at 20:17:27 Pacific
Subject: HOTBAR nightmare
OS: 98
CPU/Ram: 128
Comment:

Please help as I am a computer idiot. I guess that is why I have hotbar nightmares now. I continue to delete all of it from Spybot and I have gone to the registry to delete all signs as well... and it continues to infest my computer!!! Please help me!!!

I am computer illiterate


Report Offensive Message For Removal


Response Number 1
Name: bonfire62
Date: March 15, 2004 at 20:52:55 Pacific
Reply:

OK, after you use Spybot's "check for problems", Use Spybot's Immunize feature, which will block all the gay spyware


Report Offensive Follow Up For Removal

Response Number 2
Name: computerDummy
Date: March 15, 2004 at 21:29:19 Pacific
Reply:

thanks bonfire62, but it has already been immunized. This hotbar has to be detected, deleted and immunized every day. It is embedded into my registry keys/files (whatever) and continues to update itself and I need to know how to get rid of it FOREVER and ever. Can ya think of anything else to try?? All help is so much appreciated!!


I am computer illiterate


Report Offensive Follow Up For Removal

Response Number 3
Name: blender
Date: March 15, 2004 at 22:05:06 Pacific
Reply:

ComputerDummy

I think I worked with you on another problem a while back...
You still have Hijackthis? If you do...run its scan, scan button changes to save log button, click save log, click save, when it opens up in notepad, hit ctrl+a keys to select all, right click in the window, select copy, right click in this window, select paste.
If it asks you if you want to replace the other log you have say yes.

In case you dont have hijackthis...

Hijackthis!

1st file in the list.
Make sure you make a seperate folder for it; call the folder hijack, and put hijackthis in that folder.
_________________________________________

I never give up!

Windows Update


Report Offensive Follow Up For Removal

Response Number 4
Name: computerDummy
Date: March 16, 2004 at 20:47:29 Pacific
Reply:

Blender: Thanks so much! I have not worked with this program "Hijackthis" before. I will try what you said and download it etc.. but it says beofre I download it that it is intended for advanced users only. Can I mess anything up? Should I go word for word on your directions? Thanks again!!

I am computer illiterate


Report Offensive Follow Up For Removal

Response Number 5
Name: blender
Date: March 17, 2004 at 08:21:31 Pacific
Reply:

HI Computer D.

Yes alot can be messed up with HijackThis if used improperly.
Basically put Hijack is a program that will show what is starting up with windows...good and bad.
It will show what toolbars are installed like google, yahoo, and your hotbar problem.
It shows a pile of other stuff most users have a hard time understanding...but I study these "log files" several hours a day and am an advanced user. I fix problems like this on peoples computer almost every day.
By doing what I told you above...you are not going to mess anything up...all you are doing at this point is making a log file for me to read.
Once I read the file, I make a plan to remove whatever nasties you have installed the easiest, safest way possible.
As long as you put it in its own folder like I told you above...if something does go wrong...we can recover it.
You said above..you even tried deleting hotbar out of the registry....now that is a place to stay away from...you can do ALOT of damage there...HijackThis is safer.
Yes when I tell you what to fix with hijack...follow exactly what I tell you and everything will be fine.
When you download the hijackthis file; it will likely go to your desktop.
Right click HijackThis.zip
Select "extract to hijackthis1977"
Now you have a folder on desktop called hijackthis1977.
Open that folder and double click hijackthis.exe.
Click scan
Click save log
Click save at the next window
The log will popup in notepad
Hit the "ctrl" key and "a" keys at same time
All the text will go grey
Right click the text
Click copy
Right click in this window
Select paste.

Wait for me to reply back...never mind anyone else.
_______________________________________


I never give up!

Windows Update


Report Offensive Follow Up For Removal


Response Number 6
Name: computerDummy
Date: March 18, 2004 at 11:46:27 Pacific
Reply:

Logfile of HijackThis v1.97.7
Scan saved at 1:39:05 PM, on 3/18/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\NORTON UTILITIES\NPROTECT.EXE
C:\WINDOWS\SYSTEM\TEXBUTIL.EXE
C:\PROGRAM FILES\CISCO SYSTEMS\VPN CLIENT\CVPND.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\LAUNCHER.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Program Files\Copernic 2001 Basic\Search Bar.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?p=%s
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL (file missing)
O2 - BHO: ctor - {204F937E-519E-4597-96FA-8F1F59F3CB6D} - C:\WINDOWS\SYSTEM\CTOR.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [PrimaLauncher] C:\WINDOWS\SYSTEM\Launcher.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\MOUSE\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [TExBUtil] TExBUtil.Exe
O4 - HKLM\..\RunServices: [CVPND] "C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe" start
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O8 - Extra context menu item: Search Using Copernic - C:\Program Files\Copernic 2001 Basic\Search Extension.htm
O9 - Extra button: Copernic (HKLM)
O9 - Extra 'Tools' menuitem: Launch Copernic 2001 (HKLM)
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: &Translate Using Gist-In-Time (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {70A89DB7-5EC2-4790-AC34-0018FC2E61CB} (oucv3 Class) - http://officeupdate.microsoft.com/v3content/ouv3is.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37915.816724537
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {999715EC-EDC8-44A7-8521-17A2EC4A755B} - http://download-ak.systemsoap.com/instilla/instilla-1.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinstc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab

I am computer illiterate


Report Offensive Follow Up For Removal

Response Number 7
Name: blender
Date: March 18, 2004 at 14:08:37 Pacific
Reply:

Hi Computer D.

Start hijackthis again and place a check beside the following entries:

O2 - BHO: (no name) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL (file missing)

O2 - BHO: ctor - {204F937E-519E-4597-96FA-8F1F59F3CB6D} - C:\WINDOWS\SYSTEM\CTOR.DLL

O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup <- Spykiller is considered a questionable program, considered by most to be not very good. Some say it actually installs spyware so you will buy it for it to clean it.

O16 - DPF: {999715EC-EDC8-44A7-8521-17A2EC4A755B} - http://download-ak.systemsoap.com/instilla/instilla-1.cab

Once all are checked, close all open windows except hijack and click the "fix checked" button.

Reboot the computer

Since Spykiller is not a recommended program...you can uninstall it by going to add/remove programs in the control panel.

To get there:

Double click "my computer" on desktop
Double click "control panel"
Double click "add/remove programs"
Scroll down the list until you see Spykiller
Click spykiller once
Click the "remove" button
When it asks if you are sure you want to remove it...click Yes

If you are told to reboot....then reboot the computer.

Next we need to remove some folders:

Double click "my computer"
Double click the C: drive
Double click the "program files" folder

Right click the folder "spykiller"
Select delete
Click yes at the prompt

Right click the folder "mywebsearch"
Select delete
Click yes at the prompt

Close all those windows

That's it!

Keep spybot...it is a good program.

Just to make sure you have no more hotbar....post a fresh hijack log.
________________________________________

I never give up!

Windows Update


Report Offensive Follow Up For Removal

Response Number 8
Name: computerDummy
Date: March 18, 2004 at 20:42:18 Pacific
Reply:

Logfile of HijackThis v1.97.7
Scan saved at 10:34:01 PM, on 3/18/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\NORTON UTILITIES\NPROTECT.EXE
C:\WINDOWS\SYSTEM\TEXBUTIL.EXE
C:\PROGRAM FILES\CISCO SYSTEMS\VPN CLIENT\CVPND.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\LAUNCHER.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Program Files\Copernic 2001 Basic\Search Bar.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?p=%s
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [PrimaLauncher] C:\WINDOWS\SYSTEM\Launcher.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\MOUSE\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [TExBUtil] TExBUtil.Exe
O4 - HKLM\..\RunServices: [CVPND] "C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe" start
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O8 - Extra context menu item: Search Using Copernic - C:\Program Files\Copernic 2001 Basic\Search Extension.htm
O9 - Extra button: Copernic (HKLM)
O9 - Extra 'Tools' menuitem: Launch Copernic 2001 (HKLM)
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: &Translate Using Gist-In-Time (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {70A89DB7-5EC2-4790-AC34-0018FC2E61CB} (oucv3 Class) - http://officeupdate.microsoft.com/v3content/ouv3is.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37915.816724537
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinstc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab

I am computer illiterate


Report Offensive Follow Up For Removal

Response Number 9
Name: computerDummy
Date: March 18, 2004 at 20:45:20 Pacific
Reply:

Blender: there is the new logfile...

I had already removed Spykiller and Spybot before you posted.

When I went to Program Files to delete my websearch, there was no folder, but there WAS Hotbar!!! I want to sue this company big time. Hopefully your WONDERFUL and MUCH APPRECIATED help has worked and it is gone??

I am computer illiterate


Report Offensive Follow Up For Removal

Response Number 10
Name: blender
Date: March 18, 2004 at 21:45:05 Pacific
Reply:

Computer D

Looks like it has gone...Your log is clean.

You said you saw a folder in your programs folder called hotbar....delete that too!
Just go to my computer
Double click on c:
Double click the program files folder
Right click the hotbar folder
Select delete and yes at the prompt.

Spybot is one program you should have kept...it is a good one.

If you want to download it again...here is the link:

Spybot

Don't forget to keep it up to date.

There is another program I recommend to help block this stuff like hotbar and 1200 other bad products from installing.

Called Spywareblaster; it's small, free and doesn't use any memory. It just blocks bad downloads.

You can download it here:

Spywareblaster

Choose any of the 4 sites listed at the bottom of the page.
Once you install it, click "check for updates"
Install all updates listed.
Near the bottom of the spywareblaster window click the "select all" button, then click the "protect from selected items" button.
You know you are protected when all the items in the list go from red to grey.
No all those things in the list are not on your computer..it is just a list of stuff it blocks.
Check that program for updates about once a week to stay protected.
Each time you update you will need to click "select all" and protect from checked items" buttons again.

Take care and all the best!
______________________________________

I never give up!

Windows Update


Report Offensive Follow Up For Removal

Response Number 11
Name: computerDummy
Date: March 19, 2004 at 21:20:10 Pacific
Reply:

Blender,

I just did Adware scan and I still have Hotbar registry, and two tracking cookies from DoubleClick and Tribalfusion. Why is Hotbar able to reinvent itself on my system? It is still alive and well... any other solutions/suggestions to try??

I am computer illiterate


Report Offensive Follow Up For Removal

Response Number 12
Name: blender
Date: March 20, 2004 at 10:04:30 Pacific
Reply:

Computer D

As for the tracking cookies..I get those all the time just browsing the net. I do an ad-aware scan about once a week to clean those out...I have never considered them a big issue. I don't get too many though because of spywareblaster.
Did you install spywareblaster?

The Hotbar thing in the registry...If you just updated ad-aware and ran a scan; likely ad-aware didn't know about that registry key before...the varient you had was new. With the new update you got it was able to find it and remove it. Sometimes it takes a week or so for ad-aware and spybot to update their programs to remove spyware.

The things I had told you to remove with Hijack just removed the files so hotbar couldn't run.
You finished the cleanup by running Ad-aware. If you rescanned with ad-aware after having it remove those items and come up clean...you should be ok.

If you didn't install spywareblaster yet...I would do it...that will help keep the junk off your computer. Just like I said above, you will need to remember to keep spywareblaster up to date as well to stay protected.
___________________________________

I never give up!

Windows Update


Report Offensive Follow Up For Removal

Response Number 13
Name: computerDummy
Date: March 20, 2004 at 21:50:19 Pacific
Reply:

Blender,

I appreciate all of your help. I have run adware twice since "hijackthis" was done... Hotbar continues to be isolated and deleted and it keeps coming back!! It keeps coming back.. did I mention that it continues to come back?? Please see latest:

Ad-aware 6 Scanning Result, 3-20-04 11:40:36 PM
Created with Ad-aware Personal, free for private use.
Vendor Type Category Object Comment
HotBar RegKey Data Miner HKEY_CLASSES_ROOT:CLSID\{354382db-df55-4da9-85a3-41696a0f510f}\
HotBar RegKey Data Miner HKEY_CLASSES_ROOT:ctor.rter\
HotBar RegKey Data Miner HKEY_CLASSES_ROOT:ctor.rter.1\
HotBar RegKey Data Miner HKEY_CLASSES_ROOT:TYPELIB\{8c704add-1778-4609-b9a1-17915b67d45c}\
HotBar RegKey Data Miner HKEY_CLASSES_ROOT:CLSID\{6FB2639A-4BA3-4531-8DB8-FAB03E0A8FFD}\
HotBar RegKey Data Miner HKEY_CLASSES_ROOT:CLSID\{2873D2A1-0147-4802-BDC9-FF58F12F0787}\
HotBar RegKey Data Miner HKEY_CLASSES_ROOT:Interface\{2873D2A1-0147-4802-BDC9-FF58F12F0787}\
Tracking Cookie File Data Miner c:\windows\cookies\coolhires@questionmarket[3].txt
Tracking Cookie File Data Miner c:\windows\cookies\coolhires@doubleclick[1].txt
Tracking Cookie File Data Miner c:\windows\cookies\coolhires@atdmt[2].txt
Tracking Cookie File Data Miner c:\windows\cookies\coolhires@mediaplex[1].txt
Tracking Cookie File Data Miner c:\windows\cookies\coolhires@tribalfusion[1].txt
Tracking Cookie File Data Miner c:\windows\cookies\coolhires@bluestreak[1].txt
Tracking Cookie File Data Miner c:\windows\cookies\coolhires@findwhat[1].txt
Tracking Cookie File Data Miner c:\windows\cookies\coolhires@dbbsrv[1].txt
Tracking Cookie File Data Miner c:\windows\cookies\coolhires@2o7[1].txt
Tracking Cookie File Data Miner c:\windows\cookies\coolhires@questionmarket[1].txt
Tracking Cookie File Data Miner c:\windows\cookies\coolhires@edge.ru4[2].txt
HotBar RegKey Data Miner HKEY_CLASSES_ROOT:AppID\{986B8017-1554-4BFB-A976-2DA7462C5C3D}\
HotBar RegKey Data Miner HKEY_CLASSES_ROOT:Interface\{7138714C-9819-4AB1-9A86-E7C413C9A99E}\
HotBar RegKey Data Miner HKEY_CLASSES_ROOT:Interface\{927420A3-7259-4A74-B402-9329177EC3FC}\
HotBar RegKey Data Miner HKEY_CLASSES_ROOT:Interface\{BC2025DC-136B-492F-AEFF-31D0BA8B98DA}\
HotBar RegKey Data Miner HKEY_CLASSES_ROOT:AppID\ctor.DLL\


I am computer illiterate


Report Offensive Follow Up For Removal

Response Number 14
Name: epolanowskirn
Date: March 21, 2004 at 18:08:45 Pacific
Reply:

I have recently been infested with hotbar, and had the same trouble with reinstal as you describe. Locate ctor.dll in windows1\system32 file and delete it. re-run spybot or adaware, delete the keys it identifies. They wont reinstal


Report Offensive Follow Up For Removal

Response Number 15
Name: blender
Date: March 21, 2004 at 21:26:30 Pacific
Reply:

Computer D

There must be a program that does not show up in hijack that keeps loading that hotbar...
Can you give me a list of the programs on your computer?
Click start
Point to settings
Click control panel
Double click add remove programs.

If "Hotbar" or "Web Tools by Hotbar" is there again hilight it and click remove.
There might be another program to remove that is re infecting you with hotbar so I will need the whole list from your add/remove programs.

Then run ad-aware again to remove the registry entries. They have another update available.


I never give up!

Windows Update


Report Offensive Follow Up For Removal

Response Number 16
Name: Dog
Date: March 22, 2004 at 04:21:12 Pacific
Reply:

Look at this
http://www.pchell.com/support/hotbar.shtml


It works for me

D4


Report Offensive Follow Up For Removal

Response Number 17
Name: computerDummy
Date: March 22, 2004 at 19:31:36 Pacific
Reply:

Blender has done it again!!!! Right on!!! Thank you so very much! You rock!!!

I am computer illiterate


Report Offensive Follow Up For Removal

Response Number 18
Name: blender
Date: March 23, 2004 at 01:16:38 Pacific
Reply:

Computer D

Glad it finally worked!

Keep that spywareblaster up to date to prevent re-occurance. :)

I never give up!

Windows Update


Report Offensive Follow Up For Removal

Response Number 19
Name: johnnywasnaked
Date: April 6, 2004 at 19:03:56 Pacific
Reply:

hahahahah hahahahaha hahah. ahem. i personally would reformat and reinstall.


Report Offensive Follow Up For Removal

Response Number 20
Name: CompIdiot
Date: April 10, 2004 at 23:41:25 Pacific
Reply:

why would you reformat and reinstall? WHAT would you reformat and reinstall??

I am computer illiterate


Report Offensive Follow Up For Removal

Response Number 21
Name: Tigerlily23
Date: April 14, 2004 at 13:19:51 Pacific
Reply:

I was also a victim of the hotbar nightmare. I went into the control panel and removed the programs. I downloaded ad-aware 6.0 and it found 40-some items which I deleted. It seems to have fixed the hotbar problem. However, everytime I restart my computer I get two messages
1.) Cannot locate bridge.dll
2.) Cannot locate Instilla.exe
Any suggestions to make this stop happening would be greatly appreciated!. Thanks.


Report Offensive Follow Up For Removal

Response Number 22
Name: hkuhl
Date: April 22, 2004 at 05:36:38 Pacific
Reply:

Ask Blender for the link to CWShredder, and try that. I never installed Hotbar, cause I looked at it, and I saw that it was too good to be true, and it was just a bunch of spyware crap.


Report Offensive Follow Up For Removal






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home



Results for: HOTBAR nightmare

Help me get rid of HOTBAR.. please!
    Summary: Please help as I am a computer idiot. I guess that is why I have hotbar nightmares now. I continue to delete all of it from Spybot and I have gone to the registry to delete all signs as well... and it...
www.computing.net/answers/security/help-me-get-rid-of-hotbar-please/10524.html

W32.apolre
    Summary: hi carrol, if the worm is aplore and not apolre, here's some info for you: This worm combines a VBS mass-mailing routine and includes an IRC bot which may allow an attacker to gain remote access to th...
www.computing.net/answers/security/w32apolre/2848.html

virus alert!!!!!
    Summary: nortons alert on swen it sounds bad becarefull What is W32.Swen.A@mm and how does it affect me? W32.Swen.A@mm is a mass-mailing worm that uses its own SMTP engine to spread itself. It attempts to spre...
www.computing.net/answers/security/virus-alert/6536.html








Which MP3 player do you have?

iPod/iPhone
Zune
Something Else
None


View Results

Poll Finishes In 2 Days.
Discuss in The Lounge
Poll History






Data Recovery Software