Hotbar

Hi. Everytime my wife starts up her user account she gets a warning from microsoft anti spyware saying that hotbar is trying to install itself. She allows this to be removed but the next time she starts up it hapens again etc. I've scanned with avg, spybot SD and ad-aware se and they've found nothing. I've looked in previous threads and went to the symantec website and downloaded a hotbar removing tool, and this found nothing as well. It only happens on my wifes user account. I guess I need to remove something from the registry settings, so a nudge and a poke in the right direction would be helpful.
Many thanks.

 

Hotbar should be removable from ‘Add/Remove Programs’ on the Control Panel, under the name ‘Hotbar’ or ‘Web Tools by Hotbar’.

 

There's nothing there to remove!!!

 

Please follow the steps below:

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

• Make sure you check version numbers and get all updates.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis:

Downloading, Installing, and Running HijackThis

 

Hi, I'm so sorry for not replying sooner but I've been very, very busy this week.
Anyway I've run through the read first thread procedure and nothing to do with hotbar has been found, only Ad-aware and panda activescan came back with anything( reports attached along with HJT).
Anyway after doing all the above my wife went onto her user name and up comes a warning from microsoft antispyware saying hotbar is trying to inatall an internet browser??? HELP!!!!!!

 

Scan with HijackThis and fix teh following:

Download
- Registry Search Tool

Unzip to your Desktop and double click on regsrch.vbs
(if you have script protection, please allow this to run)

In the dialog that opens enter the following:

Press 'OK'

The search will run for a while then alert you when it is finished.

Press 'OK' and copy the contents of the WordPad window and post in this thread

 

Hi. I've done everything as requested and posted the the results of the scan. Sorry, I've just remembered something, yesterday I couldn't complete a scan with Panda Activescan in safe mode. When asked to view the results I kept on getting a message saying about needing to connect to the internet even though i'm on broadband cable and it came up about a VB script error. I managed the scan though in normal mode. Sorry about not mentioning this before.

 

WUPD is a part of Webroot's Window Washer.

Post a fresh HijackThis log.

How is your computer running?

 

Hi. The computer is running fine, except for when the wife uses her user name and this hotbar warning keeps on coming up, never on my user name. Sometimes It also comes up with some warning from microsoft anti spyware about choosing a left or right something( I haven't seen this warning for a little while so I can't remember exactly what it is), but apart from that its fine, just annoying really as microsoft antispyware says that its removed the threat. Anyway i've attached a HJT log as requested.

 

The log is clean.

You will have to run the cleaning procedures under her profile to get rid of Hotbar.

Once finished post the logs for her profile.

 

Hi. I've ran through the cleaning procedures on my wifes profile and Spybot SD found hotbar and removed 4 entries for it. Panda active scan found a few bits ( scan log attached) that nothing else has picked up, so some removal tips for this would be very much appresiated. Also included is a HJT logfile. Many thanks.

 

Export the contents of this registry key, HKEY_CURRENT_USER\SOFTWARE\MATRIX_HTML.

Attach the file. Make sure you change the extension from reg to txt, before posting.

 

HI. I've exported the contents of the registry key as requested( Hope I've done this correctly). Not sure if its worth mentioning, but when my wife 1st starts up her profile she no longer gets a red hotbar warning from microsoft antispyware, but instead a blue warning comes up saying that a web browser requires permission to install. Many thanks.

 

Follow the directions for Running Spy Sweeper. Make sure you update the definitions before scanning your system.

That should get rid of Hotbar.

 

Hi. I've ran spy sweeper and everything seems to be ok now. Many thanks for your time and effort. Although you never asked for them I've included logs for spy sweeper and HJT just in case they are required.

 

Sorry to be a pain but my wife has informed me that when she first starts up her profile she is still getting a blue warning from microsoft anti spyware saying that a web browser needs permission to install. Also, in the last 2 days when I start up my profile I now get a green warning from microsoft anti spyware saying something about it blocking something to do with a shell library? The warning is gone before i can write down what it has actually blocked.

 

Red = BAD
Green = OK
Blue = Informational; User interaction required.

 

Scan with HijackThis and fix:

How is your computer running?

Are you still getting Hotbar alerts?

 

Hi. I've got HJT to fix the required and everything is just the same, On my wifes profile she still gets a blue warning from microsoft anti spyware, but I'm guessing that this is ok. There is no specific mention of hotbar anywhere.

 

That may go on for a while. Changes were made when we removed the infections. MSAS will alert until it doesn't see anymore changes.

Disable System Restore and then enable System Restore. This will flush all your restore points and create a new clean one for your system.

System Restore
How to Protect yourself from malware!

Safe surfing.