Description

Huntbar (HuntBar/Btiein and variants, including HuntBar/Ctoolb, HuntBar/MSLink, Huntbar/QDow, HuntBar/Side, HuntBar/WebSearch; also is similar to the IBIS Toolbar) is a browser hijacker that resets the start and search pages in IE. It also delivers targeted pop-up ads to the PC. Huntbar is part of the TrafficSyndicate "contextual marketing solution" developed by First Cash Reserve. The company promotes its TrafficSyndicate technology to any company that wants to redirect traffic to its site in order to generate "a powerful residual revenue stream" (again, in the words of First Cash Reserve).

An ActiveX control, Huntbar will attempt to install itself on your system when you visit any site affiliated with First Cash Reserve or TrafficSyndicate.

How To Tell If Huntbar Is Present On Your System

The browser attempts to redirect searches to Huntbar.com. (The attempts will fail, however, as Huntbar.com has been out of commission for more than a year.) It's also known to have an adverse effect on browser performance and may cause browser crashes and error messages.

How To Get Rid Of Huntbar With Spybot S&D

All of the major anti-spyware utilities will recognize and remove variants of Huntbar. To remove Huntbar with Spybot S&D, open the utility and click Check For Problems. Spybot S&D will take a few minutes to search your system. When the scan is complete, click Fix Selected Problems. Click Yes to confirm that you want to remove the selected files. Spybot S&D may prompt you to reboot your system so it can complete the removal process.

WARNING: The following section includes step-by-step information on how to edit the Windows Registry, a large database containing system and program settings that are essential to how the OS (operating system) operates. Follow Registry-editing instructions to the letter and be sure to make a backup of your Registry before you begin. (Registry errors can render your computer inoperable if you don't have a backup.) This procedure differs depending on the OS you use. For more information on backing up and editing the Registry, see these articles: "Protect Yourself" and "Register Here."

How To Get Rid Of Huntbar Manually

For best results, you should manually remove Huntbar. One option for doing so involves the Huntbar uninstallers (if available). Open the Add Or Remove Programs (Add/Remove Programs Properties in WinMe and Win98) dialog box and scan its list of installed programs for references to Huntbar. You also should look for references to Internet 404, MSEITS, Search Toolbar, Tools For Internet Explorer, and TrafficSyndicate. Highlight any of the Huntbar-related components you find, click the Remove or Add/Remove button, and follow the on-screen instructions to complete the uninstall. Repeat the procedure for all remaining Huntbar-related components installed on your PC.

Unfortunately, the Huntbar uninstallers may leave quite a bit of residue on your system. Thus, we suggest unregistering the DLL (dynamic link library) files, flushing out the Registry, and deleting the related folders and files. Start by rebooting into Safe Mode. You can do so by holding down the F8 key or CTRL key (or pressing the key repeatedly in one-second intervals, depending on your system) while restarting your PC and selecting Safe Mode from the resulting Windows Startup Menu. When Windows starts in Safe Mode, open the Registry Editor and delete the following keys and values (if present):

•HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\WinTools

•HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\TB_setup

•HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\TBPS

•HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\EXPLORER\
BROWSER HELPER OBJECTS\{87766247-311C-43B4-8499-3D5FEC94A183}

•HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WINTOOLSSVC

Close the Registry Editor and reboot normally. Use the Windows search utility to locate the following Huntbar-related DLLs: Btiein.dll, Btlink.dll, Msiein.dll, Msielink.dll, Msiets.dll, Qdow.dll, Stoolbar.dll, Toolbar.dll, and Wtoolsb.dll. Make a note of which files are installed on your system and where they are located (including the full path name, such as C:\WINDOWS\SYSTEM32\Msiein.dll). Then, open the Start menu and burrow through the All Programs (Programs in WinMe and Win98) and Accessories submenus to locate the Command Prompt (MS-DOS Prompt in WinMe and Win98) option. Click it once to open the Command Prompt (MS-DOS Prompt in WinMe and Win98) window. At the prompt, type cd.. and press ENTER. Repeat until you access a command prompt that looks like this: C:\> (where C is the letter representing the Windows drive). Next, type cd windows and press ENTER. Then, type cd system32 (cd system in WinMe and Win98) and press ENTER again. The resulting prompt should look like this: C:\WINDOWS\SYSTEM32> (C:\WINDOWS\SYSTEM> in WinMe and Win98).

In either case, type regsvr32 /u followed immediately by the location and name of a Huntbar-related DLL file installed on your system. The location of the file should be enclosed in quotation marks (for example: regsvr32 /u "program files\search toolbar\stoolbar.dll"). Press ENTER to unregister the DLL file. Repeat for each Huntbar-related DLL file on your PC. When you finish, type exit at the command prompt and press ENTER to close the window.

Reboot your system. Now you must flush out the Registry some more. Open the Edit menu in the Registry Editor and select Find. Type msiets in the Find What field and click the Find Next button. Delete any matching keys or values from inside the HKEY_CURRENT_USER hive. When the search is complete, repeat the process to find and delete any keys or values that refer to btiein, btlink, msiein, msiets, msietslink, search toolbar, wintools, {0A5CF411-F0BF-4AF8-A2A4-8233F3109BED}, {0A68C5A2-64AE-4415-88A2-6542304A4745}, {26E8361F-BCE7-4F75-A347-98C88B418328}, {339BB23F-A864-48C0-A59F-29EA915965EC}, {59450DB0-341D-4436-B380-B8377D8B6796}, {6A85D97D-665D-4825-8341-9501AD9F56A3}, {63B78BC1-A711-4D46-AD2F-C581AC420D41}, {8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}, {850CD0B8-DA33-4558-A8C8-95D7908E37A7}, {87067F04-DE4C-4688-BC3C-4FCF39D609E7}, {87766247-311C-43B4-8499-3D5FEC94A183}, {8952A998-1E7E-4716-B23D-3DBE03910972}, {A6250FB8-2206-499E-A7AA-E1EC437E71C0}, {CD8D1CAA-FE4A-45DF-A06C-028AAF1821DE}, {D6DFF6D8-B94B-4720-B730-1C38C7065C3B}, and {D6E66235-7AA6-44ED-A06C-6F2033B1D993}.

You also should delete the following keys (if present):

•HKEY_CLASSES_ROOT\PROTOCOLS\NAME-SPACE HANDLER\RES\WTOOLSB.RESPROTOCOL

•HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\
USERDATA\AUI

•HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\
USERDATA\STO

•HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\
USERDATA\TUID

Close the Registry Editor after deleting all Huntbar-related keys and values.

Finally, open the Windows search utility to find and delete any file that refers to btiein, btlink, msiein, msielink, msiets, qdow, search toolbar, stoolbar, wintools, and wtoolsb. Search for and delete the following particular files, as well (if present): After going online.htm, Clsid d6d.reg, Def.dat, Installation report (two-phase mode).htm, Ivwricno.wzg, Menuextdefault.reg, Nzqlihv.wzg, Redirxml.dat, Offline huntbar registration.htm, Related links pro handler.reg, and Rw.wzg. You also should dig into My Computer and delete the Install.txt, Remove.bat, Search.dat, Toolbar.dll, Wintools.exe, and Wvu.wzg files in the root folder (for example: C:\ when C represents the Windows drive) on the Windows drive. While you're at it, open the C:WINDOWS\DOWNLOADED PROGRAM FILES folder and delete any of the following folders (if present): {8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}, {59450DB0-341D-4436-B380-B8377D8B6796}, {D6E66235-7AA6-44ED-A06C-6F2033B1D993}, {26E8361F-BCE7-4F75-A347-98C88B418322}, SEARCH TOOLBAR, and TOOLBAR.

The last step is to delete any shortcuts that point to Huntbar or TrafficSyndicate. Peruse the Start menu and the Desktop to locate such shortcuts. If you find one, right-click it and select Delete from the pop-up menu. Click Yes to confirm your decision.

The only task that remains is resetting your browser settings. Open the Programs tab of the Internet Options dialog box and click the Reset Web Settings button. Clean the Favorites menu of unwanted links to finish the process.