Description
HuntBar is a toolbar providing searching features, which is added to every new Internet Explorer and Windows Explorer window.
It also changes your home page and search bar settings to point to HuntBar’s servers, and automatically opens this search bar when it detects you using any other search engine.
Distribution
Through ActiveX drive-by-download at affiliate sites, possibly in pop-up advertising.
TrafficSyndicate, the makers of HuntBar, offer ‘co-branded’ versions of HuntBar which may be installed by other sites under a different name.
What it does
Advertising
No.
Privacy violation
HuntBar sends the domain name of the site being viewed, the domain name of any site previously being viewed and the title and any keywords in the current page to its controlling servers whenever a new site is viewed. It does this even if the toolbar is not turned on.
However, it does not (currently) use a cookie or unique ID to track visits across sites.
Security issues
Yes. HuntBar can silently download and execute arbitrary code, as an update feature.
Stability problems
None known.
Removal
TrafficSyndicate offer two removal programs. (Bottom of page; these have not been tested.)
Ad-Aware and Spybot S&D cannot yet remove this parasite.
Manual removal
HuntBar stores its code in a folder called ‘MSIETS’ inside the ‘Common Files’ folder in ‘Program Files’. Before you can delete it, you must deregister its DLLs. There will be one called ‘msiets.dll’, and, if HuntBar has been running long enough to download some updates, probably also ‘msielink.dll’. If you don’t have msielink.dll you will only have to use the first of the two following commands.
Open a DOS command prompt window from Start->Programs->Accessories, and enter the commands. For Windows XP, 2000 or NT:
regsvr32 /u “C:\Program Files\Common Files\MSIETS\msiets.dll”
regsvr32 /u “C:\Program Files\Common Files\MSIETS\mslink.dll”
Or for Windows 95, 98 or Me:
“%WinDir%\SYSTEM\regsvr32.exe” /u “C:\Program Files\Common Files\MSIETS\msiets.dll”
“%WinDir%\SYSTEM\regsvr32.exe” /u “C:\Program Files\Common Files\MSIETS\mslink.dll”
You will need to change the path ‘C:\Program Files\Common Files’ in the above commands if your Program Files are on a different drive, or have a different name (eg. non-English Windows installations).
Having done this you can restart the machine and delete the MSIETS folder, along with the entry ‘{8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}’ inside ‘Downloaded Program Files’ in the Windows folder. You can also run ‘regedit’ and remove these entries from the registry to clean up if you like:
HKEY_CURRENT_USER\Software\MSIETS
HKEY_CURRENT_USER\Software\MSIETSLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar{8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}
After removing the software you may want to delete the shortcuts it adds to the desktop, start menu and favourites menu, and set your search and home pages back to normal (see Tools->Internet Options->Programs->Reset Web Settings).