HDToolBar

  • Thread starter Thread starter Bobby
  • Start date Start date
B

Bobby

MSAS detects HDToolBar, but does not clean it
successfully. It finds 3 reg keys that it claims it
deletes, but then finds them all over again the next time
it runs.

In searching the registry for "HDT" I found another 6-10
references, including CLS definitions...

There is an entire section in Software of HDT that can be
removed.

This led me to a DLL file:

C:\WINDOWS\Downloaded Program Files\barhelp22.0.dll

I then searched the registry for references to 'barhelp'
and found the 'T2BHO' class...

I removed the DLL, and all registry references
to 'barhelp', 'HDT', and 'T2BHO'.

I also searched out and removed the associated CLSIDs
revealed using the keywords above; for me, they were:
{9aaabfe1-22a9-4e0d-8f4a-48b0606a199b};
{1f77f67e-bd08-4932-af5a-15fd532eedb1};
{b1d147e7-873e-4909-8127-695d9bb78728};
{e35306d7-b44c-4530-a2ce-94c60f8cc4dc}

Careful not to delete the owner CLSID:
{56A7DC70-E102-4408-A34A-AE06FEF01586}


Can you update your cleaning of this thing to really get
rid of it?
 
Tools, Suspected spyware report on an infected machine is one way to help
the process.

Cleaning whilst booted in safe mode is also far more likely to be successful
than normal mode.
 
Are you saying that all of the extra keys I found would have been deleted if
I'd run the tool in safe mode?

I am clean now -- I just wanted to provide the list of additional items I
found so the tool developers could incorporate them into the signature for
this item if they were not already there.

Thanks for the additional tips...

Bobby
 
Providing the information here is useful, as is the suspected spyware
report--I'm not clear what information is included in those reports, but the
registry keys might be.

I don't know the answer to the specifics of the extra keys--it doesn't seem
logical--so I don't know whether these keys were left simply because by
themselves they constitute no risk, or whether they were missed, or what.
Safe mode is good for processes or related files which are active in normal
mode and not properly handled by Microsoft Antispyware--we've seen ample
evidence in this beta that this is helpful if cleaning isn't complete--i.e.
the same threat comes right back on a subsequent boot or otherwise.
 
Back
Top