Spyware: WebBar - htwtb.bin and bar.dll

<< Spyware Adware Detection and Removal

<< Windows Tutorials - Herong's Tutorial Examples

This section provides a tutorial example on remove spyware 'WebBar' and related files htwtb.bin and bar.dll.

Symptom: When ran Internet Explorer, I got the following JavaScript error:

   Object doesn't support this property or method
   File: c:\windows\htwtb.bin

HijackThis Report: I ran HijackThis on my friend's system and saw this line:

O2 - BHO: WebBar Class - {EE392A64-F30B-47C8-A363-CDA1CEC7DC1B} 
   - C:\PROGRA~1\APPLIE~1\BAR.DLL

Quick Research: I did a Google search on "htwtb.bin" and located the following related message:

I did a rescan using hijackthis and removed the line below. I had 
removed the other backup files in hijackthis to another location so 
I knew that the backup file from this rescan and fix would be the 
only one there in case I needed to do a restore. The web search tool 
is gone AND the IE Scripting Error message no longer appears on any 
site.

O2 - BHO: WebBar Class - {EE392A64-F30B-47C8-A363-CDA1CEC7DC1B} 
   - C:\PROGRA~1\APPLIE~1\BAR.DLL

What I Did:

1. Looked at c:\windows\htwtb.bin, found the file, and deleted it:

>dir c:\windows\htwtb.bin
07/29/2005  08:51 PM               196 htwtb.bin

>del c:\windows\htwtb.bin

2. Looked at IE > Internet Options > Programs > Manage Addon, found the entry, and disabled it.

   WebBar class, published by http://www.hexatech.com

3. Looked at bar.dll, found the directory, and deleted it:

> dir c:\program files\Appliedsearch_AutoInstall
   bar.dll
   ...
   
> rmdir c:\program files\Appliedsearch_AutoInstall

Result: The JavaScript error is gone.

Sections in This Chapter

What Is Spyware?

"HijackThis" - Spyware and Browser Hijacker Detector

"HijackThis" Report Entry Types

Spyware: WebBar - htwtb.bin and bar.dll

Spyware: SurfBuddy - sbuddy.dll

Spyware: WebSpecials - webspec.dll

Spyware: DSSAgent - DSSAgent.exe

Transponder: Best Offer - farmmext.exe

Spyware: dinst.exe - dsr.dll