Hotbar Description

Hotbar is a discontinued Internet Explorer search toolbar that adds graphical skins to a web browser, Microsoft Outlook and Microsoft Outlook Express toolbars. It displays advertising links and opens commercial pop-up advertisements. Hotbar tracks user Internet activity and reports it to predetermined remote servers. It can silently update itself or download and run arbitrary programs. Hotbar has to be manually installed. Previously, it was bundled with some ad-supported software such as various file sharing applications. Hotbar runs on every Windows startup.

Type: Browser Helper Object

How Can You Detect Hotbar?

Hotbar Technical Report

As new Hotbar details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Hotbar files with its MD5s were created in the system:

Hotbar has typically the following processes in memory:

• itfucjrx.exe
• hbtwallpap.exe
• hbttoolbar.dll
• hbthostoe.dll
• hbtguard22.exe
• HbInstIE.dll
• country.exe
• HbtGuard.exe
• HbtWeatherOnTray.exe
• Wallpaper.dll
• hbcoresrv.dll
• hbhostol.dll
• hbtoolbar.dll
• HBTVHelper.dll
• SBInst.exe
• ASAPCom.dll
• SbHostIE.dll
• SbInstIE.dll
• SBSrvPS.dll
• SBUIRes.dll
• SBTVHelper.dll
• SpamBlocker.exe
• ShoppingReport.dll
• HotbarSAHook.dll
• HotbarSADF.exe
• hbtweather.exe
• ijpmkxbl.exe
• hbtwallpaper.dll
• hbthostol.dll
• hbtcoresrv.dll
• eticpigk.exe
• HbtAds.dll
• Cml.exe
• HbtSrv.exe
• HbOEAddOn.exe
• dbenderc.dll
• hbhostoe.dll
• hbsrv.exe
• ShprRprtHbt.exe
• nsn17.dll
• jesjzwcf.exe
• SbCoreSrv.dll
• SbHostOL.dll
• SBOLExt.dll
• SBTrayAppPS.dll
• SbWallpaper.dll
• SbSrv.exe
• SBTV.exe
• HotbarSAAX.dll
• HotbarSA.exe
• hotbar.exe
• hitwqczw.exe
• hbttoolbar.exe
• hbtinstie.dll
• hbthostie.dll
• hbtcoresrv.exe
• HbtOEAddOn.exe
• HbtUninst.exe
• HbTools.exe
• ShprRprt.dll
• Contact.dll
• hbhostie.dll
• hbinst.exe
• hbrpt.dll
• HBTV.exe
• SbOEAddOn.exe
• SBClientSinkPS.dll
• SbHostOE.dll
• SBOLExp.dll
• SbToolbar.dll
• SBUISkin.dll
• SbGuard.exe
• SpamBlockerUtility.exe
• CntntCntr.dll
• npclntax_HotbarSA.dll

Hotbar created the following directories, files, paths:

• %ProgramFiles%\Hotbar

Hotbar creates the following registry entries:

• HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\hotbarainstalllocation
• HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\hotbaraversionmajor
• HKEY_LOCAL_MACHINE\software\hotbar\hotbar\installbarversion_prv
• HKEY_LOCAL_MACHINE\software\hotbar\hotbar\installcreatedatedw
• HKEY_CLASSES_ROOT\hbttoolbar.hbttoolbarctl.1\clsid
• 74CC49F7-EB32-4A08-B204-948962A6E3DB
• 69FD62B1-0216-4C31-8D55-840ED86B7C8F
• SOFTWARE\Microsoft\Internet Explorer\Toolbar\74CC49F7-EB32-4A08-B204-948962A6E3DB
• Software\Microsoft\Internet Explorer\Extensions\E77EDA01-3C56-4a96-8D08-02B42891C169
• Wallpaper.WallpaperManager
• Hotbar.HbTravelCompareBar.1
• HbHostOL.HbWebmailSend
• HbCoreServices.LfgAx.1
• Software\Microsoft\Internet Explorer\Explorer Bars\BECAFC17-BAF9-11D4-B492-00D0B77F0A6D
• Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\B195B3B3-8A05-11D3-97A4-0004ACA6948E\
• Microsoft\Internet Explorer\Explorer Bars\66B90ADB-0BE3-40AE-8680-84A6F0577CA0
• AppID\0507FDDE-F3B7-49F5-9E8F-C557E991F39B
• 0AB71193-EC19-4D70-85C2-E46E2FF02755
• 31A59636-0FA3-4A56-954D-DB7AD02840D8
• 420C35C9-E4F2-49F9-BF67-2BE1ECF86989
• 66B90ADB-0BE3-40AE-8680-84A6F0577CA0
• A14C0D8D-E753-4E73-9E2B-4070791D8940
• FA16BCE1-5E36-472A-8466-E0CDD5CE00E6
• HbtCoreSrv.LfgAx
• HbtHostIE.Bho.1
• HbtHostOL.HbtWebmailSend
• HbtInstIE.HbInstObj.1
• HbTools.HbtTravelCompareBar
• HbtSrv.HbtCoreServices.1
• HbtToolbar.HbtToolbarCtl
• HbtTools.HbMain.1
• 19EBCBE0-9245-4397-BC5D-883D34782043
• 27C4569F-8728-4958-A920-A607CAE8153C
• 397A208B-3D09-4B3E-93E8-CA171886612E
• 54286C3A-E044-4E65-BD44-528D6AE28A18
• 8654592E-952A-4E7C-A960-304763B35FA6
• 8E98FAF8-794F-47F9-AF90-15305564ED81
• B671426C-5C1A-48AC-9652-BC9402B1C404
• D082721F-4BD4-4B8B-BB82-06753EE6174F
• F786CB18-3809-4E49-BC99-9A66DA47DB8B
• RprtsPSClient.PSExecuter.1
• ShprRprts.HbInfoBand
• ShprRprts.IEButton.1
• ShprRprts.SmrtShprCtl
• 4CF5A3C1-07A2-4336-9B54-6870452EBDE1
• 842D315A-7E1E-448B-96E8-9E76D1820BE2
• B9F51D42-CCA0-4408-BB02-D433D1865A3A
• HbTools
• Microsoft\Office\Outlook\Addins\HbtHostOL.HbtMailAnim
• Microsoft\Windows\CurrentVersion\App Management\ARPCache\Hotbar ShopperReports
• A1772E14-9291-454E-AEDE-02161FBC3E59
• 66291BEF-C867-43C0-A7B4-D13393814BCD
• 3103E312-E1BB-49AB-80EB-0A92FCA78746
• 354382db-df55-4da9-85a3-41696a0f510f
• 175652E8-8BCC-47C4-B591-0D630F469C19
• 5BA32D9E-F1BD-476C-AD42-97C9379A57A4
• Hotbar
• AD9A7B03-BE12-11D4-B493-00D0B77F0A6D
• DA603411-0593-11D5-A46B-00508B5BA2DF
• 4BF4FAFA-186E-4E36-8F74-525290438D7B
• 6A6EBAE8-8C66-4675-B423-95B3BA530940
• 46417AFD-7A15-4ED1-B764-CB72CD4D904F
• 6D6D1580-5B74-40EA-97F4-3C2B46C5ABDD
• B195B3A5-8A05-11D3-97A4-0004ACA6948E
• 4DBCFAF7-62E1-4811-8ACC-6511E7192CB4
• 75D2080B-4857-4B96-9B7D-732634FBD01F
• B701A704-F828-11D4-A466-00508B5BA2DF
• DA603411-0593-11D5-A46B-10101DDD1111
• A80F2DB2-80A9-4834-8F5A-4AB70F4EF4C3
• Hotbar.HbMain
• Hotbar.HbCommBand.1
• HbHostOL.HbElementFocus
• HbSrv.HbCoreServices.1
• Atlnet.HbWebmailSend
• HbHostIE.HbBho.1
• HBInstIE.HbInstObj
• HbToolbar.HbToolbarCtl.1
• Microsoft\Installer\Features\10B0642B36134F8F914EA8E11EE5B503
• 06784C15-B640-40F8-AEE8-3C1A3C7A899C
• 30022029-2C17-4A99-87D2-A382C674A19D
• 5D16197A-1EAA-45AF-B29A-69F1AA055E87
• 68C93759-CAD1-465F-A320-4C2728003E08
• Microsoft\Installer\Products\D493500BD4A54EA6BC805FC9CDA952C5
• ASAPCom.ASAPEnvelope
• ASAPCom.ASAPRecipients
• 319260AB-BE0C-4025-8569-7A27ED2FAAB9
• 9809A6B4-70B1-4BB2-B3B5-B415763A534E
• 21447C90-6EC1-4FC1-9379-BD515008AEDB
• B0C3DE1B-E3FF-4DD0-9229-F452CF9C678E
• E678CBDC-D022-41F5-AB21-C43DFD9DFC3E
• SbCoreSrv.CoreServices.1
• SbHostIE.Bho
• SbHostOL.MailAnim.1
• SbInstIE.SbInstObj
• SbSrv.CoreServices.1
• SbToolbar.ToolbarCtl
• SbWallpaper.WallpaperManager.1
• SpamBlockerUtility.CommBand
• SpamBlockerUtility.SbMain.1
• Microsoft\Windows\CurrentVersion\Ext\PreApproved\90B5A95A-AFD5-4d11-B9BD-A69D53D22226
• D95C7240-0282-4c01-93F5-673BCA03DA86
• HotbarAX.UserProfiles
• Microsoft\Windows\CurrentVersion\Ext\PreApproved\A3E67DAA-DA01-4da5-98BE-3088B554A11E
• HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\hotbaradisplayname
• HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\hotbarauninstallstring
• HKEY_LOCAL_MACHINE\software\hotbar\hotbar\installbarversion
• HKEY_LOCAL_MACHINE\software\hotbar\hotbar\installcreatedate
• HKEY_CLASSES_ROOT\hbttoolbar.hbttoolbarctl.1
• 2A8A997F-BB9F-48F6-AA2B-2762D50F9289
• B195B3B3-8A05-11D3-97A4-0004ACA6948E
• Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\74CC49F7-EB32-4A08-B204-948962A6E3DB
• Software\Microsoft\Internet Explorer\Explorer Bars\A798E2B4-B6A0-4B96-8C53-8EC7A3B0895A
• Software\Microsoft\Internet Explorer\Toolbar\B195B3B3-8A05-11D3-97A4-0004ACA6948E
• Hotbar.HbTravelCompareBar
• HbToolbar.HbHtmlMenuUI.1
• HbCoreServices.LfgAx
• HbCoreSrv.DynamicProp.1
• SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\hotbar\
• Microsoft\Internet Explorer\Explorer Bars\2178C864-B8BC-41AE-A1FB-EB6A32F87EB1
• ShopperReports
• 0774F696-D801-4C18-81A7-A3A32B8BEF19
• 2178C864-B8BC-41AE-A1FB-EB6A32F87EB1
• 40D8240A-E3A0-4D59-AC55-0443120188D1
• 580A1F3F-89B4-433B-BBDB-B97AEB13F3FC
• 8C875948-9C60-4381-9248-0DF180542D53
• ED8525EA-2BFC-4440-BD8A-20EFB9D5E541
• HbtCoreSrv.HbtCoreServices.1
• HbtHostIE.Bho
• HbtHostOL.HbtMailAnim.1
• HbtInstIE.HbInstObj
• HbTools.HbtCommBand.1
• HbtSrv.HbtCoreServices
• HbtToolbar.HbtHtmlMenuUI.1
• HbtTools.HbMain
• 175816A5-219E-4079-B2F9-53C501C409BA
• 1E07646F-07C4-4847-A250-0EC8114F2963
• 38370864-346F-4AFA-8C4B-4FBFF518C0BB
• 4331EC56-0AAB-499E-8757-DD2EE44AD671
• 5F2B9DE7-F878-4762-8CFE-E9C58F082F0E
• 8D5C4EC6-AF8E-4B85-BA27-64BABE410510
• B53D4CD4-406D-43CC-8244-7893D72236DD
• BC8C2E5F-D8B4-4997-BCE3-8775C3707956
• F43EC88B-B6C8-4969-A763-E2BF55602CCE
• RprtsPSClient.PSExecuter
• ShprRprts.HbAx.1
• ShprRprts.IEButton
• ShprRprts.IEButtonA.1
• 45397063-D7D0-47C2-9508-26487608A298
• 71EFE583-62FE-4419-9918-CA3B683F7B36
• B5901229-25CC-43C9-B604-3BB6AC2B48A5
• F8EE014F-B34C-4544-8E45-95A7971D323B
• Microsoft\Internet Explorer\Extensions\E77EDA01-3C56-4a96-8D08-02B42891C169
• Microsoft\Windows\CurrentVersion\App Management\ARPCache\HbToolsWebTools
• BC2025DC-136B-492F-AEFF-31D0BA8B98DA
• 7138714C-9819-4AB1-9A86-E7C413C9A99E
• 31321312-E1BB-49AB-80EB-13212CA78746
• 3CEB882D-6B2B-4D81-A544-9D9B1D6FA945
• 1E0004EC-5DF0-48C7-A8F0-FBB0488A3D94
• AB357854-7A72-4FBE-9382-CC74B45A3ADD
• HbSrv.EXE
• 918E4B7A-4D80-43A4-83A7-39ADCC11841F
• B00609A6-82AF-4C55-BBB8-ADC8593CEB86
• 17719B54-FAD1-11D4-A466-00508B5BA2DF
• 5F1DA76D-F903-4A44-87BB-3EE9432322F6
• 7E33BC81-0818-11D5-B50D-00D0B77F0A6D
• 60F63095-41EC-11D5-B558-00D0B77F0A6D
• A80347D3-F757-11D4-A466-00508B5BA2DF
• 1038DD23-8AE8-451B-A134-4DB8A49AA519
• 6FE00B71-7251-4E00-9186-ED89BBB946B8
• BECAFC17-BAF9-11D4-B492-00D0B77F0A6D
• F4132B7B-1576-41B6-ABD8-39C6C53047F7
• DA603411-0593-11D5-A46B-10101B1B1111
• HbWebmailSend Class
• Hotbar.HbCommBand
• Hotbar.HbBho.1
• HbSrv.HbCoreServices
• HbCoreSrv.HbCoreServices.1
• HbHostIE.HbBho
• HbHostOL.HbMailAnim.1
• HbToolbar.HbToolbarCtl
• 4B18DD50-C996-44fc-AC52-0FECFF82ED58
• ABE46B90-C143-44ee-BC04-3313A048B9AC
• 1D5DF418-73EA-4B20-B0D1-5F9C6C949CB0
• 3D2E7662-85FB-4CC1-875C-A624B1AA5D96
• DDA9619F-F00E-4B40-AA4D-94A218773C61
• Software\Microsoft\Internet Explorer\Explorer Bars\7E66936C-FEA0-4984-AD26-7B6661AC5B2E
• ASAPCom.ASAPClass
• ASAPCom.ASAPMessage
• 286E500C-EF0A-4AA3-A94D-E495F653EF4B
• 8AC5BC54-B13B-4642-99F9-0BAA2D116184
• D9882035-7745-47c7-8D5E-C11178F9C553
• 4921DB9C-64EA-430A-ABD2-D016DB5A0AC4
• DFD5D79B-EF2F-4A51-9821-5B469F05262E
• SbCoreSrv.CoreServices
• SbCoreSrv.LfgAx.1
• SbHostOL.MailAnim
• SbHostOL.WebmailSend.1
• SbSrv.CoreServices
• SbToolbar.HtmlMenuUI.1
• SbWallpaper.WallpaperManager
• SpamBlockerConfig.Application.1
• SpamBlockerUtility.SbMain
• Microsoft\Office\Outlook\Addins\SbHostOL.MailAnim
• A3E67DAA-DA01-4da5-98BE-3088B554A11E
• HotbarAX.ClientDetector.1
• 76D54105-99EB-4ECB-95B2-A944F50CC566
• HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\hotbaruninstall
• HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\hotbarapublisher
• HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\hotbaraversionminor
• HKEY_LOCAL_MACHINE\software\hotbar\hotbar\installcomponents
• HKEY_CLASSES_ROOT\hbttoolbar.hbttoolbarctl
• HKEY_CLASSES_ROOT\hbttoolbar.hbttoolbarctl\clsid
• 05F2E787-467E-BD9B-FD6E-5591CBE8C329
• Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\74CC49F7-EB32-4A08-B204-948962A6E3DB
• Software\Microsoft\Internet Explorer\Explorer Bars\2178C864-B8BC-41AE-A1FB-EB6A32F87EB1
• Software\Microsoft\Internet Explorer\Extensions\946B3E9E-E21A-49c8-9F63-900533FAFE14
• Wallpaper.WallpaperManager.1
• HbToolbar.HbHtmlMenuUI
• HbHostOL.HbWebmailSend.1
• HbCoreSrv.DynamicProp
• Software\Microsoft\Internet Explorer\Explorer Bars\FF6B2FD5-093C-4D4F-BB98-5641130A9DE6
• SOFTWARE\Microsoft\Office\Outlook\Addins\aHbHostOL.HbMailAnim.1\
• Microsoft\Internet Explorer\Explorer Bars\7E66936C-FEA0-4984-AD26-7B6661AC5B2E
• AppID\WeatherOnTray.EXE
• 1E6AC766-9094-4BCF-ABD3-39E2EAEA5FCD
• 3FA917B9-DF69-477F-9E4F-B60D929DE79F
• 454B4812-E572-4703-A1BB-63490809EAC0
• 7E66936C-FEA0-4984-AD26-7B6661AC5B2E
• C2BAA4C9-AE1E-4605-AE2F-A1C49A30D881
• HbtCoreSrv.HbtCoreServices
• HbtCoreSrv.LfgAx.1
• HbtHostOL.HbtMailAnim
• HbtHostOL.HbtWebmailSend.1
• HbTools.HbtCommBand
• HbTools.HbtTravelCompareBar.1
• HbtToolbar.HbtHtmlMenuUI
• HbtToolbar.HbtToolbarCtl.1
• 023A4648-601A-4C30-8A2E-C72EBFA99AF6
• 1C1793E0-1034-4CAC-837D-AA545F6961BF
• 34F4D917-31E4-464C-B8B3-84C1CE76B395
• 421745E9-16DF-4EE4-A758-D51F939C49CB
• 5D9C84E7-FA45-49E2-A0B8-B6B5E9A4F6BE
• 8A61A950-C325-4F44-BA64-273180FF3464
• AF15975B-1498-4740-8E6C-90AF78E4198C
• B9BB3219-F84C-4060-966B-4A1E73E24226
• D24F9D3C-5D4C-47F8-9AB7-632B44AD6A0D
• F814BE58-1BF9-4B50-829A-E889F86127AD
• ShprRprts.HbAx
• ShprRprts.HbInfoBand.1
• ShprRprts.IEButtonA
• ShprRprts.SmrtShprCtl.1
• 71E9CF40-AF72-4B55-BD3F-1FEA2A0EAEA6
• 9967A873-40F3-4C7E-9239-6C8760F19F61
• C83DAED4-0611-4F7A-978E-7FEAFCB2F91B
• Microsoft\Internet Explorer\Extensions\946B3E9E-E21A-49c8-9F63-900533FAFE14
• Microsoft\Windows\CurrentVersion\App Management\ARPCache\HbToolsOutlookTools
• C8539BFE-8FD7-405C-8EEF-D9AF48DC6BA4
• 927420A3-7259-4A74-B402-9329177EC3FC
• 340D8791-0E2C-43CF-9671-7E90AAFBF0DA
• 20D21E02-8C1C-41FE-9826-DAB4C223436C
• 31D0C6FF-5897-4A57-8005-A50FCE4CE159
• 013A482E-1893-4f49-8D41-AC89156A6955
• 522985F4-BA43-45A0-9B20-AB5F82C0FF7E
• 8F59F897-6923-4B3B-8156-4E55D19DE99A
• A80347DF-F757-11D4-A466-00508B5BA2DF
• B195B3B2-8A05-11D3-97A4-0004ACA6948E
• F64B26C1-07DE-11D5-B50D-00D0B77F0A6D
• 6F885F52-B45F-45BC-8642-FE3D56155A3A
• 17719B53-FAD1-11D4-A466-00508B5BA2DF
• 94BEB7A2-36B7-46DC-8AD1-81A8332409C0
• 00C1117B-AB91-4ADD-9BBF-5D22D099DEBD
• 60F630A2-41EC-11D5-B558-00D0B77F0A6D
• A80347E0-F757-11D4-A466-00508B5BA2DF
• 9EE87A26-B2C8-4130-83F6-E8511D939976
• F7A1BF21-1D7D-4F5F-A201-0CA35A5CD68F
• B701A705-F828-11D4-A466-00508B5BA2DF
• Hotbar.HbMain.1
• Hotbar.HbBho
• HbHostOL.HbElementFocus.1
• HbCoreSrv.HbCoreServices
• Atlnet.HbWebmailSend.1
• HbHostOL.HbMailAnim
• HBInstIE.HbInstObj.1
• 0B6899B6-1564-43e0-BD93-F7CF930A5E5C
• 90B5A95A-AFD5-4D11-B9BD-A69D53D22226
• 195EF37C-0FF4-4AEF-B51B-47D326F01978
• 3A6691EA-C844-46F2-9237-1386A85CE119
• 601A9784-1114-4089-9B3E-CBD70DAFC6AD
• 793AF621-5CD0-4B92-B765-6712F6AAF48E
• SpamBlockerUtility
• ASAPCom.ASAPMain
• 00B498E3-0543-4624-8FDE-1CAF89A80550
• 620D55B0-F2FB-464E-A278-B4308DB1DB2B
• D5178F77-C5E6-4E8F-9787-48B5D7ECCCE8
• 32C97A37-E2B8-4097-9330-5F3E1125E181
• D2D94732-A74D-433C-98F7-9ED740E82AE9
• EA232A0A-46F8-4D44-A30B-50321518A828
• SbCoreSrv.LfgAx
• SbHostIE.Bho.1
• SbHostOL.WebmailSend
• SbInstIE.SbInstObj.1
• SbToolbar.HtmlMenuUI
• SbToolbar.ToolbarCtl.1
• SpamBlockerConfig.Application
• SpamBlockerUtility.CommBand.1
• BCE2E826-D0F5-41C8-97BE-28A6F540CEEB
• Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\90B8B761-DF2B-48AC-BBE0-BCC03A819B3B
• HotbarAX.ClientDetector
• HotbarAX.UserProfiles.1
• Microsoft\Windows\CurrentVersion\Ext\PreApproved\D95C7240-0282-4c01-93F5-673BCA03DA86

Important Article Disclaimer