HuntBar is a search-hijacker from Traffic Syndicate (controlling server dst.trafficsyndicate.com), with various additional features depending on version.

Variants

HuntBar/TS is the original version, also providing an IE toolbar with search features.

HuntBar/Side is an addition to HuntBar/TS which also pops open a search sidebar pointed at its own results when it detects you using search engines.

HuntBar/MSLink is a development of HuntBar/Side dropping the toolbar from HuntBar/TS and adding the ability to redirect you instantly when browing targeting web pages. This is typically used to hijack affiliate fees from merchant sites.

HuntBar/BTLink is an updated version of MSLink.

HuntBar/MSIn and HuntBar/BTIn are installer controls for both the MSLink and BTLink variants.

HuntBar/SToolbar also tries to hijack your homepage to WebSearch.com, and copies searches you make in known search engines to the search field in the toolbar as you type.

HuntBar/QDow is a small downloader ActiveX control used to load HuntBar/BTIn.

Distribution

Through ActiveX drive-by-download at affiliate sites, including pop-up advertising served by trafficsyndicate.com.

TrafficSyndicate, the makers of HuntBar, offer 'co-branded' versions of HuntBar which may be installed by other sites under a different name. Known partner sites include bullseyesgames.com and side-search.com.

Advertising

No.

Privacy violation

HuntBar/TS sends the domain name of the site being viewed, the domain name of any site previously being viewed and the title and any keywords in the current page to its controlling servers whenever a new site is viewed. It does this even if the toolbar is not turned on.

HuntBar/Side, MSLink, BTLink and SToolbar send URLs and search terms used to its controlling servers with a unique ID allowing your search engine usage to be tracked.

Security issues

Yes. HuntBar/TS, MSIn and BTIn can silently download and execute arbitrary code, as an update feature.

Stability problems

HuntBar/BTLink and SToolbar seems to cause IE to crash often on some setups with an 'Exception E Access Violation'.

Removal

TrafficSyndicate offer two uninstaller files for HuntBar/TS, which have been reported not to work properly.

HuntBar/Side may put an entry called 'MSIETS' in the Control Panel's Add/Remove Programs option, which should remove this variant.

HuntBar/MSLink and HuntBar/BTLink have two entries in the Control Panel's Add/Remove Programs option, called 'Internet 404' and 'Tools for Internet Explorer'. Both entries (which also demand an internet connection to work) must be removed to get rid of these variants, but it will leave the files intact and still won't remove the MSIn or BTIn installer, which can reinstall the software automatically in the future.

HuntBar/SToolbar puts an entry called 'Search Toolbar' in Add/Remove Programs, which should work (though it requires an internet connection).

Ad-Aware reffile and Common anti-spyware titles can remove HuntBar variants other than BTLink, BTIn and SToolbar.

Manual removal

Open a DOS command prompt window (from Start->Programs->Accessories), and enter the following commands (for HuntBar/TS):

For HuntBar/Side and HuntBar/MSLink, enter:

For HuntBar/BTLink, enter:

For HuntBar/MSIn, enter:

For HuntBar/BTIn, enter:

For HuntBar/SToolbar, enter:

(Users of non-English verions of Windows will need to change 'Program Files' and 'Common Files' in the above commands to the name of the these folders in the language Windows was installed in.)

Having done this you can restart the machine and delete the folder 'Common Files\MSIETS' (TS, Side, MSLink variants), 'Common Files\BTLINK' (BTLink variant) or 'Search Toolber' (SToolbar variant) from the Program Files folder.

Inside the System folder (which is inside the Windows folder, called 'System' under Windows 95/98/Me or 'System32' under Windows NT/2000/XP), you can delete the file 'msiein.dll' (MSIn variant) or 'btiein.dll' (BTIn variant).

To clean up, you can also open 'Downloaded Program Files' in the Windows folder and delete the entry '{8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}', '{59450DB0-341D-4436-B380-B8377D8B6796}', '{D6E66235-7AA6-44ED-A06C-6F2033B1D993}' or '{26E8361F-BCE7-4F75-A347-98C88B418322}'.

You can also open the registry (Start->Run->regedit), find the key HKEY_CURRENT_USER and delete the subkey 'MSIETS' (TS, Side variants), 'MSIEIN' (MSIn variant), 'BTIEIN' (BTIn variant), 'BTLINK' (BTLink variant) or 'Search Toolbar' (SToolbar variant).

After removing the software you may want to delete the shortcuts the HuntBar/Side and TS variants add to the desktop, start menu and favourites menu, and reset your search and home pages back to normal (Tools->Internet Options->Programs->Reset Web Settings).