McAfee > Theat Center > PUP Detail Page

Characteristics

McAfee(R) AVERT™ recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Summary

This is not a virus or a Trojan. It is an adware dropper which drops adware component on the system and generates extra pop-up ads while browsing Internet. On executing this application, it makes multiple internet connections with "hotbar.com" & "reports.shopperreports.com". It creates BHO entries for the Internet Explorer. It also installs a weather service in the system tray.

Privacy

A EULA appears while installation of the application.

System Changes

File Name : HbTools.exe
MD5Hash : 685ffa722acdcc61e73ced5b7d2a76b7

Upon execution of this adware application, a toolbar is installed as shown below:

It gives pop-up ads and installs a weather service in the system tray as below:

Following directories are added:

• c:\Program Files\HbTools
• c:\Program Files\HbTools_Icons
• c:\Program Files\ShopperReports

Following files are added:

• HbTools.log
• HbtUninst.exe
• Cml.exe
• dBenderC.dll
• HbtAds.dll
• HbtCoreSrv.dll
• HbtGuard.exe
• HbtHostIE.dll
• HbtHostOE.dll
• HbtHostOL.dll
• HbtInstIE.dll
• HbtOEAddOn.exe
• HbtSrv.exe
• HbtToolbar.dll
• HbtWallpaper.dll
• HbtWeatherOnTray.exe
• ShprRprtHbt.exe
• ShprRprt.dll
• qgykwchz.exe (Name may vary)
• xwofbzwx.exe (Name may vary)

Following registry entries are added:

• HKEY_CLASSES_ROOT\AppID\{0507FDDE-F3B7-49F5-9E8F-C557E991F39B}
• HKEY_CLASSES_ROOT\AppID\WeatherOnTray.EXE
• HKEY_CLASSES_ROOT\CLSID\{0774F696-D801-4C18-81A7-A3A32B8BEF19}
• HKEY_CLASSES_ROOT\CLSID\{0AB71193-EC19-4D70-85C2-E46E2FF02755}
• HKEY_CLASSES_ROOT\CLSID\{1E0004EC-5DF0-48C7-A8F0-FBB0488A3D94}
• HKEY_CLASSES_ROOT\CLSID\{1E6AC766-9094-4BCF-ABD3-39E2EAEA5FCD}
• HKEY_CLASSES_ROOT\CLSID\{2178C864-B8BC-41AE-A1FB-EB6A32F87EB1}
• HKEY_CLASSES_ROOT\CLSID\{2A8A997F-BB9F-48F6-AA2B-2762D50F9289}
• HKEY_CLASSES_ROOT\CLSID\{31A59636-0FA3-4A56-954D-DB7AD02840D8}
• HKEY_CLASSES_ROOT\CLSID\{3FA917B9-DF69-477F-9E4F-B60D929DE79F}
• HKEY_CLASSES_ROOT\CLSID\{40D8240A-E3A0-4D59-AC55-0443120188D1}
• HKEY_CLASSES_ROOT\CLSID\{420C35C9-E4F2-49F9-BF67-2BE1ECF86989}
• HKEY_CLASSES_ROOT\CLSID\{454B4812-E572-4703-A1BB-63490809EAC0}
• HKEY_CLASSES_ROOT\CLSID\{580A1F3F-89B4-433B-BBDB-B97AEB13F3FC}
• HKEY_CLASSES_ROOT\CLSID\{66B90ADB-0BE3-40AE-8680-84A6F0577CA0}
• HKEY_CLASSES_ROOT\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}
• HKEY_CLASSES_ROOT\CLSID\{7E66936C-FEA0-4984-AD26-7B6661AC5B2E}
• HKEY_CLASSES_ROOT\CLSID\{8C875948-9C60-4381-9248-0DF180542D53}
• HKEY_CLASSES_ROOT\CLSID\{A14C0D8D-E753-4E73-9E2B-4070791D8940}
• HKEY_CLASSES_ROOT\CLSID\{C2BAA4C9-AE1E-4605-AE2F-A1C49A30D881}
• HKEY_CLASSES_ROOT\CLSID\{ED8525EA-2BFC-4440-BD8A-20EFB9D5E541}
• HKEY_CLASSES_ROOT\CLSID\{FA16BCE1-5E36-472A-8466-E0CDD5CE00E6}
• HKEY_CLASSES_ROOT\HbCoreSrv.DynamicProp
• HKEY_CLASSES_ROOT\HbCoreSrv.DynamicProp.1
• HKEY_CLASSES_ROOT\HbtCoreSrv.HbtCoreServices
• HKEY_CLASSES_ROOT\HbtCoreSrv.HbtCoreServices.1
• HKEY_CLASSES_ROOT\HbtCoreSrv.LfgAx
• HKEY_CLASSES_ROOT\HbtHostIE.Bho
• HKEY_CLASSES_ROOT\HbtHostIE.Bho.1
• HKEY_CLASSES_ROOT\HbtHostOL.HbtMailAnim
• HKEY_CLASSES_ROOT\HbtHostOL.HbtMailAnim.1
• HKEY_CLASSES_ROOT\HbtHostOL.HbtWebmailSend
• HKEY_CLASSES_ROOT\HbtHostOL.HbtWebmailSend.1
• HKEY_CLASSES_ROOT\HbtInstIE.HbInstObj
• HKEY_CLASSES_ROOT\HbtInstIE.HbInstObj.1
• HKEY_CLASSES_ROOT\HbTools.HbtCommBand
• HKEY_CLASSES_ROOT\HbTools.HbtCommBand.1
• HKEY_CLASSES_ROOT\HbTools.HbtTravelCompareBar
• HKEY_CLASSES_ROOT\HbTools.HbtTravelCompareBar.1
• HKEY_CLASSES_ROOT\HbtSrv.HbtCoreServices
• HKEY_CLASSES_ROOT\HbtSrv.HbtCoreServices.1
• HKEY_CLASSES_ROOT\HbtToolbar.HbtHtmlMenuUI
• HKEY_CLASSES_ROOT\HbtToolbar.HbtHtmlMenuUI.1
• HKEY_CLASSES_ROOT\HbtToolbar.HbtToolbarCtl
• HKEY_CLASSES_ROOT\HbtToolbar.HbtToolbarCtl.1
• HKEY_CLASSES_ROOT\HbtTools.HbMain
• HKEY_CLASSES_ROOT\HbtTools.HbMain.1
• HKEY_CLASSES_ROOT\Interface\{023A4648-601A-4C30-8A2E-C72EBFA99AF6}
• HKEY_CLASSES_ROOT\Interface\{175816A5-219E-4079-B2F9-53C501C409BA}
• HKEY_CLASSES_ROOT\Interface\{19EBCBE0-9245-4397-BC5D-883D34782043}
• HKEY_CLASSES_ROOT\Interface\{1C1793E0-1034-4CAC-837D-AA545F6961BF}
• HKEY_CLASSES_ROOT\Interface\{1E07646F-07C4-4847-A250-0EC8114F2963}
• HKEY_CLASSES_ROOT\Interface\{27C4569F-8728-4958-A920-A607CAE8153C}
• HKEY_CLASSES_ROOT\Interface\{34F4D917-31E4-464C-B8B3-84C1CE76B395}
• HKEY_CLASSES_ROOT\Interface\{397A208B-3D09-4B3E-93E8-CA171886612E}
• HKEY_CLASSES_ROOT\Interface\{3F04CBF7-CD62-4403-B090-B432DEDCB159}
• HKEY_CLASSES_ROOT\Interface\{421745E9-16DF-4EE4-A758-D51F939C49CB}
• HKEY_CLASSES_ROOT\Interface\{4331EC56-0AAB-499E-8757-DD2EE44AD671}
• HKEY_CLASSES_ROOT\Interface\{54286C3A-E044-4E65-BD44-528D6AE28A18}
• HKEY_CLASSES_ROOT\Interface\{5D16197A-1EAA-45AF-B29A-69F1AA055E87}
• HKEY_CLASSES_ROOT\Interface\{5D9C84E7-FA45-49E2-A0B8-B6B5E9A4F6BE}
• HKEY_CLASSES_ROOT\Interface\{5F2B9DE7-F878-4762-8CFE-E9C58F082F0E}
• HKEY_CLASSES_ROOT\Interface\{601A9784-1114-4089-9B3E-CBD70DAFC6AD}
• HKEY_CLASSES_ROOT\Interface\{8578D35E-C6C0-4808-9A80-0F6C29A2C423}
• HKEY_CLASSES_ROOT\Interface\{8654592E-952A-4E7C-A960-304763B35FA6}
• HKEY_CLASSES_ROOT\Interface\{8A61A950-C325-4F44-BA64-273180FF3464}
• HKEY_CLASSES_ROOT\Interface\{8D5C4EC6-AF8E-4B85-BA27-64BABE410510}
• HKEY_CLASSES_ROOT\Interface\{8E98FAF8-794F-47F9-AF90-15305564ED81}
• HKEY_CLASSES_ROOT\Interface\{AF15975B-1498-4740-8E6C-90AF78E4198C}
• HKEY_CLASSES_ROOT\Interface\{B53D4CD4-406D-43CC-8244-7893D72236DD}
• HKEY_CLASSES_ROOT\Interface\{B671426C-5C1A-48AC-9652-BC9402B1C404}
• HKEY_CLASSES_ROOT\Interface\{B9BB3219-F84C-4060-966B-4A1E73E24226}
• HKEY_CLASSES_ROOT\Interface\{BC190DA5-0187-4D99-B3AC-6C45EA1B9324}
• HKEY_CLASSES_ROOT\Interface\{BC8C2E5F-D8B4-4997-BCE3-8775C3707956}
• HKEY_CLASSES_ROOT\Interface\{D082721F-4BD4-4B8B-BB82-06753EE6174F}
• HKEY_CLASSES_ROOT\Interface\{D24F9D3C-5D4C-47F8-9AB7-632B44AD6A0D}
• HKEY_CLASSES_ROOT\Interface\{F43EC88B-B6C8-4969-A763-E2BF55602CCE}
• HKEY_CLASSES_ROOT\Interface\{F786CB18-3809-4E49-BC99-9A66DA47DB8B}
• HKEY_CLASSES_ROOT\Interface\{F814BE58-1BF9-4B50-829A-E889F86127AD}
• HKEY_CLASSES_ROOT\RprtsPSClient.PSExecuter
• HKEY_CLASSES_ROOT\RprtsPSClient.PSExecuter.1
• HKEY_CLASSES_ROOT\ShprRprts.HbAx
• HKEY_CLASSES_ROOT\ShprRprts.HbAx.1
• HKEY_CLASSES_ROOT\ShprRprts.HbInfoBand
• HKEY_CLASSES_ROOT\ShprRprts.HbInfoBand.1
• HKEY_CLASSES_ROOT\ShprRprts.IEButton
• HKEY_CLASSES_ROOT\ShprRprts.IEButton.1
• HKEY_CLASSES_ROOT\ShprRprts.IEButtonA
• HKEY_CLASSES_ROOT\ShprRprts.IEButtonA.1
• HKEY_CLASSES_ROOT\ShprRprts.SmrtShprCtl
• HKEY_CLASSES_ROOT\ShprRprts.SmrtShprCtl.1
• HKEY_CLASSES_ROOT\TypeLib\{45397063-D7D0-47C2-9508-26487608A298}
• HKEY_CLASSES_ROOT\TypeLib\{4CF5A3C1-07A2-4336-9B54-6870452EBDE1}
• HKEY_CLASSES_ROOT\TypeLib\{71E9CF40-AF72-4B55-BD3F-1FEA2A0EAEA6}
• HKEY_CLASSES_ROOT\TypeLib\{71EFE583-62FE-4419-9918-CA3B683F7B36}
• HKEY_CLASSES_ROOT\TypeLib\{793AF621-5CD0-4B92-B765-6712F6AAF48E}
• HKEY_CLASSES_ROOT\TypeLib\{842D315A-7E1E-448B-96E8-9E76D1820BE2}
• HKEY_CLASSES_ROOT\TypeLib\{9967A873-40F3-4C7E-9239-6C8760F19F61}
• HKEY_CLASSES_ROOT\TypeLib\{B5901229-25CC-43C9-B604-3BB6AC2B48A5}
• HKEY_CLASSES_ROOT\TypeLib\{B9F51D42-CCA0-4408-BB02-D433D1865A3A}
• HKEY_CLASSES_ROOT\TypeLib\{C83DAED4-0611-4F7A-978E-7FEAFCB2F91B}
• HKEY_CLASSES_ROOT\TypeLib\{F8EE014F-B34C-4544-8E45-95A7971D323B}
• HKEY_CLASSES_ROOT\Wallpaper.WallpaperManager
• HKEY_CLASSES_ROOT\Wallpaper.WallpaperManager.1
• HKEY_CURRENT_USER\Software\HbTools
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\
  Explorer Bars\{2178C864-B8BC-41AE-A1FB-EB6A32F87EB1}
• HKEY_CURRENT_USER\Software\ShopperReports
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\
  Addins\HbtHostOL.HbtMailAnim
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\
  Toolbar "{74CC49F7-EB32-4A08-B204-948962A6E3DB}"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Run "HbTools"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Run "qfrxdkbq"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Run "WeatherOnTray"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Explorer\Browser Helper Objects\{2A8A997F-BB9F-48F6-AA2B-2762D50F9289}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Explorer\Browser Helper Objects\{74CC49F7-EB32-4A08-B204-
  948962A6E3DB}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Uninstall\HbToolsOutlookTools
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Uninstall\HbToolsWebTools

Network Impact

Additional overhead in bandwidth due to unwanted internet connections.

Removal

Aliases

Aliases

• HotBar,Adware : CA eTrust