Hotbar - Re-Post

[Rob]

I originally posted this last night at 9:49pm but, for whatever reason, it never showed up
so I'll try again.

XPh - Running ZA(free), Spybot & AdAware in addition to MSAS.
My daughter's machine has recently become plagued with Hotbar attempting to install.
MSAS pos up a warning as soon as she logs on.
Telling it to remove the threat results in it getting busy (flashes up registry entries)
and saying it's deleted.
All is well until the next time she logs on.
I've searched this ng and tried many of the solutions offered but no go.

Also (related?) MSAS pops up another window-hidden behind the foregoing-advising that it
has detected something trying to make a change to the "restricted sites" and asks if it
should be blocked.
Just "for fun", after blocking it many times, I allowed it but did not see any changes.

I was wondering if someone could point me in the right direction.

 

[Guest]

Rob, Symantec have a removal tool for Hotbar.See the following:
http://securityresponse.symantec.com/avcenter/venc/data/adware.hotbar.html
Also,make sure that MSAS scans on your daughters machine are run from an
admin account.
Check the security settings on I.E. by going to Tools>Internet
Options>Security>Restricted Sites and make sure the slide bar is set to
"High".
Good luck.

 

[Rob]

Mike, and any other "interested parties";
I was up too long last night trying to figure this out, so I'm a little punchy!
Please see my "reply" which has the subject "Hotbar trying to install".
BTW Restricted sites security is "High".

 

[Dave M]

Rob;
MSAS Beta1 has a bug with adding sites to the trusted/restricted sites... this
is documented on SpyBot's FAQ as well as here:
http://support.microsoft.com/?kbid=902956
The correct action is to Allow Spybot to do this, the sites are added to your
Restricted list not to your Trusted list.

 

[Rob]

Thanks Dave.

 

[Guest]

I am experiencing the same problem. I do not have a solution yet, however I
beleve the source of the problem might be (?) the visiting/use of Poker Stars
web site?
It may also be related to Actixe X settings?