Should I remove “Win32/Adware.HotBar.T”?

The Win32/Adware.HotBar.T is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Adware.HotBar.T virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Authenticode signature is invalid

How to determine Win32/Adware.HotBar.T?


File Info:
name: C29711C8EFFAE9918295.mlw
path: /opt/CAPEv2/storage/binaries/a63a8fec5a2f5676dba0f42947855ce87897fddb3ac8e7ac5847203d2ec32c6c
crc32: 257217CF
md5: c29711c8effae9918295f2ab29830f5b
sha1: a202403d63fe47344325af984e9507089836f221
sha256: a63a8fec5a2f5676dba0f42947855ce87897fddb3ac8e7ac5847203d2ec32c6c
sha512: 29403178fdc7631ba235b5a3ec63353180f3483228969fcaaefbf310e151da8e5f9e9ccb84a48f1c95110d35ada9ba304c416e26c640574f1a600e73128d2cfd
ssdeep: 3072:nQIURTXJhhcsP6CELEt1LMf3chUEdXEqEHnVkrhAJhHYhOzfTQOb/bwM3S:nsp/6CEuLMfCUiX3ahHYWfxwM3S
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T130F312D63AC0D5FBE5920F715A73967EE7B9E3000A11264B47361FAF6824183C42B6E7
sha3_384: 2796eebc466bb4464e3ca917f0637146c734ff3411d60e8b50f767c315f0eef28f3c8bc590eabb572d26e8ecf4b970f0
ep_bytes: 81ec8001000053555633db57895c2418
timestamp: 2009-12-05 22:50:46

Version Info:
FileDescription: 
FileVersion: 1.0.10.0
LegalCopyright: 
ProductVersion: 1.0.10.0
Translation: 0x0409 0x04e4

Win32/Adware.HotBar.T also known as:

Lionic	Adware.Win32.Generic.lCtg
MicroWorld-eScan	Application.Agent.HVX
ClamAV	Win.Adware.Shopper-106
FireEye	Application.Agent.HVX
CAT-QuickHeal	Adware.NSIS.Hotbar
McAfee	RDN/Generic PUP.z
Cylance	Unsafe
VIPRE	Application.Agent.HVX
K7AntiVirus	Adware ( 004d241f1 )
CrowdStrike	win/grayware_confidence_100% (D)
Symantec	SMG.Heur!gen
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Adware.HotBar.T
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	not-a-virus:VHO:AdWare.Win32.Convagent.gen
BitDefender	Application.Agent.HVX
NANO-Antivirus	Trojan.Win32.Shopper.bczaeo
Avast	NSIS:Zango [PUP]
Ad-Aware	Application.Agent.HVX
Emsisoft	Application.Agent.HVX (B)
DrWeb	Adware.Zango.15
Zillya	Adware.Shopper.Win32.187
McAfee-GW-Edition	GenericRXET-AK!EAA970C0849D
Trapmine	suspicious.low.ml.score
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Suspicious PE
GData	Application.Agent.HVX
Avira	HEUR/AGEN.1211274
Antiy-AVL	Trojan/Generic.ASMalwS.329
Kingsoft	Win32.Malware.Generic.a.(kcloud)
Arcabit	Application.Agent.HVX
Microsoft	Trojan:Win32/Skeeyah.A!MTB
Google	Detected
AhnLab-V3	PUP/Win32.Shopper.R275330
ALYac	Application.Agent.HVX
MAX	malware (ai score=75)
VBA32	Adware.Zango
Malwarebytes	Malware.AI.4213429752
TrendMicro-HouseCall	TROJ_GEN.R002H0CCB22
Rising	Trojan.Generic@AI.87 (RDMK:dQiOJhtpkhYvkssAAv/jJQ)
Ikarus	not-a-virus:AdWare.Win32.Shopper
Fortinet	Adware/Shopper
AVG	NSIS:Zango [PUP]
Cybereason	malicious.8effae

How to remove Win32/Adware.HotBar.T?

Win32/Adware.HotBar.T removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X