Go to Add/Remove Programs and uninstall:
Ask.com
Ask Toolbar
or anything with Ask in the name.
----------
Open HijackThis and select
Do a system scan only.
Place a check mark next to the following entries: (if there)
- R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
- O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
- O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
- O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
- O2 - BHO: (no name) - {891B76B0-D49C-4D9B-BCB3-40C919F5FD62} - (no file)
- O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
- O3 - Toolbar: (no name) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - (no file)
- O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
- O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
- O15 - Trusted Zone: http://www.adobe.com
- O15 - Trusted Zone: http://www.drewdavisband.com
- O15 - Trusted Zone: http://*.turbotax.com
- O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} -
- O18 - Filter hijack: text/html - (no CLSID) - (no file)
- O20 - Winlogon Notify: ssqomlm - ssqomlm.dll (file missing)
- O23 - Service: McAfee Application Installer Cleanup (0038321227012829) (0038321227012829mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\003832~1.EXE (file missing)
- O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeImportant: Close all windows except for HijackThis and then click
Fix checked.
Exit HijackThis.
----------
Download the
Norton Removal Tool (SymNRT) to your Desktop.
Once downloaded please close ALL open browsers, also save any work because this may require a restart.- Go to your desktop and double click on the removal tool and then click Setup.
- Once open Click Next
- Accept the license agreement and click Next
- Type in the letters/numbers that you see into the text box then click Next.
- Then click Next and the tool will start running.
- Once finished restart the PC and run the tool again to ensure everything has been removed.
- Delete Nortonremoval tool from your Desktop.
----------
Download
Disable/Remove Windows Messenger to the Desktop to remove
Windows Messenger.
Do not confuse
Windows Messenger with
MSN Messenger because they are not the same.
Windows Messenger is a frequent cause of popups.
Unzip the file on the Desktop. Open the
MessengerDisable.exe and choose the bottom box -
Uninstall Windows Messenger and click
Apply.
Exit out of MessengerDisable then delete the two files that were put on the Desktop.
Run CCleaner and restart the computer.
----------
Download ComboFix© by sUBs from one of the below links. Be sure top save it to the
Desktop.
Link #1Link #2**Note: It is important that it is saved directly to your DesktopClose any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.
Temporarily
disable your
antivirus, and any
antispyware real time protection
before performing a scan. Click
this link to see a list of security programs that should be disabled and how to disable them.
Double click combofix.exe & follow the prompts.
For Windows XP Systems install the Recovery Console:- If you are using Windows XP and do not already have the Recovery Console installed, please ensure your Internet connection is active (if possible) and click
Yes.
- If for some reason your Internet is not working click
No.
-
If you are not using Windows XP, you will not be prompted.
- When prompted to accept the EULA click
OK.
- Accept Microsoft's EULA (Click
Yes).
- When you are told that the RC is installed correctly click
YES to continue scanning for malware.
When finished ComboFix will produce a log for you.
Post the
ComboFix log and a new
HijackThis log in your next reply.
Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.