The short answer is that your computer is infected with spyware that actually infects Norton itself, so that it cannot remove it. it is Fixable but its complicated and I'm unsure how much you know about computers. It might even be easier to reformat.
but if you do the following it will fix it.
(Disclaimer: if you are not comfortable with the following please get a professional or don't attempt. The easiest way is to reformat)
also i personally use the following sites on a daily basis and stand by them 100%
Get the Pocket Killbox from here:
http://bleepingcomputer.com/files/spyware/KillBox.zipUnzip the file to your desktop.
Go offline until this is completed (you may wish to print these instructions).
Boot into Safe Mode and do a search for these files:
guninst.exe
popup_bl.dll
systr.dll
svrhost.exeDelete any found, and then do a search for
param32.dllRun Pocket Killbox and paste the full file path of
param32.dll in the box and click on
Delete on Reboot. Click on the button with the red circle and an X in the middle; you will get a message saying
File will be deleted on next reboot, Process and Reboot now? Click
Yes to reboot. (Note: the 'file path' will be something like C:WINDOWSSystem32param32.dll)
Delete any unwanted icons from your desktop.
Empty your Recycle Bin.
Go to AddRemove Programs in your Control Panel and remove
ADVANCED SEARCHBAR, if found.
Scan with
hijackthis (download it here), and have it fix the following entries:
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = about:NavigationFailure
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = about:NavigationFailure
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://www.newgenlook.info/ad/ad0278/R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = about:NavigationFailure
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = about:NavigationFailure
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = about:NavigationFailure
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = about:NavigationFailure
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank
R3 - URLSearchHook: (no name) - {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - (no file)
O1 - Hosts: 69.50.166.11
www.google.co.ukO1 - Hosts: 69.50.166.11 google.co.uk
O1 - Hosts: 69.50.166.11
www.google.caO1 - Hosts: 69.50.166.11 google.ca
O1 - Hosts: 69.50.166.11
www.google.esO1 - Hosts: 69.50.166.11 google.es
O1 - Hosts: 69.50.166.11
www.google.deO1 - Hosts: 69.50.166.11 google.de
O1 - Hosts: 69.50.166.11
www.google.frO1 - Hosts: 69.50.166.11 google.fr
O1 - Hosts: 69.50.166.12
www.go.comO1 - Hosts: 69.50.166.12 go.com
O1 - Hosts: 69.50.166.13 astalavista.com
O1 - Hosts: 69.50.166.13
www.astalavista.comO1 - Hosts: 69.50.166.13 astalavista.box.sk
O1 - Hosts: 69.50.166.13 cracks.am
O1 - Hosts: 69.50.166.13
www.cracks.amO9 - Extra button: Advanced Searchbar - {43F02779-6D88-4958-8AD3-83C12D86ADC7} - C:PROGRAM FILESADVANCED SEARCHBARTOOLBAR.DLL
O9 - Extra 'Tools' menuitem: Advanced Searchbar -{43F02779-6D88-4958-8AD3-83C12D86ADC7} - C:PROGRAM FILESADVANCEDSEARCHBARTOOLBAR.DLL
O18 - Filter: text/html - {E27A20A0-BE61-11D9-9E02-0008C7E6B749} - C:WINDOWSSYSTEMHIJENCA.DLL
O18 - Filter: text/plain - {E27A20A0-BE61-11D9-9E02-0008C7E6B749} - C:WINDOWSSYSTEMHIJENCA.DLL
Be sure all windows are closed, other then hijackthis, before hitting
Fix checked.
A few more things need to go.
1. Open a DOS box by typing "command" (omit the quotes) in the "Run.." option under your Start button menu.
- At the command prompt in the DOS window, type the following command:
regsvr32 /u C:WINDOWSSYSTEMHIJENCA.DLL
Close the DOS window after the command command completes2. Run HijackThis again and have it fix:
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = about:NavigationFailure
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = about:NavigationFailure
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = about:NavigationFailure
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = about:NavigationFailure
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = about:NavigationFailure
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = about:NavigationFailure
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: ToolHelper - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - C:PROGRA~1ADVANC~1TOOLBAR.DLL (file missing)
O2 - BHO: (no name) - {4948A8E1-BE50-11D9-9E02-000855D4C36C} - C:WINDOWSSYSTEMHIJENCA.DLL
O18 - Filter: text/html - {7CDBC5E3-BE71-11D9-9E02-00084A455E60} - C:WINDOWSSYSTEMHIJENCA.DLL
O18 - Filter: text/plain - {7CDBC5E3-BE71-11D9-9E02-00084A455E60} - C:WINDOWSSYSTEMHIJENCA.DLL
3. Search your system for the C:WINDOWSSYSTEMHIJENCA.DLL file and delete it if it still exists.
Sorry but this particular virus/spyware has no real quick fix and it has many many names.
×