My Anti Spyware

How to remove CID popups

Symptoms:
1. Popup with words CiD in upper left of title bar appears when starting IE.
2. Popup re-appears every few minutes. If you leave the machine and come back later, will be many popups on the screen.
3. Adaware, spybot shows nothing.

The CiD pop-up is an optional sponsor for Windows Live! Plus! (messenger addon). Upon installation it will ask you if you whould show your support by allowing it to install intergrated sponsor support.

If you have this installed on your PC just go to Control Panel – add/remove programs – and select Microsoft Live Plus and you’ll get the option of removing the sponsor support only.

Download NoLop.exe to your desktop.
Download CCleaner. Double click on the file for install.
Download and install SuperAntiSpyware Home Edition Free Version.

Launch SuperAntiSpyware and click on ‘Check for updates’. Once the updates have been installed,exit SuperAntiSpyware. Do not run it just yet.

Uninstall these programs because they are bundled with the CID malware. Go to Start, then Control Panel and then Add/Remove Programs. Click Remove on any of the following:

CiD Help
CiD Manager
DivoCodec
Download Plugin for Internet Explorer
Lop.com
LOP SEARCH
Messenger plus or messenger plus and client
Download Plugin for Internet Explorer
Bitdownload
Zone Media
WinZix
Search Plugin
Window Search
Window Searching
Bitgrabber
BitRol
Bitdownload
Browser Enhancer
Netpumper
Torrent101
W3player
Ultimate Browser Enhancer

Note: if you’re asked for a Verification code, please enter the numbers that appear in the window.
Reboot your computer.

Close any other programs you have running as this will require a reboot. Double click NoLop.exe to run it.

1. Click the button labelled “Search and Destroy”.
2. When scanning is finished you will be prompted to reboot only if infected,click ‘OK’.
3. Now click the “REBOOT” Button.

A Message should popup from NoLop, if not,double click the program again and it will finish.

Note:

If you receive the error,that mscomctl.ocx or one of its dependencies are not correctly registered, please download mscomctl.ocx package,run for install. After that rerun the program.

Download Deljob.exe and save it on your desktop.
Doubleclick Deljob.exe.

Now download Combofix by sUBs and save to your desktop.
Close any open browsers. Double click on combofix.exe and follow the prompts.

Run CCleaner.

Click Analyze button. After scan your system, click Run Cleaner.

Now Start SuperAntiSpyware. On the main screen click on ‘Scan your computer’. Check: ‘Perform Complete Scan’. Click ‘Next’ to start the scan.

Superantispyware will now scan your computer,when it’s finished it will list all/any infections found. Make sure everything found has a checkmark next to it,then press ‘Next’. Click on ‘Finish’ when you’ve done.

If you are still having problems with spyware after completing these instructions, it`s possible, then please follow the steps: How to use Spyware Removal Forum. Post the content of the deljob log (file logit.txt on your desktop) in your post.

How To Remove cyberstoll.com, search-daily.com hijacker and WebHancer spyware

Symptom:
When you do a Google search, you got a search results, but if you click on one of the results, you got redirect to cyberstoll.com or search-daily.com

Download HijackThis and save the file to your desktop. Double click on the file for install.
Download CCleaner. Double click on the file for install.
Download SmitfraudFix (by S!Ri) Extract the content (a folder named SmitfraudFix) to your desktop.
Download LspFix and extract the content to your desktop.

Go to Start > Control Panel > Add or Remove Programs and remove the following programs, if found: WebHancer.

Reboot your computer in Safe Mode by doing the following:

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the first option, to run Windows in Safe Mode.

Start HijackThis. Click “Do a system scan only.” and put a checkmark next to the following items:

O2 – BHO: (no name) – {F71D25F6-E9F6-401B-AD3D-AB9F7D36E6C7} – C:\WINDOWS\system32\dinpu.dll

Close all browser and other windows except for HijackThis. Click “Fix Checked”.

Reboot your PC.

Run LSPFix.exe

Check the I know what I’m doing box.
In the Keep box, select the webhdll.dll (Protocol handler) and move it to the Remove box by clicking the >> button.
When you are done click Finish>>.
When LSP-Fix is done removing the LSP you will see a summary box. At this point the LSP has been removed and you can press OK to shutdown LSP-Fix.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd.

Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended).
You will be prompted : “Registry cleaning – Do you want to clean the registry ?“; answer “Yes” by typing Y and press “Enter” in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer “Yes” by typing Y and press “Enter”.
The tool may need to restart your computer to finish the cleaning process; if it doesn’t, please restart it into Normal Windows.

Open notepad and copy/paste the text in the quotebox below into it:

@echo off
sc stop gzncfggw
sc delete gzncfggw
exit

Save this as fix.bat to your Desktop (remember to select Save as file type: All files in Notepad.).Double-click on the fix.bat.

Run CCleaner.

Click Analyze button. After scan your system, click Run Cleaner.

If you are still having problems with spyware after completing these instructions, it`s possible, then please follow the steps: How to use Spyware Removal Forum