Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have for some reason had my computer hijacked by the Snap.do malware. It takes over my browser and sets my new tab, startup page and default search engine to snap.do, something that I'm not very fond of. I've tried doing the following things:

  1. Followed the guide on http://blog.anvisoft.com/adware-removal-guide/how-to-remove-search-snap-do-virus-from-ieffchrome-snap-do-toolbar-removal-guide/ to the point, 3 times.
  2. Removing the add-on/extension
  3. Reinstalling Firefox
  4. Doing a full malware scan with SuperAntiSpyware
  5. Adding a mozilla.cfg file to the Mozilla directory with the following text

//
lockPref("browser. startup. homepage", "about:home"); lockPref("browser.newtab.url", "about:home"); lockPref("browser.search.defaultenginename", "data:text/plain,browser.search.defaultenginename%3DDuckDuckGo"); lockPref("browser.search.selectedEngine", "http://www.duckduckgo.com");

It is good for a few days and then it resets back to the malware search engine. What is interesting is that I have added the lockPref("browser.newtab.url", "about:home") and just now the new tab is the malware search engine. When I look at the about:config tab I can find the browser.newtab.url has been changed from about:newtab to the malware url instead.

I'm out of luck here, does anyone have any suggestion on what I could do? Any help is appreciated, thank you!

EDIT

Just remembered I tried using HijackThis to remove the dll files which contained the snap.do malware as well, no luck there either.

share|improve this question
    
have you tried to remove the whole Firefox user's profile –  jet Aug 23 '13 at 21:56
    
Tried it now, but I will have to get back to you in a day or two to make sure that it stays fine, because all the things I tried in the list above worked for a few days before going back to the malware again. –  MagneTism Aug 23 '13 at 22:08

2 Answers 2

up vote 1 down vote accepted

I would try using MalwareBytes to neutralize the threat. http://www.malwarebytes.org/ . Make sure that you run it after updating it fully and booting into Safe mode.

Also try Revo Uninstaller to strip away everything associated with the firefox install, including registry items that may have been affected.

http://www.revouninstaller.com/revo_uninstaller_free_download.html

share|improve this answer
    
I will try that when I get home, currently at work computer. –  MagneTism Aug 24 '13 at 12:42
    
Any update on the situation? –  worseone Aug 30 '13 at 17:08
    
Oh, sorry, I forgot about this one! Yes, it worked fine, thank you very much :) What is the difference between these ones and the ones I tried? –  MagneTism Sep 4 '13 at 12:46
    
I am not familiar with SuperAntiSpyware as a tool, it sounds like it might have a limited scope in terms of what types of malware it is capable of handling. Malwarebytes is a highly reputable Malware removal tool, and by booting into safemode before using it you are able to disarm a lot of methods that malware uses to remain on the system even when you try to remove it. Afaik HJT is a detection tool only, so you would have to be very thorough in removing the actual malware yourself once you found it. –  worseone Sep 4 '13 at 17:05
1  
It's definitely worth trying that as well in the future. That being said having a plurality of tools at your disposal is always helpful. –  worseone Sep 4 '13 at 21:47

take a look here, the removal guide is shown step by step, so I think it would be easy to follow, however choose wisely what antivirus or antimalware software you are going to use :) http://www.xp-vista.com/spyware-removal/snap-do-removal

share|improve this answer
    
Welcome to Super User! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Thor Dec 30 '13 at 16:14
    
This is extremely low quality answer which seems to only exist as a traffic generator to a random website with content that already exists on other websites. –  Ramhound Dec 30 '13 at 16:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.