cancel
Showing results for 
Search instead for 
Did you mean: 

Question about Norton Popup "Get your Norton Toolbar back!"?

Operating system is Windows Vista.  (I know, poor me!)

Yesterday I started getting a popup message that states:  "Changes in the latest version of Googl Chrome require re-installing the Norton Toolbar from the Chrome Web Store.  Click "Install Now" to get your full web protection back in your browser."

QUESTION:  Since I don't recall having the Norton Toolbar displayed and the popup looks strange, I am concerned about clicking on it, even to close it.  Is this a legitimate message from Symantec?  It's taking up about 1/4 of my screen and is difficult to work around.

Thank you.

 

19 Replies

Have a screenshot?

Have a screenshot?

Hi Brian, I've attached a

Hi Brian, I've attached a file with a screenshot.

Would appear to be legit if

Would appear to be legit if you upgraded chrome.

I assume you have norton installed on this system?

I switched to Chrome about a

I switched to Chrome about a year ago and have not intentionally upgraded it.  

I do have Norton installed on my pc, however I do not recall ever receiving any popups from Norton, so I checked Norton and the internet to see if I could find anything about this specific issue.  I did see articles about the toolbar disappearing, but not this exact popup message.  I guess the title looked suspicious to me and it seemed like the perfect way to deliver some malware--making it look like you were doing a legitimate re-install.

Anyway, thank you very much for taking the time to help.  Maybe I'll go to the "Chrome Web Store" to see if I can install it from there.  That would make me feel better.  

I have the same message only

I have the same message only it won't go away.  I've tried everything on the screen and it won't go away.  Any ideas on how to get rid of it?

I GET SAME MESSAGE AS

I GET SAME MESSAGE AS JEANNE123.  I USE WINDOWS 7, FIREFOX AND NORTON 360.  TRIED ABOUT EVERYTHING, AND CAN'T GET MESSAGE OFF,  DOES ANYONE KNOW IF IT'S MALWARE?

 

I've been afflicted

I've been afflicted too!

Where is Symantec in all this?

 

ME TOO

ME TOO  Dec.26,2014??????????????

Please check the Norton

Please check the Norton community:

http://community.norton.com/

THERE IS NO NEW INFO,bRIAN,AT

THERE IS NO NEW INFO,bRIAN,AT THAT SITE BEYON nO 2014 re this problem

No need for CAPS, I can

No need for CAPS, I can read.

This forum is for Symantec Endpoint Protection, Enterprise and Small Business. Norton is consumer/home based which is why I suggested to check their forum and post there as you'll receive support for the product.

Don't fall for this scam.

Don't fall for this scam. This popup is from a Adware company called AskPartners.

 

There are quite a few

There are quite a few companies that are part of thi network. I spoke to 2 such companies using the phone number that shows up on my screen. This virus takes full control of the browser and will make the computer very unusable.

 

Norton, Symantec and McCafee 

Norton, Symantec and McCafee  are all silent about this network program because it is helping them sell more pc scanners. Win win for all of them.

I have tried Norton and

I have tried Norton and Malwarebytes on one laptop. Both did not catch it. 

Windows Registry Editor

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Installer\Products\D2A425F405350054677A7A857BC08110]
"ProductName"="Search App by Ask"
"PackageCode"="7B6938074340C6747A110922C6170CAE"
"Language"=dword:00000000
"Version"=dword:0c180001
"Transforms"=hex(2):43,00,3a,00,5c,00,77,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,5c,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,65,00,72,00,5c,00,7b,00,\
  34,00,46,00,35,00,32,00,34,00,41,00,32,00,44,00,2d,00,35,00,33,00,35,00,30,\
  00,2d,00,34,00,35,00,30,00,30,00,2d,00,37,00,36,00,41,00,37,00,2d,00,41,00,\
  37,00,35,00,38,00,42,00,37,00,30,00,43,00,31,00,38,00,30,00,31,00,7d,00,5c,\
  00,31,00,30,00,33,00,33,00,2e,00,6d,00,73,00,74,00,00,00
"Assignment"=dword:00000001
"AdvertiseFlags"=dword:00000184
"ProductIcon"="C:\\windows\\Installer\\{4F524A2D-5350-4500-76A7-A758B70C1801}\\ToolbarIcon.exe"
"InstanceType"=dword:00000000
"AuthorizedLUAApp"=dword:00000000
"DeploymentFlags"=dword:00000003
"Clients"=hex(7):3a,00,00,00,00,00

[HKEY_CLASSES_ROOT\Installer\Products\D2A425F405350054677A7A857BC08110\SourceList]
"PackageName"="AskToolbarInstaller-12.24.1_ORJ-SPE.msi"
"LastUsedSource"=hex(2):6e,00,3b,00,31,00,3b,00,43,00,3a,00,5c,00,50,00,72,00,\
  6f,00,67,00,72,00,61,00,6d,00,44,00,61,00,74,00,61,00,5c,00,41,00,50,00,4e,\
  00,5c,00,41,00,50,00,4e,00,2d,00,53,00,74,00,75,00,62,00,5c,00,4f,00,52,00,\
  4a,00,2d,00,53,00,50,00,45,00,5c,00,00,00

[HKEY_CLASSES_ROOT\Installer\Products\D2A425F405350054677A7A857BC08110\SourceList\Media]
"1"=";"

[HKEY_CLASSES_ROOT\Installer\Products\D2A425F405350054677A7A857BC08110\SourceList\Net]
"1"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,44,00,\
  61,00,74,00,61,00,5c,00,41,00,50,00,4e,00,5c,00,41,00,50,00,4e,00,2d,00,53,\
  00,74,00,75,00,62,00,5c,00,4f,00,52,00,4a,00,2d,00,53,00,50,00,45,00,5c,00,\
  00,00
"2"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,\
  46,00,69,00,6c,00,65,00,73,00,20,00,28,00,78,00,38,00,36,00,29,00,5c,00,41,\
  00,73,00,6b,00,50,00,61,00,72,00,74,00,6e,00,65,00,72,00,4e,00,65,00,74,00,\
  77,00,6f,00,72,00,6b,00,5c,00,54,00,6f,00,6f,00,6c,00,62,00,61,00,72,00,5c,\
  00,4f,00,52,00,4a,00,2d,00,53,00,50,00,45,00,5c,00,53,00,6f,00,75,00,72,00,\
  63,00,65,00,00,00

 

Killing the process does not

Killing the process does not seem to help. Another service is starting the process again.

Windows Registry Editor

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\AskPartnerNetwork]

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar]

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\shared]
"EnableSA"="1"

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater]
"LastPlatformVersion"="12.24.1.51"
"tbnguid"="52F26EB1-8537-40E3-B29D-7DEA6A0EEA2C"
"iedsgdisable"=dword:00000001

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater\ORJ-SPE]
"hpr_ie_set"=dword:00000000
"hpr_ff_set"=dword:00000001
"hpr_cr_set"=dword:00000000
"sa_ie_set"=dword:00000000
"sa_ff_set"=dword:00000001
"sa_cr_set"=dword:00000000
"hpr_ff"="http://www.search.ask.com/?tpid=ORJ-SPE&o=APN11408&pf=V7&trgb=FF&p2=%5EBBG%5EOSJ000%5EYY%5EUS&gct=hp&apn_ptnrs=BBG&apn_dtid=%5EOSJ000%5EYY%5EUS&apn_dbr=ff_36.0.0.5531&apn_uid=E564B8AE-8A53-4962-BC17-A5CED7B5493D&itbv=12.24.1.51&doi=2015-02-28&psv=&pt=tb"
"nthp_ff"="1"
"sa_ff"="1"
"timeinstalled_ff"="2015-02-28T12:50:44"
"timeinstalled"="2015-02-28T12:50:44"
"dailyconfigupdateime"="2015-03-01T12:37:56"
"postinstallreportstate"=dword:ffffffff
"ff_tb_set"=dword:00000001
"ff_tb"=dword:00000000

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater\ORJ-SPE\Reporting]
"lastUpdateCallLatency"="4899"
"lastConfigDnldLatency"="359"

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater\ORJ-SPE\ServerSwitches]
"switches/enableIEToolbarProtection"=dword:00000001
"switches/enableChromeSearchProtection"=dword:00000001
"switches/enableFFToolbarProtection"=dword:00000000
"switches/enableGCDefaultSearchGuard"=dword:00000001
"switches/enableGCNewTabGuard"=dword:00000001
"switches/enableGCSideLoad"=dword:00000001
"switches/enableGCStartupPage"=dword:00000001
"switches/enableHPG"=dword:00000000
"switches/enableIEDefaultSearchAssist"=dword:00000001
"switches/enableNTHP"=dword:00000001
"switches/enableFFHPG"=dword:00000000
"switches/enableVNT"=dword:00000000
"switches/enableFFRevert"=dword:00000001
"switches/enableGCStockURLMonitor"=dword:00000000
"switches/enableGC32Rebuttal"=dword:00000000
"switches/enableGCEnableAssist"=dword:00000000
"switches/enableIENTG"=dword:00000000
"switches/enableIEIDC"=dword:00000001
"switches/enableGCIDC"=dword:00000000
"switches/enableGCRetakeOffer"=dword:00000000
"switches/enableIEDSByPass"=dword:00000000
"switches/enableIETakeDSAssist"=dword:00000001
"switches/enableIEHPRebuttal"=dword:00000001
"switches/enableIENTRebuttal"=dword:00000001
"switches/enableIEDSRebuttal"=dword:00000001

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater\report]
"ie_hpr"=dword:00000000
"ie_ds"=dword:00000000
"ie_nt"=dword:00000000
"ie_countEnabled"=dword:00000000
"ie_countDisabled"=dword:00000000
"ff_hpr"=dword:00000000
"ff_crm"=dword:00000000
"ff_countEnabled"=dword:00000000
"ff_countDisabled"=dword:00000001
"ff_nt"=dword:00000000
"cr_hb"=dword:00000000
"cr_ds"=dword:00000000
"cr_start"=dword:00000000
"cr_nt"=dword:00000000
"cr_signin"=dword:00000000
"cr_countEnabled"=dword:00000000
"cr_countDisabled"=dword:00000000
"assetLost"=""
"comp"=""
"ie_browserRestarted"=dword:fffffffc
"ff_browserRestarted"=dword:00000000
"cr_browserRestarted"=dword:fffffffc
"ie_tb"=dword:fffffffc
"ff_tb"=dword:fffffffd
"cr_tb"=dword:fffffffc

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater\Settings]
"ffhpr_prev"="about:home"
"ffhpr_inst"="http://www.search.ask.com/?tpid=ORJ-SPE&o=APN11408&pf=V7&trgb=FF&p2=%5EBBG%5EOSJ000%5EYY%5EUS&gct=hp&apn_ptnrs=BBG&apn_dtid=%5EOSJ000%5EYY%5EUS&apn_dbr=ff_36.0.0.5531&apn_uid=E564B8AE-8A53-4962-BC17-A5CED7B5493D&itbv=12.24.1.51&doi=2015-02-28&psv=&pt=tb"
"ffsa_selectengine_prev"=""
"ffsa_defaultengine_prev"=""
"ffsa_selectengine_inst"=""

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater\Shutdown]
"done"=dword:00000000

 

I have been getting the same

I have been getting the same issue here lately! Any help will be much appreciated.