cancel
Showing results for 
Search instead for 
Did you mean: 

Question about Norton Popup "Get your Norton Toolbar back!"?

Jeanne123
Level 2

Operating system is Windows Vista.  (I know, poor me!)

Yesterday I started getting a popup message that states:  "Changes in the latest version of Googl Chrome require re-installing the Norton Toolbar from the Chrome Web Store.  Click "Install Now" to get your full web protection back in your browser."

QUESTION:  Since I don't recall having the Norton Toolbar displayed and the popup looks strange, I am concerned about clicking on it, even to close it.  Is this a legitimate message from Symantec?  It's taking up about 1/4 of my screen and is difficult to work around.

Thank you.

 

20 REPLIES 20

_r___
Level 6
Certified

Have a screenshot?

Jeanne123
Level 2

Hi Brian, I've attached a file with a screenshot.

_r___
Level 6
Certified

Would appear to be legit if you upgraded chrome.

I assume you have norton installed on this system?

Jeanne123
Level 2

I switched to Chrome about a year ago and have not intentionally upgraded it.  

I do have Norton installed on my pc, however I do not recall ever receiving any popups from Norton, so I checked Norton and the internet to see if I could find anything about this specific issue.  I did see articles about the toolbar disappearing, but not this exact popup message.  I guess the title looked suspicious to me and it seemed like the perfect way to deliver some malware--making it look like you were doing a legitimate re-install.

Anyway, thank you very much for taking the time to help.  Maybe I'll go to the "Chrome Web Store" to see if I can install it from there.  That would make me feel better.  

arbright
Not applicable

I have the same message only it won't go away.  I've tried everything on the screen and it won't go away.  Any ideas on how to get rid of it?

SIexpert
Not applicable

I GET SAME MESSAGE AS JEANNE123.  I USE WINDOWS 7, FIREFOX AND NORTON 360.  TRIED ABOUT EVERYTHING, AND CAN'T GET MESSAGE OFF,  DOES ANYONE KNOW IF IT'S MALWARE?

 

conlem
Not applicable

I've been afflicted too!

Where is Symantec in all this?

 

rickbarb
Level 2

ME TOO  Dec.26,2014??????????????

_r___
Level 6
Certified

Please check the Norton community:

http://community.norton.com/

rickbarb
Level 2

THERE IS NO NEW INFO,bRIAN,AT THAT SITE BEYON nO 2014 re this problem

_r___
Level 6
Certified

No need for CAPS, I can read.

This forum is for Symantec Endpoint Protection, Enterprise and Small Business. Norton is consumer/home based which is why I suggested to check their forum and post there as you'll receive support for the product.

sdonthy
Level 3

Don't fall for this scam. This popup is from a Adware company called AskPartners.

 

sdonthy
Level 3

There are quite a few companies that are part of thi network. I spoke to 2 such companies using the phone number that shows up on my screen. This virus takes full control of the browser and will make the computer very unusable.

 

sdonthy
Level 3

Norton, Symantec and McCafee  are all silent about this network program because it is helping them sell more pc scanners. Win win for all of them.

sdonthy
Level 3

I have tried Norton and Malwarebytes on one laptop. Both did not catch it. 

sdonthy
Level 3

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Installer\Products\D2A425F405350054677A7A857BC08110]
"ProductName"="Search App by Ask"
"PackageCode"="7B6938074340C6747A110922C6170CAE"
"Language"=dword:00000000
"Version"=dword:0c180001
"Transforms"=hex(2):43,00,3a,00,5c,00,77,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,5c,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,65,00,72,00,5c,00,7b,00,\
  34,00,46,00,35,00,32,00,34,00,41,00,32,00,44,00,2d,00,35,00,33,00,35,00,30,\
  00,2d,00,34,00,35,00,30,00,30,00,2d,00,37,00,36,00,41,00,37,00,2d,00,41,00,\
  37,00,35,00,38,00,42,00,37,00,30,00,43,00,31,00,38,00,30,00,31,00,7d,00,5c,\
  00,31,00,30,00,33,00,33,00,2e,00,6d,00,73,00,74,00,00,00
"Assignment"=dword:00000001
"AdvertiseFlags"=dword:00000184
"ProductIcon"="C:\\windows\\Installer\\{4F524A2D-5350-4500-76A7-A758B70C1801}\\ToolbarIcon.exe"
"InstanceType"=dword:00000000
"AuthorizedLUAApp"=dword:00000000
"DeploymentFlags"=dword:00000003
"Clients"=hex(7):3a,00,00,00,00,00

[HKEY_CLASSES_ROOT\Installer\Products\D2A425F405350054677A7A857BC08110\SourceList]
"PackageName"="AskToolbarInstaller-12.24.1_ORJ-SPE.msi"
"LastUsedSource"=hex(2):6e,00,3b,00,31,00,3b,00,43,00,3a,00,5c,00,50,00,72,00,\
  6f,00,67,00,72,00,61,00,6d,00,44,00,61,00,74,00,61,00,5c,00,41,00,50,00,4e,\
  00,5c,00,41,00,50,00,4e,00,2d,00,53,00,74,00,75,00,62,00,5c,00,4f,00,52,00,\
  4a,00,2d,00,53,00,50,00,45,00,5c,00,00,00

[HKEY_CLASSES_ROOT\Installer\Products\D2A425F405350054677A7A857BC08110\SourceList\Media]
"1"=";"

[HKEY_CLASSES_ROOT\Installer\Products\D2A425F405350054677A7A857BC08110\SourceList\Net]
"1"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,44,00,\
  61,00,74,00,61,00,5c,00,41,00,50,00,4e,00,5c,00,41,00,50,00,4e,00,2d,00,53,\
  00,74,00,75,00,62,00,5c,00,4f,00,52,00,4a,00,2d,00,53,00,50,00,45,00,5c,00,\
  00,00
"2"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,\
  46,00,69,00,6c,00,65,00,73,00,20,00,28,00,78,00,38,00,36,00,29,00,5c,00,41,\
  00,73,00,6b,00,50,00,61,00,72,00,74,00,6e,00,65,00,72,00,4e,00,65,00,74,00,\
  77,00,6f,00,72,00,6b,00,5c,00,54,00,6f,00,6f,00,6c,00,62,00,61,00,72,00,5c,\
  00,4f,00,52,00,4a,00,2d,00,53,00,50,00,45,00,5c,00,53,00,6f,00,75,00,72,00,\
  63,00,65,00,00,00

 

sdonthy
Level 3

Killing the process does not seem to help. Another service is starting the process again.

sdonthy
Level 3

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\AskPartnerNetwork]

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar]

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\shared]
"EnableSA"="1"

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater]
"LastPlatformVersion"="12.24.1.51"
"tbnguid"="52F26EB1-8537-40E3-B29D-7DEA6A0EEA2C"
"iedsgdisable"=dword:00000001

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater\ORJ-SPE]
"hpr_ie_set"=dword:00000000
"hpr_ff_set"=dword:00000001
"hpr_cr_set"=dword:00000000
"sa_ie_set"=dword:00000000
"sa_ff_set"=dword:00000001
"sa_cr_set"=dword:00000000
"hpr_ff"="http://www.search.ask.com/?tpid=ORJ-SPE&o=APN11408&pf=V7&trgb=FF&p2=%5EBBG%5EOSJ000%5EYY%5EUS&gct=hp&apn_ptnrs=BBG&apn_dtid=%5EOSJ000%5EYY%5EUS&apn_dbr=ff_36.0.0.5531&apn_uid=E564B8AE-8A53-4962-BC17-A5CED7B5493D&itbv=12.24.1.51&doi=2015-02-28&psv=&pt=tb"
"nthp_ff"="1"
"sa_ff"="1"
"timeinstalled_ff"="2015-02-28T12:50:44"
"timeinstalled"="2015-02-28T12:50:44"
"dailyconfigupdateime"="2015-03-01T12:37:56"
"postinstallreportstate"=dword:ffffffff
"ff_tb_set"=dword:00000001
"ff_tb"=dword:00000000

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater\ORJ-SPE\Reporting]
"lastUpdateCallLatency"="4899"
"lastConfigDnldLatency"="359"

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater\ORJ-SPE\ServerSwitches]
"switches/enableIEToolbarProtection"=dword:00000001
"switches/enableChromeSearchProtection"=dword:00000001
"switches/enableFFToolbarProtection"=dword:00000000
"switches/enableGCDefaultSearchGuard"=dword:00000001
"switches/enableGCNewTabGuard"=dword:00000001
"switches/enableGCSideLoad"=dword:00000001
"switches/enableGCStartupPage"=dword:00000001
"switches/enableHPG"=dword:00000000
"switches/enableIEDefaultSearchAssist"=dword:00000001
"switches/enableNTHP"=dword:00000001
"switches/enableFFHPG"=dword:00000000
"switches/enableVNT"=dword:00000000
"switches/enableFFRevert"=dword:00000001
"switches/enableGCStockURLMonitor"=dword:00000000
"switches/enableGC32Rebuttal"=dword:00000000
"switches/enableGCEnableAssist"=dword:00000000
"switches/enableIENTG"=dword:00000000
"switches/enableIEIDC"=dword:00000001
"switches/enableGCIDC"=dword:00000000
"switches/enableGCRetakeOffer"=dword:00000000
"switches/enableIEDSByPass"=dword:00000000
"switches/enableIETakeDSAssist"=dword:00000001
"switches/enableIEHPRebuttal"=dword:00000001
"switches/enableIENTRebuttal"=dword:00000001
"switches/enableIEDSRebuttal"=dword:00000001

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater\report]
"ie_hpr"=dword:00000000
"ie_ds"=dword:00000000
"ie_nt"=dword:00000000
"ie_countEnabled"=dword:00000000
"ie_countDisabled"=dword:00000000
"ff_hpr"=dword:00000000
"ff_crm"=dword:00000000
"ff_countEnabled"=dword:00000000
"ff_countDisabled"=dword:00000001
"ff_nt"=dword:00000000
"cr_hb"=dword:00000000
"cr_ds"=dword:00000000
"cr_start"=dword:00000000
"cr_nt"=dword:00000000
"cr_signin"=dword:00000000
"cr_countEnabled"=dword:00000000
"cr_countDisabled"=dword:00000000
"assetLost"=""
"comp"=""
"ie_browserRestarted"=dword:fffffffc
"ff_browserRestarted"=dword:00000000
"cr_browserRestarted"=dword:fffffffc
"ie_tb"=dword:fffffffc
"ff_tb"=dword:fffffffd
"cr_tb"=dword:fffffffc

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater\Settings]
"ffhpr_prev"="about:home"
"ffhpr_inst"="http://www.search.ask.com/?tpid=ORJ-SPE&o=APN11408&pf=V7&trgb=FF&p2=%5EBBG%5EOSJ000%5EYY%5EUS&gct=hp&apn_ptnrs=BBG&apn_dtid=%5EOSJ000%5EYY%5EUS&apn_dbr=ff_36.0.0.5531&apn_uid=E564B8AE-8A53-4962-BC17-A5CED7B5493D&itbv=12.24.1.51&doi=2015-02-28&psv=&pt=tb"
"ffsa_selectengine_prev"=""
"ffsa_defaultengine_prev"=""
"ffsa_selectengine_inst"=""

[HKEY_CURRENT_USER\Software\AskPartnerNetwork\Toolbar\Updater\Shutdown]
"done"=dword:00000000

 

MillieEspo
Level 2

I have been getting the same issue here lately! Any help will be much appreciated.