Symptoms:
1. Popup with words CiD in upper left of title bar appears when starting IE.
2. Popup re-appears every few minutes. If you leave the machine and come back later, will be many popups on the screen.
3. Adaware, spybot shows nothing.
The CiD pop-up is an optional sponsor for Windows Live! Plus! (messenger addon). Upon installation it will ask you if you whould show your support by allowing it to install intergrated sponsor support.
If you have this installed on your PC just go to Control Panel – add/remove programs – and select Microsoft Live Plus and you’ll get the option of removing the sponsor support only.
Download NoLop.exe to your desktop.
Download CCleaner. Double click on the file for install.
Download and install SuperAntiSpyware Home Edition Free Version.
Launch SuperAntiSpyware and click on ‘Check for updates’. Once the updates have been installed,exit SuperAntiSpyware. Do not run it just yet.
Uninstall these programs because they are bundled with the CID malware. Go to Start, then Control Panel and then Add/Remove Programs. Click Remove on any of the following:
CiD Help
CiD Manager
DivoCodec
Download Plugin for Internet Explorer
Lop.com
LOP SEARCH
Messenger plus or messenger plus and client
Download Plugin for Internet Explorer
Bitdownload
Zone Media
WinZix
Search Plugin
Window Search
Window Searching
Bitgrabber
BitRol
Bitdownload
Browser Enhancer
Netpumper
Torrent101
W3player
Ultimate Browser Enhancer
Note: if you’re asked for a Verification code, please enter the numbers that appear in the window.
Reboot your computer.
Close any other programs you have running as this will require a reboot. Double click NoLop.exe to run it.
1. Click the button labelled “Search and Destroy”.
2. When scanning is finished you will be prompted to reboot only if infected,click ‘OK’.
3. Now click the “REBOOT” Button.
A Message should popup from NoLop, if not,double click the program again and it will finish.
Note:
If you receive the error,that mscomctl.ocx or one of its dependencies are not correctly registered, please download mscomctl.ocx package,run for install. After that rerun the program.
Download Deljob.exe and save it on your desktop.
Doubleclick Deljob.exe.
Now download Combofix by sUBs and save to your desktop.
Close any open browsers. Double click on combofix.exe and follow the prompts.
Run CCleaner.
Click Analyze button. After scan your system, click Run Cleaner.
Now Start SuperAntiSpyware. On the main screen click on ‘Scan your computer’. Check: ‘Perform Complete Scan’. Click ‘Next’ to start the scan.
Superantispyware will now scan your computer,when it’s finished it will list all/any infections found. Make sure everything found has a checkmark next to it,then press ‘Next’. Click on ‘Finish’ when you’ve done.
If you are still having problems with spyware after completing these instructions, it`s possible, then please follow the steps: How to use Spyware Removal Forum. Post the content of the deljob log (file logit.txt on your desktop) in your post.
You can remove the sponsor program by un-installing Messenger Plus and then re-installing and refusing to install the sponsor program.
I downloaded the mscomctl.ocx package but it only says that it might not have been installed correctly. I use Vista if it makes any difference
Jimmy, skip “nolop.exe” step or ask us for help at our forum.
Yep, just go to control pannel –> add/remove programs and click on the msn plus and click ‘change/remove’ button and then choose to remove sponser. thanks for the help 😀
what do i do if it doesent show up on the list???
please help!!!!
peter, whats list ? You can ask for help at our Spyware removal forum.
You can to just go to the software search in the list messenger plus click on delete/change and then click on sponser then you can unistall it.
messenger pluss isnt uninstalled
i trie to do al of these steps, but its still here! i dont even HAVE msn plus anymore, and it has infected other users on my computor, even the password-encryped admin user. do i need to reinstall it and romove sponser like that?
please reply.
peter, make a new topic in our Spyware removal forum. I will help you.
Worked perfectly! Thank you so much for the help! 🙂
Thanks!