My browser appears to have been hijacked by something called Hola toolbar or Hola Search. I have tried uninstalling it but it just won’t go away. Searching on the internet it appears to download info from your PC or browser but my Avast scan is not picking anything up?
Does anyone know how to get rid of it and just how dangerous is it?
Run AdwCleaner.
Instructions: http://forum.avast.com/index.php?topic=53253.0
Hi,
Also after running AdwC, run this one…
Please download zoek.exe and save it to your desktop.
[*] Close any open browsers.
[*] Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this or this Instruction.
[*] Double click on zoek.exe to run the tool .
Please wait while the tool does not start…
[*] Copy the text present inside the code box below and paste it into the large window in the zoek tool:
startupall;
filesrcm;
installedprogs;
firefoxlook;
Chromelook;
skipfix-iedefaults;
shortcutfix;
[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button
Please wait until a logreport will open (this can be after reboot)
[*] Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”
Thanks for the two responses, which are much appreciated.
Well I have run AdW and that seems to have cleared Hola from my system, although I seem to have lost all my Google settings. I did notice however that it was still listed as a toolbar option within my browser setting, but I have now deleted it.
I have also run Zoek and that has produced a report but doesn’t seem to do anything else.
Is there anything else that I should do?
Yes, post the log, as asked by magna86.
Sorry for the delay. Started a boot scan and it has only just finished. It found two other infected files, different ones, while it was doing that.
Hopefully I have now attached the log.
Hi Rolf,
Looks like traces from the Conduit toolbar, → http://systemexplorer.net/file-database/file/tbtog2-dll
polonus
Hi,
Attach hjere C:[b]AdwCleaner[S1].txt[/b] for review.
Re-run zoek.exe as you did before but use this script:
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tbTog2.dll;f
C:\WINDOWS\System32\roboot.exe;f
C:\Program Files\Lavasoft;vs
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{374D4993-6C18-4FE6-AA16-E52A7F16E735}];r
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{ADCC5BDC-6BC6-4CC8-9C44-D604C2EF9317}];r
emptyalltemp;
autoclean;
Click on RunScript button. Attach here fresh zoek log.
Additional scan:
Download ComboFix from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
note: ComboFix must be downloaded to your Desktop.
Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this or this Instruction.
How to disable avast:
[*]Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
[*]In the window that opens on the top right corner, click Settings.
[*]In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.
[*]Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
[*]In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.
Note: Do not forget to turn on this option after the cleaning.
Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix’s window while it is running.
If you see a message like “Illegal operation attempted on a registry key that has been marked for deletion” just restart computer once more.
When the tool is finished, it will produce a log report for you. (typical location: C:[b]ComboFix.txt[/b] )
Attach log reports ( ComboFix.txt) back to topic.
Good morning. I have attached the Adw log as requested. I have re-run the zoek program and the new log is also attached.
Have now also run ComboFix and have attached the log report as requested.
Yet another pseudo search engine, shouldn’t be to difficult to remove, see this: http://deletemalware.blogspot.com/2013/04/remove-hola-search-removal-instructions.html
It seems like another Delta Search re-brand to me. Nothing to worry about. On the other hand it might be challenging for less computer savvy users to remove it completely. Too many of this **** lately. I’m just wandering, do they really think they can outrank Google by bundling this search engine with freeware? I still don’t understand what they are trying to achieve.
@Rolf
How’s your computer runnign now?
Re-run zoek.exe for re-check as you did before but use this script.
firefoxlook;
chromelook;
shortcutfix;
Click on RunScan button and attach here fresh zoek log.
Good morning. Thanks everyone for your support.
I have re-run Zoek and the log file is attached. I have also checked the settings within Chrome, Firefox and IE and can no longer find any reference to Hola search.
Fingers crossed, the PC seems to be working OK at the moment. Just for information the Hola Search appears to have downloaded with Digiarty WinX DVD player, which was downloaded by my daughter.
Thank you for info. 
It is necessary to uninstall ComboFix :
[*] Click Start (or
http://amf.mycity.rs/pg/images/VistaStartButton.png
) then Run.
On Windows7 or Vista you may use Start Search field if Run is not available.
[*] In the line of text type in (Copy) the following:
ComboFix /Uninstall
Note that there is a space between " ComboFix " and " /Uninstall " .
[*] then click OK (or press Enter ).
Wait for the uninstall process is complete.
Download “Delfix by Xplode”
Run the tool … Check the boxes …
[] Remove disinfection tools
[] Purge System Restore
[*] Reset system settings
Click on “Run” button.
I recommended to keep Malwarebytes AntiMalware and to use MCShield if you will.
You may download MCShield from one of the following links:
MyCity - Official download link
Softpedija - Mirror download link
It will prevent infection by computer via USB flash drive, mobile phone or any other memory card.
And not only will prevent infection, but it will immediately clean flash drive, memory card or external HDD.
Uninstalled ComboFix but it came up with an message saying that Avast was still running and continuing would be at my own risk? I think Avast should probably have been closed first? There was no option to cancel the uninstall so I had to continue. After the uninstall I had to restart Avast from Start, Programs because it didn’t start itself.
Going to move onto the next steps now.
DelFix completed.
MC Shield installed
Malwarebytes updated and run - nothing detected
Thank you
CF should be uninstalled regardless the avast warning.
Run DelFix and reboot system. Turn on avast again. All is well?
CF was uninstalled because I couldn’t stop it.
I had run DelFix and restarted and so far all is well.
Thank you very much for your help.