How to Remove Snap.Do Browser Hijacker

by News Editor on August 4th, 2014 in Security Tips.

Snap.Do developed by ReSoft LTD. is a tool that changes browser’s Home page and your default search engine to search.snapdo.com in IE, Mozilla and Chrome. Wikipedia mentions Snap.Do in its article about browser hijacking.
Please find below a few facts about Snap.Do we would like to pay your attention to.
In Terms & Conditions, ReSoft evades responsibility for the quality of content they provide:

“Resoft provides Users, inter alia, with a toolbar to be implemented in User's web browser. You also understand and agree that the Resoft Services may include advertisements and that these advertisements are necessary for Resoft to provide the Services.

You are entirely responsible for all content that you upload or otherwise make available via the Resoft Services. Resoft does not control the content posted via the Resoft Services. You understand that by using the Resoft Services, You may be exposed to content that is offensive, indecent or objectionable. Under no circumstances will Resoft be liable in any way for any content, including, but not limited to, any errors or omissions in any content, or any loss or damage of any kind incurred as a result of the use of any content posted, transmitted or otherwise made available via the Resoft Services.”.

In Privacy policy, ReSoft informs users about information that is being transferred to its servers if Snap.Do is installed on your PC:

“Statistical Information we collect and aggregate non-identifying information regarding users use of our Products, including, inter alia, advertisements viewed, pages browsed, search inquiries, offers and services that interest you, the type of browser you are using, your IP address, the URL you have come from and the time spent at that URL, cookies and your domain type and server.” .

It may change your default browser’s icon to this one -  , and even if you launch the browser from its original location, it is still affected by Snap.Do – picture below shows home page of your browser:


 
Your default search engine will also be changed to search.snapdo.com. Even though Snap.do is a “perfect tool to simplify the web”, when you type, for example, ‘amazon’, first search results provided by Snap.Do are always ads (marked as ‘Ads related to amazon’ – see picture below), unlike Google, for example, that shows you on a hunch amazon.com as a first result:






Popular shopping websites have ad-banners by Snap.Do, and you may not even notice that these ads are not related to the website you trust – a small note ‘By Smartbar’ is almost inconspicuous:


 

Instead of features’ description in Extensions tab of your browser (Mozilla or IE, for example; Chrome doesn’t allow this toolbar), Snap.Do gives short removal instructions, but this method doesn’t help to remove all the traces of Snap.Do.


 
Standard Windows directory ‘Program Files’(where new applications are usually installed) doesn’t have a folder called ‘Snap.Do’, but another one called ‘LTD’ that doesn’t seem to be related to Snap.Do at a glimpse (in fact, this it belongs to Snap.Do). Main executable file of Snap.Do is located in a hidden path (C:\Users\USER_NAME\AppData\Local), in a folder called ‘Smartbar’.

Processes and services related to Snap.Do automatically launch with every Windows start slowing down its booting time:

  

If you want to remove Snap.Do from your PC, please find below step-by-step instructions.

Note. This is a self-help guide. Use it at your own risk. This article is provided "as is" and to be used for information purposes.

1.    Before you start, please make sure you are logged as a system administrator. Also, please save a copy of your important documents/files on an external hard drive.

2.    Close all your browsers if any.

3.    Open your Task Manager (right click on your task bar and choose ‘Task Manager’ from the context menu):

•    In the ‘Processes’ tab, please find Lrcnta.exe and SnapDo.exe, right click on each one and choose ‘End Process’ from the context menu;
•    In the ‘Services’ tab, please find LPTSystemUpdater and stop it using right-click menu.
4.    From your desktop, click on Windows Start button and choose Control Panel option (Windows 8 users: right-click on ‘Windows Start’   icon (by default, it is located in the left bottom corner of your screen), and choose Control Panel from the context menu):

•    Click ‘Programs and Features’ (Windows Vista, 7 and 8)/‘Add or Remove Programs’ (Windows XP),
•    Find 2 entries: Snap.Do and Snap.Do Engine by ReSoft Ltd.,
•    Right click on ‘Snap.Do’ and click on ‘Uninstall’ button,
•    When a window below opens, click on a ‘CUSTOM’ button, and in the 2nd window check ‘Remove Snap.Do’ (making sure that 2 other boxes are UN-checked):



•    in the next window, click on ‘Accept’, and then – ‘Continue’ (as we’ve closed the browsers in step 2):


•     Wait a few moments for the program to finish uninstallation. Once done, please press F5 key on your keyboard (while being in ‘Programs and Features’ window making sure you don’t have Snap.Do and Snap.Do Engine here anymore.

5.    Please make sure that hidden files in your Windows Explorer are visible: Start –> Control Panel (Appearance and Personalization) –> Folder Options –> ‘View’ tab –> find ‘Hidden files and folders’ and check a box ‘Show hidden files, folders, and drives’.

6.    Follow this path - C:\Users\YOUR_USER_NAME\AppData\Local\Temp (XP users: C:\Documents and Settings\YOUR_USER_NAME\Local Settings\Temp) -> highlight all the files/folders here -> press ‘Shift’+’Delete’ and click ‘Yes’ to completely clean this folder (Note. If you receive messages that some files cannot be removed, just skip the file in question).

7.    Please find the directories below and make sure that Snap.Do folders are removed:
C:\Program Files (x86)\LPT
C:\Users\YOUR_USER_NAME\AppData\Local\Smartbar

8.    Now please make sure that your browser is clean:

Mozilla Firefox

•    Click on the Menu button   in the right upper corner of Firefox window (older versions of browser: click on the orange ‘Firefox’ logo in the upper left corner) -> find Add-ons section -> check ‘Extensions’ and ‘Plugins’ tabs, and if you find SnapDo extension here, please click on ‘Remove’ button.
•    Again click on the Menu button -> Options :
•    In the General tab ‘Home Page’ field, please highlight Snap.Do link -> right click on it and press ‘Delete’ -> type a web address of your preferred home page in ‘http://…’ format.
•    In the Security tab make sure that all the 3 options ‘Warn me when sites try to install add-ons’, ‘Block reported attack sites’ and ‘Block reported web forgeries’ are checked.
•    In the main Firefox window, click on a small triangle in the ‘Search Engines’ field (right upper corner) , and choose ‘Manage Search Engines…’ option. Highlight all the unwanted search engines including ‘Web Search’ and click on ‘Remove’ button.
•    Restart Firefox.

 Google Chrome


•    Type chrome://settings in the Chrome address bar and press ‘Enter’ to open Chrome Settings menu;
•    In the ‘On Startup’ section -> ‘Open a specific page or set of pages.’ Option -> click on the ‘Set pages’ link -> if you find ‘http://feed.sonic-search.com…’ here, hover your mouse to this line for a ‘Delete’ option to appear, and click ‘x’ to remove this page from startup;
•    In the ‘Appearance’ section, when the ‘Show Home button’ is checked, if you see ‘search.hometab.com’ link, please click on ‘Change’ and remove it from your browser;
•    In the ‘Search’ section, click on ‘Manage search engines…’ -> hover your mouse cursor to any search engine for the ‘Make default’ and ‘Delete’ menu to appear. You can delete all the unnecessary search engines here, and make default your desired one (note. While an engine is set to ‘Default’, you are unable to delete it. Therefore, firstly choose a new default search tool. Once done, you will be able to remove old default item.):






 
•    Click on ‘Show advanced settings…’ link in the bottom of the page -> in the ‘Privacy’ section please make sure that ‘Enable phishing and malware protection’ box is checked;
•    Restart Google Chrome;
•    If you see this icon   left from Snap.Do Search on your desktop, please delete it;
•    Finally, please follow this path: C:\Program Files (x86)\Google\Chrome\Application -> find chrome.exe icon -> drag it to your desktop using right-click of your mouse -> choose ‘Create shortcuts here’ from the context menu.

Internet Explorer

•    When IE window is opened, press Alt+x keys on your keyboard to open Tools menu -> Manage Add-ons -> ‘Search Providers’ section -> if you have ‘WebSearch’ here, highlight it and click on ‘Disable’ button;
•    Again open Tools menu -> Internet Options -> General Tab -> ‘Home page’ section: if you see ‘http://feed.sonic-search.com…’ link here, highlight and delete it using context right-click menu -> type a new web address you want to set up as your home page, and click ‘Apply’. You can also set other custom settings of your startup page display in the ‘Startup’ section (to start with your last session, for example):



•    In the Privacy tab, ‘Pop-up Blocker’ section you can restrict any pop-ups to appear by checking appropriate button (you can exclude websites you trust using a ‘Settings’ button)
•    Restart Internet Explorer.

9.   Now, please install Ad-Aware to make sure you don’t have any infections on your machine:

•    Click here to download Ad-Aware, and follow installation instructions from Ad-Aware User Guide (‘Installation and Uninstallation’ -> ‘Ad-Aware Install’ section).
•    Perform a full scan of your PC with Ad-Aware (following Ad-Aware User guide: ‘Scanning System’ -> ‘Running a scan’ section).
•    Restart your PC.

10.  If you continue facing issues with Snap.Do, please remove its traces from your registry. Before you start, please make sure you understand how important this part of your PC is. You cannot restore data from here once you delete something (‘Ctrl+Z’ never works in Registry Editor). And if you delete an incorrect component by mistake, it may damage your OS and make it unusable.

•    To open the Registry, press ‘Win+R’ keys on your keyboard -> in the opened window type regedit and press ‘Enter’.
•    Highlight main registry section called ‘Computer’ -> press Ctrl+F keys on your keyboard -> make sure Keys, Values, Data check-boxes in the ‘Find’ window are checked -> type snapdo in the search field and click OK. Search results will highlight a key/value/data that contains Snap.Do components. If you find the exact match with the name of program you want to remove, right click on the element in question and choose ‘Delete’ from the context menu.
•    Use F3 key to continue the search and to find all the necessary files.
•    Exit the registry editor.
•    Reboot your PC.

Lastly, it is recommended to always keep your antivirus program up-to-date with a real-time protection turned on, and perform weekly full scans to stay protected at all times.