problem wid firefox n orkut

[mind021]

heloo frnds..
i face a small problem..
actually whenever i try 2 open firefox 4 browsing it doesnt open..
i get a msg "I DO NOT HATE MOZILLA..BUT USE IE"
even when i try 2 open orkut in IE..it says
"U FOOL..ORKUT IS BLOCKED"
den another msg comes "DIS PROGRAM IS NOT WRITTEN BY ADMIN..GUESS WHO HAS DONE IT"

plz do help me finding me a soln

hey..isnt any1 here able 2 solve my problem??

[Vishal Gupta]

ur system is infected by virus/spyware. Download HijackThis from http://www.hijackthis.de/ and scan ur computer with it. Then post the contents of log file here.

[spironox]

virus problem/ some script running by some program or say some files

[mind021]

Originally Posted by Vishal Gupta

ur system is infected by virus/spyware. Download HijackThis from http://www.hijackthis.de/ and scan ur computer with it. Then post the contents of log file here.

hey i hv already found d way 2 rectify it...
u just tell me d way how 2 block a process(from ctrl+alt+del) using registry editing or by any other way
i already tried using msconfig in "run" but is nt coming dere

Originally Posted by spironox

virus problem/ some script running by some program or say some files

yaa..whenever i start d comp i find a process named as svchost.exe wid username as dat of which i login in windows is dere..
if i end dis process den orkut n firefox both function properly

[shivendrashukla]

The virus must have blocked this also. Try it in safe mode.

[mind021]

Originally Posted by shivendrashukla

The virus must have blocked this also. Try it in safe mode.

well i think its a bug..n it not blocked anything else..other dan firefox n orkut..dose also work if i end d process name svchost.exe wid username as dat of login name
i dont know how 2 block d process without use of msconfig...4om where i m nt able 2
also i dont know how 2 do registry editing

[Garbage]

Originally Posted by mind021

i dont know how 2 block d process without use of msconfig...4om where i m nt able 2
also i dont know how 2 do registry editing

For editing services without using msconfig -

Go to Control Panel --> Administrative Tools --> Services

[ax3]

last option ........ da a CLEAN FORMAT of C drive ............

will definately solve ur problem ........ & henceforth bware of files u download from unknown sites or users .........

[vrnoormd]

Please Show the Thread and solve your Problem

help me.. virus... not able to open mozilla

[zyberboy]

one of my friend got infected with the same virus...i suspect the source of this virus is from india,this virus can only transfers through usb storage.Its runs two scripts in memory both named as svhost.exe.The interesting part is some months ago not even a single antivrus was able to detect it . Yeah this virus is so simple but vry effective...and it also plays a sound file to make u scare
Hope by this time u may have rectified it, hav u? so i am not posting the method

[spironox]

dear do one thing if u dont get the start up working well then use the msconfig

start->run->msconfig .... services (tick the hide microsft services) and see if there is any alien stuff there .. other wise just head to start up and disable all unknown programs ...

press apply

it will ask for restart --well do it

and see if the problem is still there or not (trial and error basis works well with Msconfig well so its time to tweak)

[mind021]

Originally Posted by ax3

last option ........ da a CLEAN FORMAT of C drive ............

will definately solve ur problem ........ & henceforth bware of files u download from unknown sites or users .........

well...it didnt solve d problem

[zyberboy]

^^hav u soved the problem??

[Charan]

http://us.mcafee.com/virusInfo/defau...virus_k=142280

http://www.sophos.com/virusinfo/anal...2ahkheapa.html

REALLY SORRY MAN, that was my handiwork
DONT DO ANYTHING CRAZY LIKE FORMATTING YOUR DRIVE

I blocked mozilla coz i couldnt read the edit fields in it through autohotkey, so forced the user to use ie or opera only.

If its not detected by the antivirus
Run the task manager,in processes tab you'll see two processes svchost.exe running under your user name, end them.
then go to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\policies\Explorer\Run
delete winlogon key

you better leave the status key, coz i made the virus first check this key, if present it'll not install

then go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
here set the checked value to 1

AND IF you are not administrator, the virus couldnt access the registry, so i created startup shortcuts in startmenu. you'll see an invisible icon in the startup menu of start menu, delete it

DO ALL THIS AFTER YOU END THE TWO PROCESSES otherwise they'll be RESTORED every 10 seconds

After all this go to folder options uncheck hide protected files
you'll see C:\heap41a folder, delete it and you'll see microsoftpowerpoint.exe in your pen drives along with autorun.inf , delete them

AND please tell me where you found this, bangalore right
sorry for what i have caused, had no idea

[zyberboy]

^^^^^^^
OMG!!!! you r the creator of that virus!!, hey one of my friend got infected in june here in kerala,he called me and finally i was able to delete the virus, it is now everywhere here ,ur virus is now competing with other virus like boot.exe in cyber cafes here....lolz,i dont believe this man r u the real guy?? where did u got tat laughing mp3. My friends little brother got frightened hearing that.
Do u know that virus is spreading into other countries becoz no Antivirus was able to detect that virus wen it was first found,His computer was running avast which failed to detect it then i terminated svhost.exe to get rid of it,then i copied the files and scanned with every AV's like kasperksy,Avira but none was able to detect it(i know this is due to "autohotkey" which is a known script maker).
Its signatures is now being added in Av's (including kaspersky,nod32,avast etc).I read its source code its install script is long,what made u to write this virus just to ban orkut and YT??.How much time spend on this??,i guess u started its work in february isn't?.
Furstration for people,but i have to say amazing work,particularly how that "reproduce+offspring script works"

[mind021]

hey man its really a gr8 piece of work
as others hv specified it is not detected by any antivirus..
by d way i got d temporary soln d first day itself...n i m weak in registry editing so cant get d permanent soln..

but thnx 4 telling me it..

n yaa 1 more thing..in my comp i was not able 2 open any browser other dan IE..
how come u opened opera
n yaa..also svchost.exe didnt regenerate itself unltill i restarted d comp...so each i started d comp i had 2 end d process...n yaa..no unknown service i found in msconfig

n yaa..i wld surely try out d registry editing way 2day...hope u r correct

[shri]

Originally Posted by fannedman

REALLY SORRY MAN, that was my handiwork

If you are really the creater of this orkut virus then I guess you would know this by now-You have caused a hell of a lot of problems to a heck of a lot of people.
You should have posted the solution to this a lot earlier.

Originally Posted by cyberboy_kerala

^^^^^^^
OMG!!!! you r the creator of that virus!!, hey one of my friend got infected in june here in kerala,he called me and finally i was able to delete the virus, it is now everywhere here ,ur virus is now competing with other virus like boot.exe in cyber cafes here....lolz,i dont believe this man r u the real guy?? where did u got tat laughing mp3. My friends little brother got frightened hearing that.
Do u know that virus is spreading into other countries becoz no Antivirus was able to detect that virus wen it was first found,His computer was running avast which failed to detect it then i terminated svhost.exe to get rid of it,then i copied the files and scanned with every AV's like kasperksy,Avira but none was able to detect it(i know this is due to "autohotkey" which is a known script maker).
Its signatures is now being added in Av's (including kaspersky,nod32,avast etc).I read its source code its install script is long,what made u to write this virus just to ban orkut and YT??.How much time spend on this??,i guess u started its work in february isn't?.
Furstration for people,but i have to say amazing work,particularly how that "reproduce+offspring script works"

WTH! kerala!!! man its spreading because many antiviruses didnt have its signature.

one more caveat , its a simple winrar sfx archive, i used resource hacker to extract the folder and invisible icon from shell32.dll

And the laughter sound is from mortal kombat 4 setup

and comon dude it cannot be spreading to other countries, unless you take there an infected pen drive from here

There was some misunderstanding between me and our college admin about the usage of orkut,its a long story, so in retribution i created this mess, i just didnt know it will blow up like this!!

[zyberboy]

Originally Posted by fannedman

and comon dude it cannot be spreading to other countries, unless you take there an infected pen drive from here

Somewhere i read tat it is being shared in P2P,i think i read this in some blog or something.

Autohotkey guys r angry with you..lol, their reputation is taken a hit becoz ter r some virus in wild written with it, Now Anti virus are detecting useful autohotkey script as virus. what do u think?.

Originally Posted by cyberboy_kerala

Somewhere i read tat it is being shared in P2P,i think i read this in some blog or something.

Autohotkey guys r angry with you..lol, their reputation is taken a hit becoz ter r some virus in wild written with it, Now Anti virus are detecting useful autohotkey script as virus. what do u think?.

Yeah i know, i feel sorry for that. But i think the exe is excluded from detection, only install.txt and autorun.inf are detected

[hard_rock]

Well...Boy..You have invaded the whole hostel's computers here in shimoga.. Those dumb guys dont know how to operate USB.. Spreaded like hell. Usually I scan all files which are foreign to my PC. But someday during project work, it was urgent so dint scanned and after sometime when I opened Opera..Bang!!! Orkut banned.. I told so many many bad words to the creator that day.. And it was you?? (Who knows..) But all that CURSE goes to you...

[a_k_s_h_a_y]

i think that guy is frm my college....PESIT....that viurs is all over our college comps....Orkut is banned in our college.......and i also remember that all hoste PCs being infected and the creator of it helping them in hostel to sort the mess

[navjotjsingh]

BTW can somebody mail me the virus? I would really love to try on my sister who is constantly hooked to orkut!

[aryayush]

Why are you guys applauding and encouraging the virus creator! This is insane.

[kumarmohit]

Why are you bothered, isnt the Mac Virus Free!

[aryayush]

Yes, it is but where does that figure into this conversation!

[spironox]

if he says that he is the creator then.... buddy go underground and erase yourself from net god knows some freaks might file a cyber case and u might be enjoying some days.years.or centuries behind the jail (get off asap) for the problem caused by your research (so called)

just try to understand what u did was a mistake and dont aks for forgivenss as people will not listen all they need is some one to blame and that is u ! idiotically u confessed in too .. now what will happen is just a wait and watch act !


let me ref the indian cyber laws and let u know (but i am not sure about the diff public ,gov,institutional rules/law/policies)

[Charan]

^^ What if he appologises and give a removal tool for that virus?

[spironox]

very few chances i think .. only if he doesnt sells them and give them out as a preventive tool rather than removal tool

base line is he should give the removal tool in form of a preventive tool and that too free of cost and also accept no responsibility for the function-ability of the tool

thus he can save his skin in that process otherwise some weirdo will cash on him i am sure about that