Ugly Virus attacked, please help me!!

Gigacore · 02-09-2007, 05:13 PM

I dont know what kind of virus is this, whenever i open, orkut, youtube and some other sites like that i get MUHAHAHA

sounds funny... but its irritating me a lot... I CANT OPEN THOSE SITES

A long back i had a same kind of problem, but at that time i reinstalled OS, but now i dont wish to do it... please help..

ScreenShot

thanks in advance

zyberboy · 02-09-2007, 05:19 PM

I think this virus is everwhere

solution frm the virus writer,one of our forum member

http://www.thinkdigit.com/forum/show...9&postcount=15

Gigacore · 02-09-2007, 05:31 PM

^ Even that thread is not opening

utsav · 02-09-2007, 05:36 PM

^^hey that thread opened without any hassle

zyberboy · 02-09-2007, 05:38 PM

@Intel_Gigacore
use internet explorer or opera it will open.

Gigacore · 02-09-2007, 05:42 PM

I'm using Opera itself...... I tried it on safari, FF, and IE... none working

zyberboy · 02-09-2007, 05:46 PM

^^any message....
i think it may be due to some other problem or tyr this link
http://www.thinkdigit.com/forum/show...769#post547769

Harvik780 · 02-09-2007, 05:48 PM

Quote:

Originally Posted by fannedman

REALLY SORRY MAN, that was my handiwork

DONT DO ANYTHING CRAZY LIKE FORMATTING YOUR DRIVE

I blocked mozilla coz i couldnt read the edit fields in it through autohotkey, so forced the user to use ie or opera only.

If its not detected by the antivirus
Run the task manager,in processes tab you'll see two processes svchost.exe running under your user name, end them.
then go to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\policies\Explorer\Run
delete winlogon key

you better leave the status key, coz i made the virus first check this key, if present it'll not install

then go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
here set the checked value to 1

AND IF you are not administrator, the virus couldnt access the registry, so i created startup shortcuts in startmenu. you'll see an invisible icon in the startup menu of start menu, delete it

DO ALL THIS AFTER YOU END THE TWO PROCESSES otherwise they'll be RESTORED every 10 seconds

After all this go to folder options uncheck hide protected files
you'll see C:\heap41a folder, delete it and you'll see microsoftpowerpoint.exe in your pen drives along with autorun.inf , delete them

AND please tell me where you found this, bangalore right

sorry for what i have caused, had no idea

This will help

Gigacore · 02-09-2007, 06:10 PM

@ cyber boy, Same again, can u copy the text in that thread and make a notepad file and mail me?

@ Harvik780, thanks man... it worked

praka123 · 02-09-2007, 06:17 PM

seems this virus is spreading all over!making indiAns proud

Gigacore · 02-09-2007, 06:22 PM

^. ya..... lol

blackpearl · 02-09-2007, 06:54 PM

How do you people manage to get viruses? What site did you visit? What did you download? I'm just curious.

Gigacore · 02-09-2007, 07:03 PM

^ i think... that virus came some where from digit forum

... coz one of the member here is a virus writer....

blackpearl · 02-09-2007, 07:06 PM

A virus writer here? who?

Charan · 02-09-2007, 07:11 PM

@Gigacore: didnt you check my siggy?

zyberboy · 02-09-2007, 07:15 PM

^^lol

@blackpearl
this virus only propagate through usb drive and not many av detects it.

Gigacore · 02-09-2007, 07:34 PM

No charngk.....

@ cyberboy.... My avast didnt

koolbluez · 02-09-2007, 07:38 PM

did u clean it? gigiboy.. most of the av's wont detec it... it's local maan... but PCCillin japan site has somethin about it :O
The solution is as pointd out by Harvik... btw.. r u able to use Firefox? How r u readin this...

____________

oops. read the thread again.. seems u got rid of it

____________

btw.. the

reminded me of ~Lil JinX~