GoFuckYourself.com - Adult Webmaster Forum - View Single Post

bllott · 04-17-2004, 02:06 PM

for anyone else, this virus is comes from some popups on porn sites, so that's how I got it

I wasted a day, to find the way, but this how to remove that piece of shit for anyone else:

download and run:

http://fileforum.betanews.com/detail.php3?fid=965718306

download update and run:

http://www.spywareinfo.com/downloads...CWShredder.exe

download and run:

http://www.spywareinfo.com/downloads...HijackThis.exe

and delete any of these once the scan with HijackThis is done:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mypoiskovik.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://mypoiskovik.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mypoiskovik.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?hklm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://hispeed.rogers.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://mypoiskovik.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,hahahahahaha Title = Microsoft Internet Explorer provided by Rogers Hi-Speed Internet
R3 - URLSearchHook: (no name) - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - (no file)
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O14 - IERESET.INF: START_PAGE_URL=http://hispeed.rogers.com

now you can surt porn again all you want !!!

04-17-2004, 02:06 PM
bllott Confirmed User Join Date: Mar 2004 Location: Everywhere Posts: 2,368	for anyone else, this virus is comes from some popups on porn sites, so that's how I got it I wasted a day, to find the way, but this how to remove that piece of shit for anyone else: download and run: http://fileforum.betanews.com/detail.php3?fid=965718306 download update and run: http://www.spywareinfo.com/downloads...CWShredder.exe download and run: http://www.spywareinfo.com/downloads...HijackThis.exe and delete any of these once the scan with HijackThis is done: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mypoiskovik.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://mypoiskovik.com/index.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mypoiskovik.com/index.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?hklm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://hispeed.rogers.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://mypoiskovik.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,hahahahahaha Title = Microsoft Internet Explorer provided by Rogers Hi-Speed Internet R3 - URLSearchHook: (no name) - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - (no file) O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O14 - IERESET.INF: START_PAGE_URL=http://hispeed.rogers.com now you can surt porn again all you want !!!