How can I remove this virus ?? - GoFuckYourself.com

bllott · 04-15-2004, 06:49 PM

I have adaware running and i got some virus thing which would attempt to contaminate my computer every startup. Someone else went to use my computer and accepted the changes and now I have some messed up homepage + messed up fovorites and a whole bunch of sex sites.

This are the messages from what the changes did:

Quote:

Ad-watch Logfile, exported on 4/15/2004
Total number of events:7
hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahaha=
4/15/2004 6:04:54 PM - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Internet Explorer\Main
Value:Search Bar
Data:
New Data:http://mypoiskovik.com/sp.htm

Possible browser hijack attempt (Accepted)

hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahaha=
4/15/2004 6:04:55 PM - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Internet Explorer\Main
Value:Start Page
Data:http://www.clickbank.com/
New Data:http://mypoiskovik.com/index.htm

Possible browser hijack attempt (Accepted)

hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahaha=
4/15/2004 6:04:56 PM - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Internet Explorer\Main
Value:Start Page
Data:
New Data:http://mypoiskovik.com/index.htm

Possible browser hijack attempt (Accepted)

hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahaha=
4/15/2004 6:05:03 PM - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Internet Explorer\Main
Value:Search Page
Data:http://www.microsoft.com/isapi/redir...ie&ar=iesearch
New Data:http://mypoiskovik.com/index.htm

Possible browser hijack attempt (Accepted)

hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahaha=
4/15/2004 6:05:07 PM - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Internet Explorer\Main
Value:Search Page
Data:
New Data:http://mypoiskovik.com/index.htm

Possible browser hijack attempt (Accepted)

hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahaha=
4/15/2004 6:05:08 PM - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Internet Explorer\SearchUrl
Value:
Data:
New Data:http://mypoiskovik.com/index.htm

Possible browser hijack attempt (Accepted)

hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahaha=
4/15/2004 6:05:09 PM - Registry modification detected
Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Internet Explorer\Search
Value:SearchAssistant
Data:
New Data:http://mypoiskovik.com/sp.htm

Possible browser hijack attempt (Accepted)

hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahahahahahahahahahaha hahahahahahahahahahahahahahahahaha=

How can I remove this?

bllott · 04-15-2004, 06:50 PM

why the hell did all those HAHAHAAHHAs come uP?

StuartD · 04-15-2004, 06:50 PM

all those 'hahaha's look serious.

Format C now!

bllott · 04-15-2004, 06:56 PM

Quote:

Originally posted by MaskedMan
all those 'hahaha's look serious.

Format C now!

that's all i need.. some more good humor..

this fucken virus is killing me.how the hell do I remove it?

i tried a bunch of sites and antivirus shit and spyware shit nothing is working

StuartD · 04-15-2004, 06:58 PM

Seriously, I don't know. It looks like the coolsearch virus that's going around and there seems to be a million and one variations.

I don't know anyone that's successfully removed it, much less how they did it.

Sorry to hear you got stuck with it though.

Paparazzi · 04-15-2004, 06:58 PM

try these:
http://www.kephyr.com/misc/promo/scc...urce=bassindex
http://www.kephyr.com/spywarescanner...rce=bottomlink

Gemini · 04-15-2004, 07:43 PM

Try this

http://www.securityworm.com/software...oolsearch.html

and then check - clean your hosts file.

webmaster x · 04-15-2004, 08:55 PM

Ooops! Sorry I can't help yur there.

bllott · 04-17-2004, 02:06 PM

for anyone else, this virus is comes from some popups on porn sites, so that's how I got it

I wasted a day, to find the way, but this how to remove that piece of shit for anyone else:

download and run:

http://fileforum.betanews.com/detail.php3?fid=965718306

download update and run:

http://www.spywareinfo.com/downloads...CWShredder.exe

download and run:

http://www.spywareinfo.com/downloads...HijackThis.exe

and delete any of these once the scan with HijackThis is done:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mypoiskovik.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://mypoiskovik.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mypoiskovik.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?hklm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://hispeed.rogers.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://mypoiskovik.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,hahahahahaha Title = Microsoft Internet Explorer provided by Rogers Hi-Speed Internet
R3 - URLSearchHook: (no name) - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - (no file)
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O14 - IERESET.INF: START_PAGE_URL=http://hispeed.rogers.com

now you can surt porn again all you want !!!

04-15-2004, 06:50 PM	#3
StuartD Sofa King Band Join Date: Jul 2002 Location: Outside the box Posts: 29,903	all those 'hahaha's look serious. Format C now! __________________ This is me on facebook This is me on twitter

04-15-2004, 06:58 PM	#5
StuartD Sofa King Band Join Date: Jul 2002 Location: Outside the box Posts: 29,903	Seriously, I don't know. It looks like the coolsearch virus that's going around and there seems to be a million and one variations. I don't know anyone that's successfully removed it, much less how they did it. Sorry to hear you got stuck with it though. __________________ This is me on facebook This is me on twitter

04-15-2004, 06:58 PM	#6
Paparazzi Confirmed User Join Date: Mar 2002 Posts: 3,488	try these: http://www.kephyr.com/misc/promo/scc...urce=bassindex http://www.kephyr.com/spywarescanner...rce=bottomlink __________________ Pure Level(3) Premium Bandwidth When Quality Counts

04-15-2004, 07:43 PM	#7
Gemini Confirmed User Join Date: Jan 2001 Location: o-HI-o Posts: 7,183	Try this http://www.securityworm.com/software...oolsearch.html and then check - clean your hosts file. __________________ <center><a target="_blank" href="http://dev.datedollars.com/index.php?s=signup&aid=535&cfg=aac"><img border="0" src="http://216.130.172.224/gfy/gsig.gif" width="490" height="100"></a><br><a href="http://dev.datedollars.com/index.php?s=signup&aid=535&cfg=aac" target="_blank"><b><font face="Arial"><font color="#FF99FF"> Buy me away from Slavedriver Smokey!<br>It's May Sig Sweeps!<font></b></center>

04-15-2004, 08:55 PM	#8
webmaster x Confirmed User Join Date: Mar 2004 Posts: 4,400	Ooops! Sorry I can't help yur there. __________________ Click 9500 FHG Text Descriptions--Only $89!

04-15-2004, 06:50 PM	#2
bllott Confirmed User Join Date: Mar 2004 Location: Everywhere Posts: 2,368	why the hell did all those HAHAHAAHHAs come uP?

04-17-2004, 02:06 PM	#9
bllott Confirmed User Join Date: Mar 2004 Location: Everywhere Posts: 2,368	for anyone else, this virus is comes from some popups on porn sites, so that's how I got it I wasted a day, to find the way, but this how to remove that piece of shit for anyone else: download and run: http://fileforum.betanews.com/detail.php3?fid=965718306 download update and run: http://www.spywareinfo.com/downloads...CWShredder.exe download and run: http://www.spywareinfo.com/downloads...HijackThis.exe and delete any of these once the scan with HijackThis is done: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mypoiskovik.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://mypoiskovik.com/index.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mypoiskovik.com/index.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?hklm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://hispeed.rogers.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://mypoiskovik.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,hahahahahaha Title = Microsoft Internet Explorer provided by Rogers Hi-Speed Internet R3 - URLSearchHook: (no name) - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - (no file) O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O14 - IERESET.INF: START_PAGE_URL=http://hispeed.rogers.com now you can surt porn again all you want !!!