Browser Hijacked!! Please Help!!

[Addy]

Hi,

Just wondering if it's alright to keep both Avast and AVG on my machine. Is keeping the resident shield on for both bad?

[Spyros]

Hi,

Just wondering if it's alright to keep both Avast and AVG on my machine. Is keeping the resident shield on for both bad?

If you mean AVG antivirus --> NEVER use two antiviruses at the same time. They will conflict during an infection and leave your system unprotected (if not cause you blue screens and other system stability problems). You can use a second antivirus only if it doesn't have resident protection, for example the free version of BitDefender.

If you mean AVG antispyware (X-"ewido") --> Yes, you can keep it active.

[Addy]

Thanks Spyros,

Yes, I meant AVG Anti Spyware.

[demin2609]

it seems that this virus is getting diversified, a lot of my friends got it because of.. me...     

it usually starts with a message and a link an your computer and after clicking on it, the virus sends itself trugh ym, and modifies the registry...

"svchost12"

[Lisandro]

it seems that this virus is getting diversified

If a virus is replicant (coming and coming again), you should:

1) Disable System Restore on Windows XP: http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405
2) Clean your temporary files.
3) Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot.
4) Use a-squared, Free AVG Antispyware, SUPERantispyware or Spyware Terminator (trojan removers).

Hope this helps you get clean...

[demin2609]

1000 buc thu tinh hay nhat http://www.tuvantinhyeu. (info)  -this is the virus adress.. please do NoT open it!

i didn't know at the start what 2 do...  because the virus can overtake the antiv and the firewall...   was sending mass message with different web pages.. (with the virus), it changes status, if u hav "rem id & passw" it can log itself, dezactivates task manager and registry editor, IE is blocked on theyr page,


what did I do...

I've downloaded: Security Task Manager

down and run:  "Taskman.bat" , and "Reg.inf"     u can find it here...  www.extremeracingclub.ro/archive.zip

in Registry Editor (regedit),

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Inte rnet Explorer\Control Panel]
there is HOMEPAGE   with   D-Word  =1    this needs 2 be changed with 0 
and then go to Contol Panel > Internet Options  and change that page...

and in the end i hav scan the registries 2 be sure there is no other.. mices in my sistem...    it was a hard work 2 find this all out.. but.. it worth...

[Lisandro]

1000 buc thu tinh hay nhat http://www.tuvantinhyeu. (info)  -this is the virus adress.. please do NoT open it!

I've tried to scan it and I couldn't.
Anyway, never post a live link to a virus 
Please, edit it.

[oldman]

1000 buc thu tinh hay nhat http://www. tuvantinhyeu. (info)  -this is the virus adress.. please do NoT open it!

I've tried to scan it and I couldn't.
Anyway, never post a live link to a virus 
Please, edit it.

To make it in active,  stick a space in it.

[DavidR]

DrWeb confirms the site is infected.

Code: [Select]

http://www.tuvantinhyeu.info
There are a number of scripts there one of which tries to run an exe file.

[Lisandro]

I've tried to scan it and I couldn't.

Thanks David... my previous post was silly... of course the user edited the right (infected) address 

[demin2609]

ofcourse I've edited the adress...  there are a lot of smartass guys.. like me.. who click on the link even with the advertisment on it...    

[Lisandro]

ofcourse I've edited the adress...  there are a lot of smartass guys.. like me.. who click on the link even with the advertisment on it...    

Thanks anyway