Related:
- My laptop have I-Worm/Generic.CLJ
- How to type # in laptop - Guide
- Gta 5 download apk laptop - Download - Action and adventure
- Why can't i type on my laptop - Guide
- Minecraft free download laptop - Download - Sandbox
- Wattpad download for laptop - Download - Books and comics
5 responses
Tried to download the Microsoft tool for removal and run the tool..but it didn't detect anything..while my avg keeps popping threat alerts..of Generic_c.YH, Generic_c.YL, Downadup....
Can somebody please advise what to do???
Can somebody please advise what to do???
julioz
Posts
21
Registration date
Sunday December 28, 2008
Status
Member
Last seen
May 10, 2009
1
Feb 8, 2009 at 01:11 AM
Feb 8, 2009 at 01:11 AM
Hello,
You can try to following. First of all download the MSN Fix file (don't worry I know what I am telling you) from the link http://sosvirus.changelog.fr/MSNFix.zip
Once done, unzip the file and open the MSNFix.bat file. To be able to run it, choose the R key once open. During the scan, if an infection has been detected, use the N key.
And now, I will advise you to get a better antivirus than AVG. Try Bitdefender, it is more suited for these kind of infections.
You can try to following. First of all download the MSN Fix file (don't worry I know what I am telling you) from the link http://sosvirus.changelog.fr/MSNFix.zip
Once done, unzip the file and open the MSNFix.bat file. To be able to run it, choose the R key once open. During the scan, if an infection has been detected, use the N key.
And now, I will advise you to get a better antivirus than AVG. Try Bitdefender, it is more suited for these kind of infections.
i have scan but there is nothing found..so wat should i do...?
i forget to tell u tat the worm is normally in temporarily file...but if i delete ady..it come bk again...
and there is another virus which is comment.htt...i can't remove it oso..
i forget to tell u tat the worm is normally in temporarily file...but if i delete ady..it come bk again...
and there is another virus which is comment.htt...i can't remove it oso..
Keifermail
Posts
28
Registration date
Saturday February 7, 2009
Status
Member
Last seen
February 15, 2009
5
Feb 8, 2009 at 06:29 PM
Feb 8, 2009 at 06:29 PM
I am writing to express gratitude for Morphine on this forum for solving my problem. This invasive "virus/malware/painintheass" seems to be diffrent on every machine and it may take several tries to find the solution as I discovered. I also would like to try and figure out where the "bug" came from. I have related below two possible causes. Please others post their stories and let's see if we can come up with the vector.
I acquired this "virus/malware/headache" on 1/27/2009. My last download from Microsoft was a routine updating of Office 2007. I know this because when I tried to use system restore my last save point was the day before I updated Office. I do not believe that Office is the culprit but I would like to know what the last thing others downloaded before they acguired "the bug." A more likely cause would be my habit of occassionally watching videos on Pornhub. This may be TMI, but hey, if we are to figure out where this thing came from I will be the first to admit to frequenting Pornhub as a possibility. If others suspect the same please post your thoughts.
Now about this bug....
This thing is incredible!
It hijacks every browser on your computer- Explorer, Firefox, Chrome and Safari. When you attempt to Update Windows it sends you to a very good "fake Google page." Every click or search in the fake google page seems to add more malware and directs one to porn sites. i.e. Gay Porn (not that there is anything wrong with that) Just happens that I am straight. I also believe that this is the reason it is worse on some machines than others. I recognized the Google page as fake because I use iGoogle as my home page and there was no button for iGoogle. When I attempted to search is when it became very apparent. It sent you straight to the page it wanted to. It seems that the more you use this fake page the worst the infection becomes.
It doesn't stop at hijacking the browser, it also prevents your Antivirus from updating. I had Trend Micro orginally and went out and bought Kaspersky after being told that it was the best by the IT guys at work This thing shut down Kaspersky's like it owned it. (I had a Disk version of Kaspersky manufactured in Oct 2008. I do believe that had I had Kaspersky before and it was updated, instead of Trend Micro, I would have never caught the bug.) I found this forum yesterday morning Googling "virus hijacks browser and disables updates."
As Morphine sugested: I downloaded the free Trojan Remover 6.7.5. (It is free for 1st 30 days) Find it here:
https://www.simplysup.com/tremover/download.html
Then I ran it. It found the offending file and it stated that it needed to be deleted- which I did by clickin OK or something. I thought I had solved the problem and did nothing else other than attempt to update Kaspersky and Windows. Both failed before completing.
Whoever wrote this "bug" is a genuis, and a sadistic bastard! It is like the last boss fight in good Videogame, you can't kill it with just one weapon. It apprently hides in your RAM and attaches itself back into the registry. That is why you have to have SmitFraudFixTool. Find it here:
http://smitfraudfixtool.com/
This program will cost you unfortnately. I already had RegCure but it did not work- its not made to chase bugs. I paid $39.00 for it and can run it on three computers. Anyway, after running the Trojan Remover again and immediately afterwards running SmitFraudFixTool and cleaning out 3156 so called "bad files." I then updated Kaspersky and ran a system scan which finally put the noose on the damn thing for good. This forum was a godsend!
My computer is now running like a dream! Thank you Morphine for the solution. Please others post their battles with this Monster.
I acquired this "virus/malware/headache" on 1/27/2009. My last download from Microsoft was a routine updating of Office 2007. I know this because when I tried to use system restore my last save point was the day before I updated Office. I do not believe that Office is the culprit but I would like to know what the last thing others downloaded before they acguired "the bug." A more likely cause would be my habit of occassionally watching videos on Pornhub. This may be TMI, but hey, if we are to figure out where this thing came from I will be the first to admit to frequenting Pornhub as a possibility. If others suspect the same please post your thoughts.
Now about this bug....
This thing is incredible!
It hijacks every browser on your computer- Explorer, Firefox, Chrome and Safari. When you attempt to Update Windows it sends you to a very good "fake Google page." Every click or search in the fake google page seems to add more malware and directs one to porn sites. i.e. Gay Porn (not that there is anything wrong with that) Just happens that I am straight. I also believe that this is the reason it is worse on some machines than others. I recognized the Google page as fake because I use iGoogle as my home page and there was no button for iGoogle. When I attempted to search is when it became very apparent. It sent you straight to the page it wanted to. It seems that the more you use this fake page the worst the infection becomes.
It doesn't stop at hijacking the browser, it also prevents your Antivirus from updating. I had Trend Micro orginally and went out and bought Kaspersky after being told that it was the best by the IT guys at work This thing shut down Kaspersky's like it owned it. (I had a Disk version of Kaspersky manufactured in Oct 2008. I do believe that had I had Kaspersky before and it was updated, instead of Trend Micro, I would have never caught the bug.) I found this forum yesterday morning Googling "virus hijacks browser and disables updates."
As Morphine sugested: I downloaded the free Trojan Remover 6.7.5. (It is free for 1st 30 days) Find it here:
https://www.simplysup.com/tremover/download.html
Then I ran it. It found the offending file and it stated that it needed to be deleted- which I did by clickin OK or something. I thought I had solved the problem and did nothing else other than attempt to update Kaspersky and Windows. Both failed before completing.
Whoever wrote this "bug" is a genuis, and a sadistic bastard! It is like the last boss fight in good Videogame, you can't kill it with just one weapon. It apprently hides in your RAM and attaches itself back into the registry. That is why you have to have SmitFraudFixTool. Find it here:
http://smitfraudfixtool.com/
This program will cost you unfortnately. I already had RegCure but it did not work- its not made to chase bugs. I paid $39.00 for it and can run it on three computers. Anyway, after running the Trojan Remover again and immediately afterwards running SmitFraudFixTool and cleaning out 3156 so called "bad files." I then updated Kaspersky and ran a system scan which finally put the noose on the damn thing for good. This forum was a godsend!
My computer is now running like a dream! Thank you Morphine for the solution. Please others post their battles with this Monster.
Didn't find the answer you are looking for?
Ask a question
Keifermail
Posts
28
Registration date
Saturday February 7, 2009
Status
Member
Last seen
February 15, 2009
5
Feb 15, 2009 at 01:39 AM
Feb 15, 2009 at 01:39 AM
This thing is called the "Kido Worm" , "Downadup" and "Conficker." It began in Oct. 2008 but in December it evolved into a Superworm. Its ability to thwart any attempt to delete it and to spread via USB devices is confounding.
There is a lot of info out there if you Google these names. It is an interesting Worm as it seems to disable every defense before the victim can even launch a counter attack. It disables system restore, shuts off Microsoft updates, blocks Antivirus updates, hijacks the browser (Safari, Explorer, Chrome and Firefox) and finally it downloads more malicious software as it goes. It is impossible to give one set of instructions to remove the Virus as it is different on every machine.
The latest variant of the worm now lets it spread via thumb drives. It operates by copying itself in a random folder created inside the Recycler directory, which is used by the Recycle Bin to store deleted files, and creating an autorun.inf file in the root folder. The worm executes automatically if the Autorun feature is enabled.
Certain TCP functions are also patched to block access to security-related Web sites by filtering every address that contains certain strings. This makes it harder to remove because information about it is difficult to gather from an infected computer. Additionally, the sneaky little worm removes all access rights of the user, except execute and directory usage, to protect its file. Microsoft has created a removal tool for this worm, but if you are infected you must find an uninfected computer to download Microsoft's Malicious Software Removal Tool.
See the following link: http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx
If you have the Kido/Conficker worm you will no be able to link to the above link.
Microsoft states,
"If your computer is infected with the Conficker worm, you might be unable to download certain security products, such as the Microsoft Malicious Software Removal Tool or to access certain Web sites, such as Microsoft Update. If you can't access those tools, try using the Windows Live OneCare Safety Scanner. If that doesn't work, read the following Microsoft Help and Support articles on an uninfected computer. "
My advise is to get the removal tool on a brand new/clean USB device from another computer and then load it onto your computer. The surprising thing is that this thing started in Oct. and already has infected 12.9 million computers. Microsoft has offered a 250K reward to help catch the culprits that created this worm.
Hope this helps,
Keifer
There is a lot of info out there if you Google these names. It is an interesting Worm as it seems to disable every defense before the victim can even launch a counter attack. It disables system restore, shuts off Microsoft updates, blocks Antivirus updates, hijacks the browser (Safari, Explorer, Chrome and Firefox) and finally it downloads more malicious software as it goes. It is impossible to give one set of instructions to remove the Virus as it is different on every machine.
The latest variant of the worm now lets it spread via thumb drives. It operates by copying itself in a random folder created inside the Recycler directory, which is used by the Recycle Bin to store deleted files, and creating an autorun.inf file in the root folder. The worm executes automatically if the Autorun feature is enabled.
Certain TCP functions are also patched to block access to security-related Web sites by filtering every address that contains certain strings. This makes it harder to remove because information about it is difficult to gather from an infected computer. Additionally, the sneaky little worm removes all access rights of the user, except execute and directory usage, to protect its file. Microsoft has created a removal tool for this worm, but if you are infected you must find an uninfected computer to download Microsoft's Malicious Software Removal Tool.
See the following link: http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx
If you have the Kido/Conficker worm you will no be able to link to the above link.
Microsoft states,
"If your computer is infected with the Conficker worm, you might be unable to download certain security products, such as the Microsoft Malicious Software Removal Tool or to access certain Web sites, such as Microsoft Update. If you can't access those tools, try using the Windows Live OneCare Safety Scanner. If that doesn't work, read the following Microsoft Help and Support articles on an uninfected computer. "
My advise is to get the removal tool on a brand new/clean USB device from another computer and then load it onto your computer. The surprising thing is that this thing started in Oct. and already has infected 12.9 million computers. Microsoft has offered a 250K reward to help catch the culprits that created this worm.
Hope this helps,
Keifer
Mar 12, 2009 at 04:39 AM
Is this the same virus as CLJ? I know for a fact that i spread through an external drive since I never had a problem until the very moment when I plugged it in. AVG-free removed the threat but every time windows starts up I get a message saying that \appdata\roaming\cyfyych.dll is missing?
How do I deal with this problem? The virus har been moved to the vault to prevent further damage. Does that mean it hasn't been completely removed and still causes damage?
Mar 12, 2009 at 04:57 AM