DIGIT-ARC read-only archive · snapshot: July 23, 2026

Ugly Virus attacked, please help me!!

20 posts · originally from https://geek.digit.in/community/threads/ugly-virus-attacked-please-help-me.67135/

Gigacore
Gigacore Original post #1
Sep 2, 2007 at 5:13 PM
I dont know what kind of virus is this, whenever i open, orkut, youtube and some other sites like that i get MUHAHAHA :D sounds funny... but its irritating me a lot... I CANT OPEN THOSE SITES

A long back i had a same kind of problem, but at that time i reinstalled OS, but now i dont wish to do it... please help..

ScreenShot

*farm2.static.flickr.com/1181/1302016347_ed7dbb7516_o.jpg

thanks in advance
zyberboy
Sep 2, 2007 at 5:19 PM
I think this virus is everwhere

solution frm the virus writer,one of our forum member:)
*www.thinkdigit.com/forum/showpost.php?p=547769&postcount=15
Gigacore
Sep 2, 2007 at 5:31 PM
^ Even that thread is not opening :eek:
utsav
utsav #4
Sep 2, 2007 at 5:36 PM
^^hey that thread opened without any hassle
zyberboy
Sep 2, 2007 at 5:38 PM
@Intel_Gigacore
use internet explorer or opera it will open.
Gigacore
Sep 2, 2007 at 5:42 PM
I'm using Opera itself...... I tried it on safari, FF, and IE... none working :(
zyberboy
Sep 2, 2007 at 5:46 PM
^^any message....
i think it may be due to some other problem or tyr this link
*www.thinkdigit.com/forum/showthread.php?p=547769#post547769
H
Sep 2, 2007 at 5:48 PM
fannedman said:
REALLY SORRY MAN, that was my handiwork :D :D
DONT DO ANYTHING CRAZY LIKE FORMATTING YOUR DRIVE

I blocked mozilla coz i couldnt read the edit fields in it through autohotkey, so forced the user to use ie or opera only.

If its not detected by the antivirus
Run the task manager,in processes tab you'll see two processes svchost.exe running under your user name, end them.
then go to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
delete winlogon key

you better leave the status key, coz i made the virus first check this key, if present it'll not install

then go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
here set the checked value to 1

AND IF you are not administrator, the virus couldnt access the registry, so i created startup shortcuts in startmenu. you'll see an invisible icon in the startup menu of start menu, delete it

DO ALL THIS AFTER YOU END THE TWO PROCESSES otherwise they'll be RESTORED every 10 seconds

After all this go to folder options uncheck hide protected files
you'll see C:\heap41a folder, delete it and you'll see microsoftpowerpoint.exe in your pen drives along with autorun.inf , delete them

AND please tell me where you found this, bangalore right :D
sorry for what i have caused, had no idea

This will help
Gigacore
Sep 2, 2007 at 6:10 PM
@ cyber boy, Same again, can u copy the text in that thread and make a notepad file and mail me?

@ Harvik780, thanks man... it worked
praka123
praka123 #10
Sep 2, 2007 at 6:17 PM
seems this virus is spreading all over!making indiAns proud :rolleyes:
Gigacore
Gigacore #11
Sep 2, 2007 at 6:22 PM
^. ya..... lol :D
blackpearl
Sep 2, 2007 at 6:54 PM
How do you people manage to get viruses? What site did you visit? What did you download? I'm just curious.
Gigacore
Gigacore #13
Sep 2, 2007 at 7:03 PM
^ i think... that virus came some where from digit forum :D... coz one of the member here is a virus writer....
blackpearl
Sep 2, 2007 at 7:06 PM
A virus writer here? who?
RCuber
RCuber #15
Sep 2, 2007 at 7:11 PM
@Gigacore: didnt you check my siggy?
zyberboy
zyberboy #16
Sep 2, 2007 at 7:15 PM
^^lol

@blackpearl
this virus only propagate through usb drive and not many av detects it.
Gigacore
Gigacore #17
Sep 2, 2007 at 7:34 PM
No charngk.....

@ cyberboy.... My avast didnt
koolbluez
koolbluez #18
Sep 2, 2007 at 7:38 PM
did u clean it? gigiboy.. most of the av's wont detec it... it's local maan... but PCCillin japan site has somethin about it :O
The solution is as pointd out by Harvik... btw.. r u able to use Firefox? How r u readin this...


____________

oops. read the thread again.. seems u got rid of it :D

____________

btw.. the *farm2.static.flickr.com/1181/1302016347_ed7dbb7516_o.jpg reminded me of ~Lil JinX~ :D
Gigacore
Gigacore #19
Sep 2, 2007 at 7:46 PM
^ Everything is working perfect now :D

A good virus... can anyone give me that virus in zip file :D
P
PRASADVM #20
Sep 6, 2007 at 10:34 AM
I Have A Trojan Downloader.????.??? ( Showing Different Names) How To Remove It.