7 replies to this topic

[rzombie1988]

I got a virus the other day and I'm having two big problems:

1) I cannot watch any videos. All previous videos that I could watch no longer work. This includes quicktime, windows media player, media player classic and vlc player.
2) I'm getting redirected from google searches onto happili.com and gimmeanswers.com
3) Internet websites keep crashing. I constantly get the operation aborted error and I get messages that IE needs to close.

I've downloaded about 6 different programs to fix the viruses but nothing has worked. Tried Norton, McAfee, Spybot, CCleaner and nothing.

Any advice? I tried to do system restore but of course that doesn't work either.

[Ryan]

I assume you've tried this? The second post, not the HijackThis dump. There are other similar methods. It sounds like it's a root-kit of some sort.

http://forums.techgu...i-redirect.html

[J.T.]

My girlfiend got hit with this over the weekend.  Getting it off her laptop was a fucking chore.

Kapersky has a tool called TDSSKiller that is specifically designed to remove rootkits.  She had the version of the rootkit that attempts to disable TDSSKiller, but I renamed the executable and finally got it to work.

Failing that, you will probably have to go old school.  

Boot your computer into Safe Mode while logged on as an administrator and delete the following registry keys:

• %AllUsersProfile%\{random}\
  
• %AllUsersProfile%\{random}\*.lnk
  
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce [RANDOM]
  
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run [RANDOM]
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [RANDOM].exe
  
• HKEY_CURRENT_USER\Software\[RANDOM]

Those are the ones associated with the redirect rookit.

If you are uncomfortable with making registry edits, then hit up the support forums in places like ArsTechnica.

I think there is also a YouTube video tutorial about how to manually remove the happili.com rootkit.

[rzombie1988]

Thanks for the tip. It worked but everything culminated and the pc died a week later. I was able to save most of my stuff though so its okay.

[RandomAct]

In the future, my be-all, end all for this sort of thing is Combofix.  It has never failed me.

[Chaos]

Next time you get a bad infection... give Malwarebytes a try. If your computer will allow it to install (I've had some computers that were beyond this point, and I just did a full reformat), Malwarebytes seems to get the job done in most cases.  The free one is great, and the paid service is supposed to be that much better.

[RandomAct]

I use the paid Malwarebytes, and it's awesome.  Excellent real time protection to go along with the deep scan.  I use MBam and Combofix on all of my repairs.

[Vick]

Use Malwarebytes and Microsoft Security Essentials in the future.