Porn banners. Treatment and prevention

Good time of day.
In the current period increase in incidents of porn widgets , and vymogatelstva programs with which criminals shake with users a lot of money.
Here I will share with you all our knowledge about this problem.

So there you go. THE WIDGET ON THE DESKTOP:

Description. Usually after restarting the computer , when turn on the machine ,
then there is a banner on the desktop that can not be move or remove. Scammers offer you erotic videos , or convince you that your computer is infected with virus and when sending SMS messages , he will recover.
Many frequent users know this trick , and even if they send a text message , the response code will not come true. But skilled users very often maintained , and using them criminals filling their pockets with loot.
Program - a virus comes in through vulnerabilities in the browser , the sites with the questionable data and pop-up Windows( link), and the user voluntarily gives the nod for the virus through the popular social network "Vkontakte or Odnoklassniki"
It goes like this : a Friend writes to you that " urgent look , you are in this picture," and give a link , where one or more characters other. ( example: VkontakLe.ru) Not attentive reader comes to this site , and in that time, the computer is the malicious script.
This is one of the most common examples , although there are a lot , be careful friends :)

Ways of dealing with the virus.
There are many ways to remove the banner , as the saying goes each to taste.
There are banner ads which can be removed by themselves after 30 days or through the 999 clicks. There are settle for a long time , and harm , harm , harm. Block task Manager and registry.

In order to avoid reinstalling the OS , offer several ways.

Way of dealing 1.
One of the easiest ways is called "system restore"
Go to start – Programs – accessories – system tools – system Restore.
If you had it enabled and was created points every day , you can just roll back your system a day ago.(at that time when you were not manifestations of advertising)
ATTENTION if you value your programs which are installed today , to do better is not necessary , because the system will rollback one day ago and thus your proici horns.

Method 2 is undesirable or extreme.
This is a trivial formatting. Applies when your system has already affected thousands of hopeless viruses and the computer just choked them , then re installing the OS for you.


Method 3 – Utilities and programs .
If you have already installed the software I was advised in the application that it is not worth the effort to disable ads.
Picture : you got Porn as far left you can see the label of your life-saving program called AnVir Task Manager. Click it , program runs always on TOP and in particular of the banner , and immediately the program will let you know which apps have been added to the startup without your knowledge , and also clearly show the degree of risk in any process.
Once this window came out , you just remove everything from startup which will give you apps and processes with "high risk". Then just scan the computer with anti-virus , clean the hidden TEMP folder which is in the directory
C:Documents and Settings\Administrator\Local Settings
Similar programs there are , and most importantly for early care you about your system.

Method 4 – Cmedia.
There is a type of banner is very Intrusive , that is not easily removed. Because the process is exploler.exe and in startup it does not fit. Appears every 5 minutes , very nasty diseases. Anti-virus software often do not see and do not take.
But it was justice , the needle that Kashchei is the daddy
c:\Users\username \Application data\Roaming\CMedia ( though sometimes he changes his location , can score in the search the name of this folder)

All the poor man is exposed , may a pinch, delete the entire folder from your computer or
Find the file CMedia.dat. ( via Notepad will open ) change the settings of the counter of the remaining ad impressions on the scratch and everything. You can leave the rest to memory.




Method 5. x Bob seven
To carry the hard disk to a friend and check it fresh antivirus.

Method 6. – Generate code (performance 90%)
Code can be generated from the website of the antivirus vendors (again, run to the other with paper and pencil)
http://support.kaspersky.ru/viruses/deblocker
http://www.drweb.com/unlocker/index
http://virusinfo.info/deblocker/

People say that there is a universal code 3097 may help.*

Method 7 “eKav antivirus”


In malicious informer eKAV ( longanimity) , you can use the table:

In this table, all just. In the first column of the selected digit of the code message and is replaced by the appropriate number of any of the colored bars. For the same code numbers are used only one color of the column. If not the first column, proceed to the next, one of the nine columns should definitely help.

Method 8 - Manager.
Well, there are a lot of cases is not necessary , I think it is clear to all. If you you have a workable standard task Manager , or you use an alternative , then delete at random any suspicious processes that are created by the administrator but not system.
ATTENTION to porn banners CMedia (see above) and FieryAds is not covered , their Manager can not be removed.

9.Deleting files banner directly: program files when some of the banners appearing file plugin.EXE or the like , can be removed just as in safe mode and in regular. Use Unlocker if you cannot do it directly.

10. to start the computer in safe mode.

Useful applications:

AnVir Task Manager is a free system utility that allows you to control everything running on computer and provides convenient tools to configure your computer.
[screenshot]

AVZ is a small program , and so much useful. Will help you to restore normal operation. Unlocks , clean , patch. It also has the task Manager which you can use when the standard was executed executioner – virus.

Dr. Web CureIt – unfortunately when the banner has already started , then start the program it will be very difficult, as some banners cannot be moved or hidden. ( only through safe mode) But this program will replace you antivirus , how to hide a banner , then immediately scan the system to her. She copes fine. You can download it on the website of Doctor Web. www.freedrweb.com/cureit/

Malwarebytes' Anti-Malware – scanner , designed for such banners , program ads , modules, and other debris. If the infection got into the system but still not show , then this utility will pull the plug. Just scan your computer at least once a day , it takes no more than 5 minutes.
[screenshot]

Trojan Guarder Gold is a Program to search and destroy the computer viruses, Trojans, macro viruses and other malicious software.

Combofix is a free program to remove spyware, Trojans and viruses. Also for those who have problems running task Manager and registry editor.

Well guys we are smart , we will find where to download , search engines are able to use. If you have difficulty finding programs that write to the PM or email/ ICQ , I'll link.

Prevention:
Of course to install a good antivirus that you like. I have for example is Kaspersky 2010 , handles great.
-Be careful when sitting on the sites of dubious information , or in social networks
(Vkontakte , Odnoklassniki , mail) , do not click on suspicious links , it is better to recheck.
Periodically scan the system utilities , it will take about 5 minutes a day.
- Use The Firewall. At least he will warn you about getting into the system malware
- Enable "system restore" and periodically create "restore point"
-In case of a site with pop-UPS it is advisable to leave it in order to avoid infection .





If methods did not help you , describe:
the appearance of the banner, the number needed to send SMS , text messages , color of the banner and other information , how often vylaziet, etc.

Useful websites:
http://www.eavasi.ru/ - very useful site , all the banners and all this crap, from there I took the table to combat eKAV

Added :

1. Just try to translate the system time (clock) well, let's say for a month ago :)

2 If not work , press the Win (windows)+R and type TASKKILL /f /im explorer.exe

Thereby we destroy the process explorer.exe
The banner should disappear ( assuming that it is fixed to Explorer) , dalla restored back Explorer the command prompt (Win+R) explorer.exe

If the command line suddenly does not start , press ctrl+alt+del and type in new task C:\WINDOWS\explorer.exe

3.It is possible to try to delete files:

c:windows\system32\driver\ssfc.sys
c:windows\system32\sfcfiles.dll


Thank you for your attention.
_________
Banehallow