3 New Notifications

New Badge Earned
Get 1K upvotes on your post
Life choices of my cat
Earned 210

Drag Images here or Browse from your computer.

Trending Posts
Sorted by Newest First
B
Banehallow 15.03.20 02:23 pm

Porn banners. Treatment and prevention

Good time of day.
In the current period increase in incidents of porn widgets , and vymogatelstva programs with which criminals shake with users a lot of money.
Here I will share with you all our knowledge about this problem.

So there you go. THE WIDGET ON THE DESKTOP:

Description. Usually after restarting the computer , when turn on the machine ,
then there is a banner on the desktop that can not be move or remove. Scammers offer you erotic videos , or convince you that your computer is infected with virus and when sending SMS messages , he will recover.
Many frequent users know this trick , and even if they send a text message , the response code will not come true. But skilled users very often maintained , and using them criminals filling their pockets with loot.
Program - a virus comes in through vulnerabilities in the browser , the sites with the questionable data and pop-up Windows( link), and the user voluntarily gives the nod for the virus through the popular social network "Vkontakte or Odnoklassniki"
It goes like this : a Friend writes to you that " urgent look , you are in this picture," and give a link , where one or more characters other. ( example: VkontakLe.ru) Not attentive reader comes to this site , and in that time, the computer is the malicious script.
This is one of the most common examples , although there are a lot , be careful friends :)

Ways of dealing with the virus.
There are many ways to remove the banner , as the saying goes each to taste.
There are banner ads which can be removed by themselves after 30 days or through the 999 clicks. There are settle for a long time , and harm , harm , harm. Block task Manager and registry.

In order to avoid reinstalling the OS , offer several ways.

Way of dealing 1.
One of the easiest ways is called "system restore"
Go to start – Programs – accessories – system tools – system Restore.
If you had it enabled and was created points every day , you can just roll back your system a day ago.(at that time when you were not manifestations of advertising)
ATTENTION if you value your programs which are installed today , to do better is not necessary , because the system will rollback one day ago and thus your proici horns.

Method 2 is undesirable or extreme.
This is a trivial formatting. Applies when your system has already affected thousands of hopeless viruses and the computer just choked them , then re installing the OS for you.


Method 3 – Utilities and programs .
If you have already installed the software I was advised in the application that it is not worth the effort to disable ads.
Picture : you got Porn as far left you can see the label of your life-saving program called AnVir Task Manager. Click it , program runs always on TOP and in particular of the banner , and immediately the program will let you know which apps have been added to the startup without your knowledge , and also clearly show the degree of risk in any process.
Once this window came out , you just remove everything from startup which will give you apps and processes with "high risk". Then just scan the computer with anti-virus , clean the hidden TEMP folder which is in the directory
C:Documents and Settings\Administrator\Local Settings
Similar programs there are , and most importantly for early care you about your system.

Method 4 – Cmedia.
There is a type of banner is very Intrusive , that is not easily removed. Because the process is exploler.exe and in startup it does not fit. Appears every 5 minutes , very nasty diseases. Anti-virus software often do not see and do not take.
But it was justice , the needle that Kashchei is the daddy
c:\Users\username \Application data\Roaming\CMedia ( though sometimes he changes his location , can score in the search the name of this folder)

All the poor man is exposed , may a pinch, delete the entire folder from your computer or
Find the file CMedia.dat. ( via Notepad will open ) change the settings of the counter of the remaining ad impressions on the scratch and everything. You can leave the rest to memory.




Method 5. x Bob seven
To carry the hard disk to a friend and check it fresh antivirus.

Method 6. – Generate code (performance 90%)
Code can be generated from the website of the antivirus vendors (again, run to the other with paper and pencil)
http://support.kaspersky.ru/viruses/deblocker
http://www.drweb.com/unlocker/index
http://virusinfo.info/deblocker/

People say that there is a universal code 3097 may help.*

Method 7 “eKav antivirus”


In malicious informer eKAV ( longanimity) , you can use the table:

In this table, all just. In the first column of the selected digit of the code message and is replaced by the appropriate number of any of the colored bars. For the same code numbers are used only one color of the column. If not the first column, proceed to the next, one of the nine columns should definitely help.

Method 8 - Manager.
Well, there are a lot of cases is not necessary , I think it is clear to all. If you you have a workable standard task Manager , or you use an alternative , then delete at random any suspicious processes that are created by the administrator but not system.
ATTENTION to porn banners CMedia (see above) and FieryAds is not covered , their Manager can not be removed.

9.Deleting files banner directly: program files when some of the banners appearing file plugin.EXE or the like , can be removed just as in safe mode and in regular. Use Unlocker if you cannot do it directly.

10. to start the computer in safe mode.

Useful applications:

AnVir Task Manager is a free system utility that allows you to control everything running on computer and provides convenient tools to configure your computer.
[screenshot]

AVZ is a small program , and so much useful. Will help you to restore normal operation. Unlocks , clean , patch. It also has the task Manager which you can use when the standard was executed executioner – virus.

Dr. Web CureIt – unfortunately when the banner has already started , then start the program it will be very difficult, as some banners cannot be moved or hidden. ( only through safe mode) But this program will replace you antivirus , how to hide a banner , then immediately scan the system to her. She copes fine. You can download it on the website of Doctor Web. www.freedrweb.com/cureit/

Malwarebytes' Anti-Malware – scanner , designed for such banners , program ads , modules, and other debris. If the infection got into the system but still not show , then this utility will pull the plug. Just scan your computer at least once a day , it takes no more than 5 minutes.
[screenshot]

Trojan Guarder Gold is a Program to search and destroy the computer viruses, Trojans, macro viruses and other malicious software.

Combofix is a free program to remove spyware, Trojans and viruses. Also for those who have problems running task Manager and registry editor.

Well guys we are smart , we will find where to download , search engines are able to use. If you have difficulty finding programs that write to the PM or email/ ICQ , I'll link.

Prevention:
Of course to install a good antivirus that you like. I have for example is Kaspersky 2010 , handles great.
-Be careful when sitting on the sites of dubious information , or in social networks
(Vkontakte , Odnoklassniki , mail) , do not click on suspicious links , it is better to recheck.
Periodically scan the system utilities , it will take about 5 minutes a day.
- Use The Firewall. At least he will warn you about getting into the system malware
- Enable "system restore" and periodically create "restore point"
-In case of a site with pop-UPS it is advisable to leave it in order to avoid infection .





If methods did not help you , describe:
the appearance of the banner, the number needed to send SMS , text messages , color of the banner and other information , how often vylaziet, etc.

Useful websites:
http://www.eavasi.ru/ - very useful site , all the banners and all this crap, from there I took the table to combat eKAV

Added :

1. Just try to translate the system time (clock) well, let's say for a month ago :)

2 If not work , press the Win (windows)+R and type TASKKILL /f /im explorer.exe

Thereby we destroy the process explorer.exe
The banner should disappear ( assuming that it is fixed to Explorer) , dalla restored back Explorer the command prompt (Win+R) explorer.exe

If the command line suddenly does not start , press ctrl+alt+del and type in new task C:\WINDOWS\explorer.exe

3.It is possible to try to delete files:

c:windows\system32\driver\ssfc.sys
c:windows\system32\sfcfiles.dll


Thank you for your attention.
_________
Banehallow
161 Comments
Sort by:
D
Dvn74 15.03.20

CureIt to scan try.

c
cazyal 15.03.20

you didn't do anything!!

[not capsite, keep yourself in hand]

c
coolracer 15.03.20

The author enough to drive - it Windows re-installed. This is a standard loser banners which are written in the registry keys responsible for the initialization of the OS shell. Cured by restoring the original settings by connecting to the registry hive on another machine. If you're really asking for help, don't cure people, you are current to send to be.
Less on the left porn sites have to climb. Where do you even find this infection. I have no antivirus and firewall are always sitting and never seen.

d
dimakozhanov 15.03.20

WoronOK
This is your neocortical, I have over 6 years of polzovaniya the Internet caught only one banner, so arrogant, everything is blocked and demands payment over the phone, but I killed him, used the point of restoration of windows and all of this banner on my comp no longer exists, the future before climbing no do a point of restoration of windows.

S
SUSUL1 15.03.20

Need help!
POPs using my stry laptop to WindowsXP at work has climbed on a site which for prodoljaya browsing suggested to install IE9.4. Well, he's not being scare and hit the button OK and as usual in such cases, downloaded (ie me) blocker. The infection is pretty well made. something new. Check disk recovery virus on helped=(. In the registry branch HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and Userinit is supposed to userinit.exe, in Shell is explorer.exe
branch Winlogon is not duplicated.
Who knows how to calculate this filth? To demolish the entire Windows not hunting

S
SUSUL1 15.03.20

Inquisitive thoughts running around in my head and tried to shake the cockroaches...
If the registry entries are all spelled out normally, therefore an infected himself explorer.exe
Without much thought about the consequences of shoved into the laptop KasperskyLiveCD, go to ProgramFiels and removed from the laptop folder, and Internet Explorer and clean all the Temp folders that are in Windows and AplcationData different users, exactly like yourself, and General.
Restart the computer in normal mode and voila, lock no. Restored IE through the control panel, removing and installing programs, Windows components. Update the antivirus software and checked. After 4 hours check 3 utilities for finding viruses, malware nikakih programm and prilozhenii was not found.
Here is such a cunning lock got into the system=(

S
Spartak_13 15.03.20

Here's what jumped out at me

S
SUSUL1 15.03.20

Spartak_13
how to catch?

S
Spartak_13 15.03.20

SUSUL1
I don't know. Somehow I intyrnet turned off and when turned on, something I study time looking and this crap popped up.

i
irknet 15.03.20

You can just use any version of Linux from the live cd, go to the Windows, well, there baderski to find the file and delete it. It is usually located in the home folder of the user.

a
aleks926820 15.03.20

I heard that there is winlock which is sewn into the BIOS of your computer.Is it true or fake?And reflashing to remove it?Just in case I want to zabekapit.

P
Poprobuy_radugu 15.03.20

When the porn banners just started to get into fashion, I long ago picked up on this old computer (grabbed on the cheap shit-the tracker). Internet, then just connect the experience of climbing it was not, here and grabbed it. When you step into any browser written type you've watched gay porn TEXT tra-TA-TA. I could not catch up with, who is from my computer gay looking)) Then only found out that it is this type of viruses.

Aleksei Kostenko
Perhaps there are, but rare.

M
Mitsu Rju 15.03.20

Banehallow
I have Avast and not any toxins.
So this is error!, I have to remove and install that you suggest!.

M
Mitsu Rju 15.03.20

Aleksei Kostenko
I heard that there is winlock which is sewn into the BIOS of your computer.Is it true or fake?And reflashing to remove it?Just in case I want to zabekapit.

I don't know what other answer, but there., That's just not in all BIOSes, mainly in the brand from the manufacturer that are shipped with the OS.
I've seen this on one Fujitsu
Is it possible to remove the flashing?!, Don't know, or when you didn't do it!.

M
Mitsu Rju 15.03.20

My struggle is simple (With infection).
1. If you are searching, go to the website on which these appear (pop-up) messages. Type already described by the Author!.
I just leave this site or page!., If this on the surface, then inside is even worse.,
So as big the possibility of clicking on those messages!, Because they sometimes change places!.
2. Not trying Yes click on normal sites, a message indicating that the messages or Your browser is out of date., It is the same, and can cause problems no less!.
I trust the browser and the antivirus!., If for some reason the page is reset, so all is not okay.

M
Mitsu Rju 15.03.20

Ozon58
Such at you?

I had this happen., Not sure, tried poking around for a long time in the folders of this computer!,
Deleting all files that were created by the person that day!.
The window disappeared, but still had to restore a bunch of programs!.
Then I found on one site, a solution like this kaki!.,
Easier for me to reinstall the system!.
This appears from clicking on free movies, on the sides and bottom of the browser!.. Am I right?!.

C
Chelseafc777 15.03.20

Mitsu Rju
Ahahahahahaah you just have to put avast antivirus premium,and adblock,and do not poke on porn sites any links of ahahhahahahahahaha only suckers fall for it..

C
Chelseafc777 15.03.20

Aleksei Kostenko
I heard that there is winlock which is sewn into the BIOS of your computer.Is it true or fake?And reflashing to remove it?Just in case I want to zabekapit.
Do you yourself understand what you wrote?banners never can ushitsa in the BIOS,it may be only a single virus in the world,and why hackers need this?ahahahaah how you can get caught on the banner,I never got caught I have friends with the native antivirus for win 8.1 has never been caught..

V
VITYA_KOLYADENKO 15.03.20

And how do you, a decent antivirus disk should have a repair option registry (like \SOFTWARE\Microsoft\Windows NT\CurrentVersion \Winlogon, \Run and other ways to replace it, like Image File Execution Options\)? And if not corrected, nothing normal will not boot after virus removal.

N
Nightmare_pc 15.03.20

great tips!