intervalhehehe virus

[as6670]

h t t p//en.wikipedia.org/wiki/Hosts_file

[ChannelDelibird]

Originally Posted by ChannelDelibird

I'm still having trouble accessing sites like Google. I've tried deleting the contents of the host file but when I try to save over it says 'cannot create the file. make sure the file and path name are correct' even though I am saving over not creating a new file. What can I do?

I'm still stuck here and I really need some help...anyone?

[Mickha]

Hve you tried doing a system restore, in Safe Mode?

[Jody in Philly]

I picked up this virus a few days ago and it's driving me crazy!!! At least I know that I'm not alone...
Does anyone know what the virus looks like in the Hosts file? Or, better yet, how do I go about backing everything up? I don't have a usb or external hard drive. Can I back everything up somewhere in my computer files? I'm new at this and could really use some HELP!!!
Thanks!

[clarkchiu]

i have the same prob on my puter but i downloaded the intervalhehehe virus from cnet.com. so i guess nowhere is safe .. i think if you download Malware Bytes that might get rid of it .

[iaminneedofhelp]

Originally Posted by as6670

After reading some of the problems here i will take a stab in the dark and suggest that your PCs host file has been modified without your knowledge. The file should look like this when you open it using notepad or wordpad:






To view the host file go to start>run and paste the following and hit ok.

for XP & Vista - C:\WINDOWS\SYSTEM32\DRIVERS\ETC

Locate the file thats called Hosts and open using notepad or wordpad and compare to the above. If you see any added entries in there do a back up of the host file then remove the suspect entries so that it looks like the above then save. Don't forget to create a back up.

Let us know how you get on and if this fixes the problem.

i did everything you said. but here's the thing. (btw i have the intervalhehehe virus 2) when i change it the websites work, but then i wait a while and the popup returns and it changes the document to how it was before i did what yoiu said and changed it! so i change it -10 seconds later- it changes it back . no matter how many times i continue this cycle it continues to happen. suggestions?

[TPengilly]

Ive found out how to fix this. Simply do what as6670 told you to. Also have a friend do it on their computer. Your friends(if they are not infected with the virus) will have their local host and that's about it. Your host file will not have the local host, but instead have several phishing site IP's. Delete all of them so their is nothing in the file. Then type in your friends localhost number. It would be in this format.
###.#.#.# localhost Your host number may have more digits so I suggest just copying your friends.

[philsuexxx]

my friend downloaded this thinking it was winrar.exe.. i got fed up trying to find the virus..it made his laptop so slow i ended up re-formatting it and re-installing windows...i know this was a bit extreme but i spent 2 days reading up on it..so ..i spent 2 hours re-installing windows instead

[DawnCaster]

Originally Posted by as6670

After reading some of the problems here i will take a stab in the dark and suggest that your PCs host file has been modified without your knowledge. The file should look like this when you open it using notepad or wordpad:






To view the host file go to start>run and paste the following and hit ok.

for XP & Vista - C:\WINDOWS\SYSTEM32\DRIVERS\ETC

Locate the file thats called Hosts and open using notepad or wordpad and compare to the above. If you see any added entries in there do a back up of the host file then remove the suspect entries so that it looks like the above then save. Don't forget to create a back up.

Let us know how you get on and if this fixes the problem.

Got rid of the redirecting part now. Just killed all the entries with the same IP adress. Basically the ones with "facebook" "live" and other popular sites on.

Now... ill get on with killing this ****er of a popup

[as6670]

try installing asquared antimalware. Works great for trojans and other junk. Its a freebie so nothing to lose. Also check out comodo BO Clean. That prevents trojans and other viruses from doing their thing but double check before installing this as some Antivirus software is not compatible with this. I use this alongside kaspersky 2009 even though they say its not compatible but thats a risk i am willing to take.

w ww.comodo.com/boclean/boclean.html

w ww.emsisoft.com/en/software/free/

also check this out for editing host file

w ww.mvps.org/winhelp2002/hostsfaq.htm#Editor


I found that it is safe to delete the infected host file as windows will create a new one after a reboot. if you are unsure just create a back up on your desktop before deleting. Only do this after you are sure that your machine is clean of the offending virus that is making the changes to the host file in the first place.