intervalhehehe virus

[yetti]

my fix is to down load STOPZILLA trial version it works a treat kills virus no problem .............remove the programme after though as it slows your PC to crawl...Next stop rarlabs official site

[Mark v1.966]

Originally Posted by kennystringer

I fell prey to this bastard of a thing too. My AVG seemed to clean up the nasty files but I still couldn't open google. I deleted the IP's followed by web addresses in the host file and that solved the problem. But now my host file is completely empty, is that a problem? Everything seems to be working ok. Thanks for any advice on this.
Cheers...

The 127.0.0.1 localhost entry is important, so if yours is blank, enter it again manually. For further information on hosts file repairs this link may be helpful:-

How do I use the Hosts File?

Back up your hosts file for safe keeping in future.

Remember an ounce of prevention is worth a ton of cure, and as has been mentioned, stick to well reviewed and reliable AS programs from trusted download sites. Always scan any downloaded file for malware before opening/running it too.

A-squared free, by EMSI is usually an effective anti-adware tool, although MalwareByte's Anti-Malware is nearly as effective. Check out the links I gave in the freeware section of this site to independent trials and results on the various AS free programs. Some of the more commonly used ones aren't particularly effective.

[hewhoponders]

For those who are saying "Download only from trusted sites..".... This site was the Google-advertised download site for "Winrar" for a good while.

Might take a look at securitylabs.websense.com/content/Blogs/3264.aspx for more about that.

At any rate... My suggestion to anyone who has it? Get a new hosts file. Make one yourself... en.wikipedia.org/wiki/Hosts_file#Default_content_on_Windows_operating_sy stems shows what you'd normally find there.

As for the thing that caused it? In your Windows/system32 folder a file called explorer.exe was added when you installed WinRar. It may or may not be self-executing, I haven't downloaded the file myself to check, but it does have a registry key that runs it on startup. You can try deleting the key via regedit, then kill off the file after a restart, but I'd instead suggest using Killbox (found at bleepingcomputer.com/files/killbox.php) to delete the file, then delete the registry key from your registry. (You can look that up on Google, just watch where you go.)

For general malware purposes, I'd suggest using AVG. You can download their free antivirus/antispyware setup at their site, which is, shockingly enough, AVG.com. Another suggestion: Download Spybot: Search & Destroy, from spybot.com/index2.html. Works really well, and is free. Comes coupled with an optional registry monitor, which notifies you if significant changes to your registry are made, what is changed and how, and you allow/disallow the change. I like it, personally.

Anyway. Done with that. Good luck to those who still have the problems with it, and... That's that.

P.S.: The 10 post count for links is annoying! My post looked much better without the clutter, and the automatic linking was frustrating when whittling down the URLs so they wouldn't be picked up by it. >.>

[Thomas_The_TMC]

some 1 help me lol

when i try to delete the host files it wont let me save ???

[Mark v1.966]

If you haven't already done so, download HijackThis, and see if you can install it. You can download it from here:-

Bleeping Computer Downloads: Trend Micro HijackThis 2.0.2

Some malware, (such as the Vundo trojan), might be able to block it, so if you find you have a problem installing/running, try renaming it, (Trend-Micro suggest AnalyzeThis). You can then try using it to edit your hosts file; information on how to do this is available at:-

HijackThis Tutorial - How to use HijackThis to remove Browser Hijackers & Spyware

Run a HJT scan, and read the other tutorial sections. You might find you can use HJT to fix your malware problems yourself, but if in any doubt, post the scan log on one of the many sites with forums offering to interpret HJT results. Just Google 'hijackthis analysis' and pick one. You'll see that there are also auto-analyzers, but these are too crude to be of much help, so wait for an expert to interpret your scan log for you. With luck, you should then have the necessary information to be able to use HJT to stop malicious processes and remove any infections.

[Mark v1.966]

"For those who are saying 'Download only from trusted sites......' This site was the Google-advertised download site for "Winrar" for a good while. Might take a look at securitylabs.websense.com/content/Blogs/3264.aspx for more about that."

Google Sponsored Links Spreading Rogue Anti-Virus Software - Security Labs Blog

A useful link with some important information, so I've repeated it to save others the minor hassle of having to type it, or paste, into the address bar. Personally, I always scan for malware before opening any download, no matter where it comes from, and don't include Google sponsored links in my definition of trusted sites anyway. I use the free McAfee siteadvisor, finjan, and WOT add-ons in Firefox for good measure, although some sites can't be scanned by finjan, some are too new to have been checked by McAfee, and WOT relies on feedback from webusers, (who may mark sites as unsafe for a variety of reasons). So long as you understand and accept the limitations of each, they are useful guides. If all three agree a site is OK then it's probably safe, but even then, I still don't open any downloads without scanning them first.

P.S. Reading the article at the link above, it will become clear that if you are looking for a file such as WinRAR or other downloads, it is much better to go directly to a reputable site such as CNET, or filehippo, and then enter the name of the file you are looking for in the site search engine instead of Googling 'winrar'. This avoids being taken to a forged version of CNET, (or other download sites), offering infected files, as happened to those who got the 'intervalhehehe' malware. This is obviously why some believe they got infected from a reputable site.