Often the scan does not detect a virus, so you need to download the Dr.web Cureit utility, which is freely available. Do a deep scan again, this time most likely viruses will be found. Next, you need to clean up the automatic boot, go to start and select the "run" tab, then type the word "msconfig". The system settings will appear, go to the "startup" section. The checkbox will mark objects that could be infected. In most cases, the following elements are infected:
- C: WINDOWSINF * .exe /% windir% system328353.exe;
- C: WINDOWSsecuritysmss.exe /% windir% system32smphost.exe.
Next, you need to clear the rest of the objects. Most often, malicious programs end up in the folder where WINDOWS recovery files are stored. Of course, the entire folder will have to be deleted. Empty the folder called temp and all temporary files from the internet. To carry out all the work as quickly as possible, use the Ccleaner program.
How to remove a virus in classmates / in contact
Often, programmers joke and say that you need to remove WINDOWS and reinstall it. Of course it will work, but there are other approaches as well. First you need to, because what NOD32 sees may not be seen by Kaspersky and vice versa. Take turns doing a deep virus scan, you can leave the computer overnight if you have no time at all.Viruses from social networks can penetrate the hosts file, it contains different lines, but first of all - 127.0.0.1 localhost. When a virus enters it, strange lines appear that were not there before. The site "Vkontakte" is being blocked, so check the hosts, it is located at the address - C: WINDOWSsystem32driversetchosts. There you will see the lines added by the virus, delete them to regain access to the site.
How to remove a virus from a USB flash drive
It is very easy to detect a virus on a USB flash drive, it gives itself out when you open the USB flash drive and information about an error appears. This happens very often, in some cases all information from the flash drive is hidden or deleted. Moreover, even the conductor does not help to open it, an error appears in an unknown language resembling hieroglyphs.You can get rid of the virus in the following way: go to start - run - type cmd.exe and click OK. Next, write the following commands on the command line:
- del / a-hrs Xautorun.inf;
- del / a-hrs Xautorun.txt;
- del / a-hrs Xautorun.bin;
- del / a-hrs Xautorun.wsh;
- del / a-hrs Xautorun.reg;
- del / a-hrs XAutorun. ~ ex;
- del / a-hrs Xautorun.inf _ ?????
- del / a-hrs Xautorun.srm;
- del / a-hrs XAUTORUN.FCB.
What to do if there is problem with entering classmates? You are asked enter a phone number or send SMS to go to classmates?! it a virus that blocks classmates and aimed at, by any means, forcing you to subscribe to the mobile newsletter or send SMS. To get rid of it and ok go to classmates - do the following:
Step 1. We try to enter classmates from another browser.
Try go to classmates from each browser on the computer - Yandex Browser, Chrome, Opera, Firefox.
If it happens that with one of them you will succeed go to classmates the site is normal and not blocked - apparently the virus works only on the browser from which can't enter classmates... This is even good, since the system files are not corrupted. It remains to check the antivirus folder where the browser is installed (usually C: \\ Program files \\ (browser_name)
), folders with cache and temporary files - C: \\ Documents and Settings \\ [Username] \\ Application Data
.
Next, go directly to step 3.
If nevertheless i could not enter classmates from any browserand the site is blocked in other browsers, then the file is most likely damaged Hosts... I will tell you how to restore it in Step 2.
Step 2. We restore the hosts file to go to classmates.
Well, or you can edit it manually.
Push Start\u003eExecute or key combination Win + R... In the Run window, enter the command % systemroot% \\ system32 \\ drivers \\ etc , click OK.
Before editing, do not rename to hosts.old... It is advisable to do this in order to leave a backup copy of the old file and restore it in case of any problems.
Then you need to create a new hosts file - right-click in an empty space, select the item in the context menu Create a → Text Document... Enter the file name - hosts, press the key Enter.
Now, open the created hosts file using Notepad and copy the following text there:
# Copyright (c) 1993-2006 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP / IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a ‘#’ symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handle within DNS itself. # 127.0.0.1 localhost # :: 1 localhost
Save and close hosts file. Restart your computer.
Often, recovering the hosts file solves the problem How to remove a virus in classmates .
Step 3. Check the C: \\ drive and the Windows folder with an antivirus.
It is imperative to check the system disk with an antivirus, even if you got rid of the virus in step 2. This must be done because the virus remains on your Windows system and Sooner or later - the situation may repeat itself... To avoid this - you need to check the system with an antivirus with up-to-date databases.
Even if you have some kind of antivirus, it's better not to rely on it - it has already missed at least one virus. You need to download special anti-virus scanners DrWeb CureIt! and Kaspersky Virus Removal Tools... They work without installation - you just need to download and run them. Of course, before starting them - disable the existing antivirus.
Recently, a new virus has been activated that blocks the entrance to social networks such as R20; classmates R21 ;, R20; VkontakteR21; and others, and in some cases on the Internet.
The fact is that viruses replace the R20 page; OdnoklassnikiR21; or R20; In contact R21; and are disguised as a support service, and antivirus software, be it ESET Nod32 or Kaspersky, cannot intercept them. Defeating such a virus is not very difficult, the main thing is not to succumb and do not send SMS messages to dubious numbers.
So let's look at how you can deal with such a virus.
On the desktop, open R20; My computer R21; and go to the address c: WindowsSystem32driversetc , open the file with notepad hosts
Right-click on the file R20; hostsR21;, in the pop-up window, select R20; Open R21;
Select the program R20; Notepad R21; and press the R20 button; OKR21;
This is what should be in the R20; hostsR21;
Scroll through the file to the very bottom and find extra lines at the very bottom, they all need to be deleted and the file saved. Then you need to reboot. And drive the disk R20; CR21; antivirus.
Here is the text that should be in this file (and nothing else)
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP / IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a R16; # R17; symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com
# source server
# 38.25.63.10 x.acme.com
# x client host
# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# :: 1 localhost
You ask how to remove a virus in a 64-bit version of the OS?
In 64 bit Windows there is no R20 folder; ectR21; and file R20; hostR21; they are in a different location, they can be found via R20; Search R21; or you can do it easier. Just create a folder R20; ectR21; by the address c: WindowsSystem32drivers , i.e. in the R20 folder; driversR21; and in the created folder create the R20 file; hostsR21; without R20 extension; txtR21; with the above text, save it to the R20; ectR21; folder, reboot, run it with an antivirus. Everything is ready.
Good luck in the fight against viruses !!!
No related posts
Do you have a problem with getting in touch, classmates, mail? Are your favorite social networks blocked? Access blocked, asking to send SMS? nothing happens when you enter the password? writes page not found? Are they writing website content blocked? This is no longer a secret. If you have such signs, you have caught a virus that redirects to fake pages! Social networks never ask to send SMS!
OPTION # 1
To begin with, we go to the control panel (start menu, then the control panel), find there such a section: FOLDER PARAMETERS, press and a window opens for us.
We do the following: go to the view tab in the window and roll the wheel down to the graph (show hidden files, folders and drives), * mark * this item and click apply!
Now we need to go to My computer drive C: folder * WINDOWS * then folder * system32 * then folder * drivers * and finally folder * etc *.
Find the hosts file in the * etc * folder (it has no extension), it may not be one, but, for example, two or even three.
If you have one hosts file and there are no hidden hosts files, then do the following, select it and right-click on it, in the window that appears, select the "Properties" item. In the window that appears, uncheck the (Read only) checkbox, if it is, and click the "apply" button. Now select hosts again and right-click.
We need to open it with Notepad or another built-in Wordpad editor. In the open hosts file, you need to delete everything except the entry * 127.0.0.1 localhost *. And be sure to click save!
Be sure to restart your computer after the changes you made! After restarting the computer, social networks and similar sites begin to open.
When you enter the page, after restarting the computer, we change all the passwords of the pages of social networks at once MANDATORY!
OPTION # 2
If for some reason you did not find entries in hosts or it was empty, or it is not one, but two, then do the following: delete all hosts files that you see and hidden ones too, only files labeled hosts. OTHERS DO NOT TOUCH IN THIS FOLDER!
Downloading FIX, MICROSOFT has released specifically to restore the contents of the hosts FILE. As you downloaded and removed all the old hosts, LET'S RUN FIX.
Follow the hosts file recovery wizard (it will take less than a minute). As soon as the wizard restores the hosts file, it will ask you to restart the computer, to which you MUST AGREE and reboot!
After restarting the computer, social networks and similar sites begin to open .
If after that you could not remove the virus?
OPTION # 3
If after the first two options you cannot enter, then you have a virus that prescribes hosts when the computer boots (do not rely on your antiviruses, even if you have the most popular brands, brands of antiviruses) in 90% of them, most of them do not see such viruses!
We do the following: go to the official website of the antivirus DOCTOR WEB
free.drweb.ru/download+cureit+free/?lng\u003dru
And we download a one-time curing utility, and do a full scan of the computer, after which we remove the found virus (if necessary, after removing the virus and restarting the computer, we repeat option 2).
After restarting the computer, social networks and similar sites begin to open.
When you enter the page, after restarting the computer, we change all the passwords of the pages of social networks at once MANDATORY!
If after that you could not remove the virus?
P.SAfter you have done everything and entered the pages, do not postpone cleaning your computer from viruses, spyware and malware.
Revealing such modules prevents you from stealing your passwords and personal data from your computer!
If your antivirus has already missed such a virus that blocks access to pages, you may still have similar viruses on your computer or even keyloggers that steal your passwords from your computer!
