intervalhehehe

[Spectrum]

Bugger, I got a virus from downloading winrar it's called intervalhehehe. I have tried the following to try and get rid of it..........

Avg full version
spybot
super anti spyware
rougefix
Adaware

None of the above can pick the virus up. It redirects you to some site asking for money for it to be removed, been told its Russian or something like that, got any ideas dudes? I can NOT get google at all any any search comes back chineese.

I have tried a system restore in normal mode and safe mode but to no avail.

C:\Windows\System32\Explore.exe

HKLM\Software\Microsoft\Windows\Curren...

I have found info that the above files need to be deleted but i cant find them.

Any ideas guys n gals???



Paul

[krazylegz]

moved to correct section.......

have you tried a decent antivirus like nod32 or kaspersky?

[Titan]

have you attempted a system recovery?...go back a few weeks or days and see if it rids it of it!!!

[bund]

intervalhehehe

got this bloody thing today , found the best way to erase it . go to my computer / computer for vista , go to windows folder , find system32 and open , then click on the top bar where date is , find specific date ( the date you downloaded it ) it will be a rar or zip style folder usually called explore . firstly rename the folder to whatever u like , right click on the folder and go to properties click advanced bottom right and change file attributes ( unclick both ) then delete . now do a system restore and the bloody thing will bug u kno more. if you dont erase this folder then it reappears about an hour after the system restore and u will subsequently smash ur fist thru the screen while intervalhehehe will just be mockin u , it took ages to figure this fekin fing out . be careful what u download

[derek cairns]

Can anyone help me get shot of intervalhehehe I have read the thread above and followed it step by step but I cant sem to find the part with the date line or the file I need to rename thgis is frustraiting
Please ADVISE

[derek cairns]

Hi All

Does anyone have a link to download winrar that doesn't have INTERVALHEHEHE on it as I need to download this
who invented INTERVALHEHEHE There laughing at MEEEEEEEE

[jody in philly]

Intervalhehehe

I picked this up a few days ago and I've run every scan, and virus detector known to man. I could use some serious help here before I put my foot through my computer!!
Thanks

[green_sat]

Clear the host file

I got the same bstd* thing, and the only way I manage to get some restbite was to clear the host file
c:/system32/windows/drivers/etc/hosts
Delete everything in this hosts file.
Enter the entry below and save and all should be ok
127.0.0.1. localhost

You might still have to download superantispyware and do a complete scan to remove any other traces. All shoulld be ok.

Sorry the above is for XP it's a similar fix for Vista.
But with Vista yo will have to do a bit messing about as it dosn't allow you to change the hosts file.

[jasbo7]

had this last week and system restore to a couple of days ago worked fine on xp

[koter002]

Thank you green-Sat for the valuable advise. I had the same bloody Intervalehehe last week when I downloaded WINRAR. I have window XP system. I have deleted the host file you have advised but I do not know how to save entry 127.0.0.1 localhost. Any advise?
Other site defenately to avoid is 7 ZIP.

[green_sat]

Saving hosts file

Hi,
Just enter the line on the first line and save using file>save.

I.e click on the option file and save as you would save a word file.
and hopfully all should be ok.

[Spectrum]

Gave up

I tried many different things to get rid of it. As i am not an expert i gave up and gave it to the professionals to fix.


Paul

[jody in philly]

I REMOVED IT!

I was able to remove this virus by cleaning out my host file. Below is the link to the instructions for how I did it. Don't worry, no virus here!!

http://www.precisesecurity.com/tools-resources/threat-removal-procedure/clean-windows-hosts-file/:champions:

[karlos32]

Intervalhehehe

Hi

I had the same virus its a real pain to get rid of. I am running windows vista, within it there is an antispyware package called windows defender. First you need to activate this. if you are runnin on XP then type into google superantispyware. This should take you to a site were you can download for free. Run this software and it should kill the main program it runs from. Then do the system restore. You will find that when you try and go back into the internet it wont be able to find anything, and come up with an error. Please then re run either windows defender or superantispyware, this should kill it once and for all. Restart your system and google etc should come back.

Hope this helps

[lebob]

Thank you green-Sat for the valuable advise. I had the same bloody Intervalehehe last week when I downloaded WINRAR. I have window XP system. I have deleted the host file you have advised but I do not know how to save entry 127.0.0.1 localhost. Any advise?
Other site defenately to avoid is 7 ZIP.

What's wrong with 7-Zip ? I use it all the time, never had a problem.