Computer Geeks, Help me get rid of http://osguardpro.microsoft.com/block.php?r=8.1 [Archive]

View Full Version : Computer Geeks, Help me get rid of http://osguardpro.microsoft.com/block.php?r=8.1

331TwistedWedge

10-16-2009, 08:38 PM

i need help getting rid of this stupid ass website ... i cant use my computer without it coming up every 10 seconds ... i just switched to zoom town, not sure why this is happening ...

http://osguardpro.microsoft.com/block.php?r=8.1

dont click on the link, you may catch what i have????

331TwistedWedge

10-16-2009, 09:05 PM

Help!

Waffles

10-16-2009, 10:28 PM

lol... I have a botnet that might be able to get rid of the website.

Waffles

10-16-2009, 10:41 PM

I'm not infected so I haven't tried this. I could infect a virtual machine and give the fix a try but not until tomorrow. Can't hurt to give this a try tho.

How to remove Osguardpro.com hijacker manually:

To perform manual removal of Osguardpro.com menace, you should do the following:

Delete Osguardpro.com hijacker corrupt files:

•%Documents and settings%\user\Application Data\Microsoft\Internet Explorer\olesys.dll
•%ProgramFiles%\System guard 2009\conf.cfg
•%ProgramFiles%\System guard 2009\mbase.vdb
•%ProgramFiles%\System guard 2009\quarantine.vdb
•%ProgramFiles%\System guard 2009\queue.vdb
•%ProgramFiles%\System guard 2009\systemguard.exe
•%ProgramFiles%\System guard 2009\uninstall.exe
•%ProgramFiles%\System guard 2009\vbase.vdb
•%Windows%\reged.exe
•%Windows%\spoolsystem.exe
•%Windows%\sys.com
•%Windows%\syscert.exe
•%Windows%\sysexplorer.exe
•%Windows%\vmreg.dll
Remove Osguardpro.com registry entries:

•HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr entVersion\Run\”systemguard” = “%Program Files%\System guard 2009\systemguard.exe”
•HKEY_CURRENT_USER\Software\System guard
•HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cur rentVersion\Uninstall\System guard 2009

You should also check your hosts file, make sure there's no references in it to that site etc. The hosts file was intended to be used like a local DNS database back before name services were common on local networks. However, they can be used to redirect traffic intended for one place to a different place.

331TwistedWedge

10-16-2009, 11:06 PM

i dont understand what im suppose to do with this info??? ... computer literate, but not a software guru ...

where do i go to insert that info?

331TwistedWedge

10-16-2009, 11:10 PM

so i can right click on start, go to program files? ... kind of guide me here ...

thanks for the post ... this is a pita and its hard to browse the internet, with this website popping up every 5 seconds ...

331TwistedWedge

10-16-2009, 11:28 PM

i found these files and deleted them ...

•%ProgramFiles%\System guard 2009\conf.cfg
•%ProgramFiles%\System guard 2009\mbase.vdb
•%ProgramFiles%\System guard 2009\quarantine.vdb
•%ProgramFiles%\System guard 2009\queue.vdb
•%ProgramFiles%\System guard 2009\systemguard.exe
•%ProgramFiles%\System guard 2009\uninstall.exe
•%ProgramFiles%\System guard 2009\vbase.vdb

i still have it ... cant kill it for shit ...

331TwistedWedge

10-16-2009, 11:38 PM

i looked here:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr entVersion\Run\”systemguard” = “%Program Files%\System guard 2009\systemguard.exe”
•HKEY_CURRENT_USER\Software\System guard
•HKEY_LOCAL_MACHINE\Software\Microsoft\Window s\Cur rentVersion\Uninstall\System guard 2009

found nothing ... im learning something though :bigthumb ... i may be a bit more savy than i thought ... i was an excel / word guru at one time :lol:

any other thoughts, its still here ...

nsaniti

10-16-2009, 11:55 PM

lol get nod32 ... should help a bit.

and hardcore i got a pretty nasty botnet too, ddos time? :D

331TwistedWedge

10-17-2009, 12:11 AM

can i download it free? ... cant seem to find a free link ... 30 day trials and wanting credit card numbers ~ not happening ...

331TwistedWedge

10-17-2009, 07:43 PM

bump ... help me, my computer is sick :lol:

i may have to take this laptop somewhere ... but who is affordable?

Goldenpony

10-17-2009, 08:16 PM

DR Micro. Best in the city

8016 Beechmont Ave.

481-4335

;)

331TwistedWedge

10-18-2009, 12:51 AM

im fixed!!!! ... i feel like i can conquer the world now :lol: ... a huge thanks to redfirepearlgt for analysing the issue ... malware ... i found some free software online and downloaded superantispyware ... it wasnt easy, the malware kept kicking the download out ... must have taken 25 or so tries ... definitely was a bigger issue than it appears on paper ...

im thinking about opening up a computer repair/tech/hardware/software/cdrom/ethernet cord center for those of you interested ... :lol: ... im just kidding ~ i havent a clue, but the malware is gone ...

Katmandu

10-21-2009, 04:48 PM

Here's are (2) excellent programs to prevent Viruses, Malware etc...

AVG FREE Anti Virus
http://download.cnet.com/AVG-Anti-Virus-Free-Edition/3000-2239_4-10320142.html

Ad-Ware Free Anti-Malware Program

http://download.cnet.com/Ad-Aware-Free-Anti-Malware/3000-8022_4-10045910.html

PaulFiveOh

10-21-2009, 10:33 PM

Download and install what Katmandu recomended.

Than download ComboFix and run it.
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Also- go start -> run -> type in cmd hit enter -> type in "netsh winsock reset" with out the quotes then hit enter

nsaniti

10-22-2009, 04:06 PM

if you google 'nod32 username and password' you can find some pretty long lasting keys for it.. definitely the best out right now imo.

Dirtyd0g

10-22-2009, 04:23 PM

Spybot SD would have stopped that. Now I suggest google to find how to delete it. Go get spybot on download.com
Alan

redfirepearlgt

10-22-2009, 04:49 PM

PaulFiveOh

10-22-2009, 08:59 PM

You still need to run combofix.

Katmandu

10-24-2009, 02:58 PM

im fixed!!!! ....What did you do to fix it ? :confused: