|
HideMyPornoExe
|
Darren
darren@thegym.net
06/22/03
|
I had a Mirc virus which I got rid of. Now whenever I reboot, I get the Error pop up "HideMyPornoExe" file can't be found.
I think there is something in the regisrty that needs to come out but I have no idea where to start to clean it out.
|
Diego
diegot@valuedguest.com
06/27/03
|
I get the same problem.
Any help would be nice
|
Tommy
intrnaldsk@yahoo.com
07/14/03
|
I have the same problem too. This program does not show up on an antivirus, but it does have a program, kill.exe is in my F:\WINNT\system32\os2\vmn32 folder. In this folder contains the files
282.reg
-see fig. 1
445.txt
-A list of IP addresses and port 445
924.reg
-see fig. 1 (same as 282.reg)
abc.dll
-I don't know. looks like a program
adobes.exe
-The startup program
attrib.exe
-no idea
kill.exe
-I dont even want to know
moo.dll
-i dont know (made in Visual C++)
msgld.exe
-dont know
psexec.exe
-dont know
pwn.bat
-Lets you know that it is a virus (fig. 3)
Figure 1 (282.reg)
-
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeA"="F:\\WINNT\\system32\\os2\\vmn32\\adobes.exe"
-
Figure 2 (924.reg)
:
@echo off
c:
cd c:\
del test0r.exe
:
test0r.exe is exactly how a "haxor" would type it up. I will attempt to make a way to fix it, but I do not know how wel it will work.
|
Tommy
intrnaldsk@yahoo.com
07/14/03
|
I HAVE THE SOLUTION!
Just go to http://idkprogs.calc.org/Downloads/Windows/Virii/fix/fix.reg and download "fix.reg" which will change the registry key [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeA"="", causing the program to not come up when you start your computer. Another way to see if you have the virus is to monitor your system's startup. If HideMyPornoExe or kill.exe is coming up, then you have the virus.
If anyone is interested in researching the virus more than I have done, feel free to download my vmn32 folder at http://idkprogs.calc.org/Downloads/Windows/Virii/fix/vmn32.zip
|
Donna
07/14/03
|
You might also want to download Spybot Search and Destroy. Update it once it is installed and run a scan. This should help you. Donna
http://spybot.eon.net.au/index.php?lang=en&page=download
|
Douglas
douglas@pralistic.com
08/05/03
|
OK. so I copied and pasted Tommy's recommended site to fix this virus but I'm forwarded to a webhosting site. Does anybody have any idea how I can get the"hidemyporn.exe" off my computer?
|
lucky
08/13/03
|
I too getting same problem. I copied and pasted tommy's site but its going to webhosting site. Tommy can u help me to get rid of hidemyporne.exe
|
Paul
08/20/03
|
Hi, Tommy's solution does work.
What you have to do is go to:
http://idkprogs.calc.org/Downloads
Then click on "windows/"
Then click "virii/"
Then "fix/"
And finally "fix.reg"
This will download the necessary file which you will then need to run.
Good luck.
Paul.
|
Chris
croberts@strunklp.com
08/26/03
|
I tried this fix and it worked just fine. Thanks for the help!!
|
x
09/19/03
|
hey, i am using a shared computer in a work environment here, and in that same dir (winnt\system32\vmn32) there isnt the hidemyporn virus, but there's actual porn... and i am wondering if the virus may have put it there or if that is just a coincidence between where this virus hides and where there is actually porn. any help here would be nice
|
Tommy
intrnaldsk@yahoo.com
10/08/03
|
Wow, I didn't know if anyone would actually use my fix :) Well, x, I think that it is just a couincidence, OR that could be one of the features of the HideMyPornoExe virus. I did not track the stages of the virus, because i do not know where it origionated. Another thing that i have found is a file called "test0r.exe" or something like that in %WINDIR%\System32 I think.
by the way, I messed up on the hyperlink, sorry. The registry patch is at http://idkprogs.calc.org/downloads/Windows/Virii/fix/fix.reg
|
Jon
10/15/03
|
Worked for me also. BTW, good idea to delete the releated c:\Winnt\system32\fonts folder also. NOT the C:\WinNT\Fonts! That is the real one. The C:\WinNT\System32\Fonts is the fake.
Thanks for leading me in the right direction Tommy.
|
Stephanie
romeoskitten@hotmail.com
10/26/03
|
Thank you sooo MUCH Tommy and Paul. It worked for me great, however, i have one question. Why does the mIRC status window still appear at my startup when I have delete all related mIRC files from my comp? Please help. Thank you!!
|
Robin
xygirl39@yahoo.com
10/30/03
|
I tried the fix and it didn't work ... I also have the spybot program and that doesn't clear it either ... HELP!!!
|
Tommy
intrnaldsk@yahoo.com
11/07/03
|
This is a wierd virus, because it isn't detected by anything yet. Mabey it will soon be detected and we will be completely rid of this. i am still trying to find out where this origionated. On mIRC, I usually go to quakenet to talk with people that I know and trust, and I also go to mIRCX for #InvaderZIM I think it was.
|
dndln
11/16/03
|
I had the same problem and fixed it by going to Start, Run menu, typed in Regedit,
then selected
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Run
and deleted AdobeA
Thanx!!
|
ipifi6
12/28/03
|
Hi!, hey guys I tried the "fix.reg" thing but it didnt work. I think its because my PC doesnt have the vmn32 folder ot file in the WINNT folder. Please help!!!
thanx a lot!
|
