Problems with click.vnn.bz

[Beanbag]

Hi and thanks for viewing my thread.
My friend sent me a game which he downloaded from this site called click.vnn.bz or something like that, and whenever I type a URL into the search box the new URL comes up with a click.vnn.bz prefix and redirects me to some vietnamese site.

I've run AVG AntiSpyware, ComboFix and HJT, and I'd be really grateful if anyone could help me. The logs are as .txt files attachments. Thanks.

 

[howard_hopkinso]

Hello and welcome to Techspot.

Run HJT with no other programmes open. Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O16 - DPF: {7606693A-C18D-4567-AF85-6194FF70761E} (GomWeb Control) - http://app.ipop.co.kr/gom/GomWeb.cab

O16 - DPF: {C946EF6D-296D-4907-A6E1-ED0E8E5AF024} (LycosMail Upload Control) - http://mail.lycos.com/hanmail-ax/AttachMail.cab

Click on the fix checked button.

Close HJT.

1. Download the attached file (.txt file)
2. Save it on your desktop
3. rename the file-extension from .txt to .reg
4. Double-click the file
5. Agree when it asks you whether you want to add the registry keys.
6. Restart your computer.

Then, run the Ccleaner programme as per step9 of the instructions HERE.

Let me know if you`re still having problems.

Regards Howard :wave: :wave:

This thread is for the use of Beanbag only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Beanbag]

Thanks a lot, but I've found an easier solution that worked.
First, I uninstalled the game Chicken Invaders 3 which my friend had downloaded from the site and sent me.
Then, I went into regedit, My Computer>Click Edit on top menu, select Find from drop down. Type in click.vnn.bz and click Find Next. Delete all the registry entries you find and keep searching for more till you have deleted all of them.
This 2 are the main entries causing the problem, but just delete all the entries that come up.

HKEY_Local_Machine\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix

HKEY_Local_Machine\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes

Thanks, Howard, for your time.

 

[howard_hopkinso]

Ok, thanks for your feedback.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of Beanbag only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.