Help with goingonearth virus please

U

Ulverop

New member
Local time
1:21 AM
Messages
11
So...
Microsoft Standalone System Sweeper search found four threats and fixed them, but the goingonearth is still there... :(

Don't know if it is related, but I've also been getting an error-message from apple everytime I log on my computer (I use iTunes). Is says that sqlite3_wal_checkpoint doesn't work (don't remember the exact message).
 
Last edited by a moderator:

My Computer My Computer

At a glance

Windows 7 64 bit + Windows 7 32 bit
OS
Windows 7 64 bit + Windows 7 32 bit
Hello there.

Download, install & update Malwarebytes & SuperAntiSpyware, then do a full scan with both.
In addition to that, do a thorough scan with your resident AntiVirus. Mark anything found for removal.
 

My Computer My Computer

At a glance

Windows 7 Ultimate x64Intel C2D E8400@4Ghz OC4x2GB Kingston HyperX 8500@1066MhzNvidia GTS450 OC
Computer Manufacturer/Model Number
Custom/DIY
OS
Windows 7 Ultimate x64
CPU
Intel C2D E8400@4Ghz OC
Motherboard
ASUS P5Q-E, bios 2101
Memory
4x2GB Kingston HyperX 8500@1066Mhz
Graphics Card(s)
Nvidia GTS450 OC
Sound Card
Onboard SoundMax
Monitor(s) Displays
Samsung Syncmaster 17"
Screen Resolution
1280x1024
Hard Drives
WD6402AAEX-640GB(system), WD10EALX-1TB(storage), other external disks & docking stations
PSU
Corsair TX-750 V2
Case
Custom Tower
Cooling
Air: Arctic Cooling 2xF8 & F12; Akasa AK-968, 2xAK-HD-BL
Mouse
Gigabyte M6900
Internet Speed
10M/1M
Already tried that. Didn't work...
 

My Computer My Computer

At a glance

Windows 7 64 bit + Windows 7 32 bit
OS
Windows 7 64 bit + Windows 7 32 bit
I have also tried to use both of the above + Spybot, Spyware doctor and Avast in safe mode (in addision to in regular mode). And I have scanned with Avast on startup (before windows starts), but still no cigar.

A friend of mine recomended deleting some dll-files, but I don't want to do that without being certain that I delete the right ones...
 

My Computer My Computer

At a glance

Windows 7 64 bit + Windows 7 32 bit
OS
Windows 7 64 bit + Windows 7 32 bit
Nobody who knows how to fix this?
I miss my desktop... :(
Try to use it as little as possible while it is infected.

I've heard that this thing is not possible to remove by using regular software, but noone seems to know what to do. Have been struggling with this for nearly two weeks now. I am desperate to get a solution that doesn't involve formating and reinstalling...
 

My Computer My Computer

At a glance

Windows 7 64 bit + Windows 7 32 bit
OS
Windows 7 64 bit + Windows 7 32 bit
Ulverop said:
Nobody who knows how to fix this?
I miss my desktop... :(
Try to use it as little as possible while it is infected.

I've heard that this thing is not possible to remove by using regular software, but noone seems to know what to do. Have been struggling with this for nearly two weeks now. I am desperate to get a solution that doesn't involve formating and reinstalling...
Click to expand...

Before u panic try hitman pro, sorry I don't have a link for you, I'm on my phone...

Sent from my Gingerbread on Dream using Tapatalk
 

My Computer My Computer

At a glance

Windows 7 Home Premium 64bitIntel(R) Core i3 CPU M330 @2.13Ghz4GB RAMIntel(R) HD Graphics
Computer Manufacturer/Model Number
HP G62-144DX Notebook PC
OS
Windows 7 Home Premium 64bit
CPU
Intel(R) Core i3 CPU M330 @2.13Ghz
Memory
4GB RAM
Graphics Card(s)
Intel(R) HD Graphics
Screen Resolution
1366 x 768
Hard Drives
500 GB Hitachi HTS725050A9A3644
You could try Norton Power Eraser: Note, you will need an active net connection to use this tool.

Norton Rescue Tools

Because Norton Power Eraser uses aggressive methods to detect threats, there is a risk that it can select some legitimate programs for removal. You should use this tool very carefully.
Click to expand...
If you have a question about a file to be removed this tool will allow you to make a restore point and submit suspicious items for further analysis. A rootkit scan can also be done with this tool.

You may wish to try a boot AV disk

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

Kaspersky has been causing BSOD's as of late, so you may with to give the others a try first.

Here is a link with information about manually removing it:

Goingonearth.com - how to remove

Also, Here is the link to Hitman Pro that MaxPayne suggested:

http://www.surfright.nl/en/hitmanpro
 
Last edited:

My Computer My Computer

At a glance

Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1,...Intel Core 2 Duo 2.93GHzNot much with my ADHDATI Radeon HD 4350
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell Hell oh Well
OS
Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1, Win 10
CPU
Intel Core 2 Duo 2.93GHz
Memory
Not much with my ADHD
Graphics Card(s)
ATI Radeon HD 4350
Monitor(s) Displays
24" HDTV/Monitor
Screen Resolution
Blurry after a Scotch or 2
Hard Drives
1 HDD 250 GB, 1 HDD 1 TB, 3 - 1 TB Externals
Case
Don't get on my case...man :D
Cooling
I have an Air Conditioner & Diet Pepsi
Keyboard
Saitek Cyborg
Mouse
10 yr old MS optical mouse that still works
Internet Speed
Never fast enough
Antivirus
Various
Browser
Various
Hi,

This is a thread about the same threat :

http://www.sevenforums.com/system-security/169370-going-earth-malware.html

Can you explain better what you mean by "it is still there"? Do you mean:

1. Anti-virus products still find it?, or
2. You still get re-directed to their site?

If its the latter, then a flushing of the DNS might be all that is required, but lets see your answers to the questions first.

Regards,
Golden
 

My Computer My Computer

At a glance

Windows 10 Pro x64 ; Xubuntu x64Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz16GB Corsair Vengance DDR3 @ 661 MHz Dual Cha...EVGA NVidia GTX 560 1024MB
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Golden Mk. I.4
OS
Windows 10 Pro x64 ; Xubuntu x64
CPU
Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz
Motherboard
Gigabyte P55A-UD3R Rev.1. Award BIOS F13
Memory
16GB Corsair Vengance DDR3 @ 661 MHz Dual Channel (9-9-9-24)
Graphics Card(s)
EVGA NVidia GTX 560 1024MB
Sound Card
Realtek Integrated
Monitor(s) Displays
Dual Samsung SyncMaster 2494HS
Screen Resolution
1920*1080 and 1920*1080
Hard Drives
1*Samsung 840 EVO 120GB SSD;
1*OCZ Vertex 2 60GB SSD;
2*Samsung F3 SpinPoint 1TB in RAID0;
1*Samsung F1 SpinPoint 1TB;
2*Western Digital 1TB External USB 3.0
1*Western Digital 500GB External USB 3.0
1*Seagate 500GB External USB 2.0
PSU
Thermaltake ToughPower QFan 750W
Case
Thermaltake Element S VK60001W2Z
Cooling
Corsair H60 Water Cooling, 2*230mm and 2*80mm case fans
Keyboard
Logitech G110
Mouse
Logitech MX518
I originally posted my question in the other thread, but as I had other problems to begin with someone made new threads for me. :)

By "is still there" I mean I still get redirected.
I forgot to mention that I also get the error message "activate windows security center". Has been the same since I started getting redirected.

Hitman pro and Norton rescue tools didn't find anything.

About this one, Goingonearth.com - how to remove , do I remove the files in safe mode and in processes? Sorry if I ask stupid questions, but I'm norwegian so I don't understand all the technical references in english. :P


I looked at the dll's listed to remove, but couldn't find any of them on my computer...
 
Last edited:

My Computer My Computer

At a glance

Windows 7 64 bit + Windows 7 32 bit
OS
Windows 7 64 bit + Windows 7 32 bit
Looks like my options are running out...
I now have gone trough every suggested solution again, but I still get redirected and I still get flagged wit the error "activate windows security center".

Giving it a few hours until a full re-installation begins... :(
 

My Computer My Computer

At a glance

Windows 7 64 bit + Windows 7 32 bit
OS
Windows 7 64 bit + Windows 7 32 bit
Hi,

Sorry its taken so long to reply - I was waiting for confirmation from another member, but hadn't heard back then.

Please follow these steps exactly:

1. Open NotePad.
2. Copy & paste the following the new Notepad file, and save the file as flush.bat on your desktop.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

3. Right-click on flush.bat on your desktop, and choose run as administrator. The PC will shut-down. Reboot it, and now try to connect to the internet in the usual way.

Regards,
Golden
 
Last edited:

My Computer My Computer

At a glance

Windows 10 Pro x64 ; Xubuntu x64Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz16GB Corsair Vengance DDR3 @ 661 MHz Dual Cha...EVGA NVidia GTX 560 1024MB
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Golden Mk. I.4
OS
Windows 10 Pro x64 ; Xubuntu x64
CPU
Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz
Motherboard
Gigabyte P55A-UD3R Rev.1. Award BIOS F13
Memory
16GB Corsair Vengance DDR3 @ 661 MHz Dual Channel (9-9-9-24)
Graphics Card(s)
EVGA NVidia GTX 560 1024MB
Sound Card
Realtek Integrated
Monitor(s) Displays
Dual Samsung SyncMaster 2494HS
Screen Resolution
1920*1080 and 1920*1080
Hard Drives
1*Samsung 840 EVO 120GB SSD;
1*OCZ Vertex 2 60GB SSD;
2*Samsung F3 SpinPoint 1TB in RAID0;
1*Samsung F1 SpinPoint 1TB;
2*Western Digital 1TB External USB 3.0
1*Western Digital 500GB External USB 3.0
1*Seagate 500GB External USB 2.0
PSU
Thermaltake ToughPower QFan 750W
Case
Thermaltake Element S VK60001W2Z
Cooling
Corsair H60 Water Cooling, 2*230mm and 2*80mm case fans
Keyboard
Logitech G110
Mouse
Logitech MX518
@soccerfan

Trouble with that solution is that none of the files listed exist on my computer. Not even when I choose to show hidden files...

@Golden

Couldn't get it to work. When I right-clicked it started something in dos, but stopped showing an error message that I can't do that procedure without being connected to internet (it is in norwegian so I don't get the right phrase in english).
 

My Computer My Computer

At a glance

Windows 7 64 bit + Windows 7 32 bit
OS
Windows 7 64 bit + Windows 7 32 bit
Hi,

Were you not connected to the internet when you ran the .BAT file?

Regards,
Golden
 

My Computer My Computer

At a glance

Windows 10 Pro x64 ; Xubuntu x64Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz16GB Corsair Vengance DDR3 @ 661 MHz Dual Cha...EVGA NVidia GTX 560 1024MB
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Golden Mk. I.4
OS
Windows 10 Pro x64 ; Xubuntu x64
CPU
Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz
Motherboard
Gigabyte P55A-UD3R Rev.1. Award BIOS F13
Memory
16GB Corsair Vengance DDR3 @ 661 MHz Dual Channel (9-9-9-24)
Graphics Card(s)
EVGA NVidia GTX 560 1024MB
Sound Card
Realtek Integrated
Monitor(s) Displays
Dual Samsung SyncMaster 2494HS
Screen Resolution
1920*1080 and 1920*1080
Hard Drives
1*Samsung 840 EVO 120GB SSD;
1*OCZ Vertex 2 60GB SSD;
2*Samsung F3 SpinPoint 1TB in RAID0;
1*Samsung F1 SpinPoint 1TB;
2*Western Digital 1TB External USB 3.0
1*Western Digital 500GB External USB 3.0
1*Seagate 500GB External USB 2.0
PSU
Thermaltake ToughPower QFan 750W
Case
Thermaltake Element S VK60001W2Z
Cooling
Corsair H60 Water Cooling, 2*230mm and 2*80mm case fans
Keyboard
Logitech G110
Mouse
Logitech MX518
I tried again and now the computer rebooted.

I then tried a few google searches and goingonearth is still there (still redirects)...
 

My Computer My Computer

At a glance

Windows 7 64 bit + Windows 7 32 bit
OS
Windows 7 64 bit + Windows 7 32 bit
OK. Lets try something different: an on-line scan using ESET's online scanner:

Free ESET Online Antivirus Scanner

Please perform the scan - it will take some time, and then post any results here. In the meantime, I'll ask a security expert to have a look at this thread as soon as they get a chance.

It might also help if you list your current security software setup e.g. Norton, MSE etc.

Regards,
Golden
 

My Computer My Computer

At a glance

Windows 10 Pro x64 ; Xubuntu x64Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz16GB Corsair Vengance DDR3 @ 661 MHz Dual Cha...EVGA NVidia GTX 560 1024MB
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Golden Mk. I.4
OS
Windows 10 Pro x64 ; Xubuntu x64
CPU
Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz
Motherboard
Gigabyte P55A-UD3R Rev.1. Award BIOS F13
Memory
16GB Corsair Vengance DDR3 @ 661 MHz Dual Channel (9-9-9-24)
Graphics Card(s)
EVGA NVidia GTX 560 1024MB
Sound Card
Realtek Integrated
Monitor(s) Displays
Dual Samsung SyncMaster 2494HS
Screen Resolution
1920*1080 and 1920*1080
Hard Drives
1*Samsung 840 EVO 120GB SSD;
1*OCZ Vertex 2 60GB SSD;
2*Samsung F3 SpinPoint 1TB in RAID0;
1*Samsung F1 SpinPoint 1TB;
2*Western Digital 1TB External USB 3.0
1*Western Digital 500GB External USB 3.0
1*Seagate 500GB External USB 2.0
PSU
Thermaltake ToughPower QFan 750W
Case
Thermaltake Element S VK60001W2Z
Cooling
Corsair H60 Water Cooling, 2*230mm and 2*80mm case fans
Keyboard
Logitech G110
Mouse
Logitech MX518
Scan in progress. :)

I am currently using Avast free edition, Spybot search and destroy, Malwarebytes and Superantispyware.
Firefox 5.0.
 

My Computer My Computer

At a glance

Windows 7 64 bit + Windows 7 32 bit
OS
Windows 7 64 bit + Windows 7 32 bit
I found this little item:

Manual removal of Goingonearth.com infection is a difficult task, we recommend you to use our Automatic Spyware removal tool. This is a safe and easy method. [COLOR=#ooooff]Download Goingonearth.com Removal Tool[/COLOR] to automatically remove Goingonearth.com.
Click to expand...
I scanned it with Norton & MSE & They tell me it's clean.

It's at this site which also offers advice to manually remove it:

Uninstall/ Remove Goingonearth.com, Learn How To Remove Goingonearth.com Easily | Killallvirus.com

The files you are looking for may not be showing up for various reasons. Generally I find that using Agent Ransack shows me more files then Windows search shows me, even the hidden ones. You can d/l it here & it's free. I've had a few instances where this utility brought up the files I was looking for while Windows search revealed nothing.

http://mythicsoft.com/page.aspx?type=agentransack&page=home

If the infection is rooted that deeply, you may well want to consider doing a re-install, at least you will know that you have a clean start.
 

My Computer My Computer

At a glance

Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1,...Intel Core 2 Duo 2.93GHzNot much with my ADHDATI Radeon HD 4350
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell Hell oh Well
OS
Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1, Win 10
CPU
Intel Core 2 Duo 2.93GHz
Memory
Not much with my ADHD
Graphics Card(s)
ATI Radeon HD 4350
Monitor(s) Displays
24" HDTV/Monitor
Screen Resolution
Blurry after a Scotch or 2
Hard Drives
1 HDD 250 GB, 1 HDD 1 TB, 3 - 1 TB Externals
Case
Don't get on my case...man :D
Cooling
I have an Air Conditioner & Diet Pepsi
Keyboard
Saitek Cyborg
Mouse
10 yr old MS optical mouse that still works
Internet Speed
Never fast enough
Antivirus
Various
Browser
Various
Hi,

This is probably not the news you want to hear, but having spoken to out security experts, it appears that your best course of action might be a clean install as suggested by Borg.

The consensus appears to be that you have some deeply imbedded bits of the malware in your system that the standard tools are just not capable of tracking down - and you have tried quite a few of these tools.

My suggestion is to bite the bullet, and perform a clean installation (assumming you have a retail Windows 7 DVD):

http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html

Sorry the news couldn't be any better.

Regards,
Golden
 

My Computer My Computer

At a glance

Windows 10 Pro x64 ; Xubuntu x64Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz16GB Corsair Vengance DDR3 @ 661 MHz Dual Cha...EVGA NVidia GTX 560 1024MB
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Golden Mk. I.4
OS
Windows 10 Pro x64 ; Xubuntu x64
CPU
Intel i7 860 @ 2.80 GHz O/C'ed to 4.0GHz
Motherboard
Gigabyte P55A-UD3R Rev.1. Award BIOS F13
Memory
16GB Corsair Vengance DDR3 @ 661 MHz Dual Channel (9-9-9-24)
Graphics Card(s)
EVGA NVidia GTX 560 1024MB
Sound Card
Realtek Integrated
Monitor(s) Displays
Dual Samsung SyncMaster 2494HS
Screen Resolution
1920*1080 and 1920*1080
Hard Drives
1*Samsung 840 EVO 120GB SSD;
1*OCZ Vertex 2 60GB SSD;
2*Samsung F3 SpinPoint 1TB in RAID0;
1*Samsung F1 SpinPoint 1TB;
2*Western Digital 1TB External USB 3.0
1*Western Digital 500GB External USB 3.0
1*Seagate 500GB External USB 2.0
PSU
Thermaltake ToughPower QFan 750W
Case
Thermaltake Element S VK60001W2Z
Cooling
Corsair H60 Water Cooling, 2*230mm and 2*80mm case fans
Keyboard
Logitech G110
Mouse
Logitech MX518
You must log in or register to reply here.

Similar threads

help with bug check codes please!
Replies
4
Views
1K
axe0
A
Need help with constant, random BSOD
Replies
8
Views
1K
willyj73
W
Need Help with getting DAO to work in VBA Project in Excel 2013-64 Bit
Replies
2
Views
4K
HiTechCoach
H
Solved Help With Albireo Virus
2
Replies
34
Views
6K
Callender
Callender
Help with understanding: sfc /scannow results
Replies
1
Views
2K
Megahertz07
Megahertz07
Back
Top