yeah, this virus (security 2012 and ping.exe) is new enough that you can't just do this alone: you need to post on one of those special websites for help.
or you can just reinstall, of course.

At this rate it seems like it would be faster to start over.

Your desire is understandable but you're probably overestimating anti-virus tools. You can never be sure that your computer has been fully cleaned after such a heavy infection.
Ask any expert and he'll tell you that formatting the harddrive is the recommended procedure to kill viruses.

Partitioning into a small C: drive and the rest for a data drive D: makes this much more convenient, especially when you can use the transfer settings feature of Windows without reinfecting yourself.

Friend got the same virus, along with ping.exe

I was able to beat it just by googling the things that came up. I'm surprised you haven't...

Yeah, since you know the name of it, it should be pretty straight forward. The instructions I came across didn't look like much, just deleting a few registry entries and a few files.

Ohey I saw this one once.

ping.exe is constantly created by some other process ..but I forgot what it was. I just remember all the internet tabs would close and some retarded "Anti-virus" window would appear randomly.
I did the malware removal guide in the sticky topic after I was manually deleting .exes. Stuff stopped breaking and working badly, so I assume it worked. (I reformatted after). (First virus that I'm aware I've encountered in a looong time.)

Oh, also with programs running as themselves I just did open with and selected itself.

Post has been edited 1 time(s), last time on Jan 12 2012, 10:21 pm by FaRTy1billion.

I don't think you're on the right website for virus help. Try going to this website here. The people on here are pros at this kinda stuff and have helped me numerous times with my computer issues in the past. The help is free and all you need is an account for the help forums, and a few tools that they use to gauge the virus's attributes, spread, and the best way to remove it. Gl.

I actually had to deal with the virus a few weeks ago - it's surprisingly insidious yet also quite easy to get rid of. If you know anything about computers, do the following:

The virus controls your program execution by overwriting the registry executor keys for .exe files. Use any method to access a terminal (safe mode with command prompt if necessary), and then do the following

>cd %LocalAppData%

Here, you should notice two things. There will be some executable you don't recognize, named xyz.exe where xyz is a random 3-character string (this will match a process running named xyz.exe), and a folder called longstring (some really long random string). Briefly memorize these strings so you can pick them out.

(note: I use cygwin, so you might need to switch to dos commands)

>rm xyz.exe
>rm longstring
>cd %CommonAppData%
>rm longstring
>cd %Temp%
>rm longstring
>cd %UserProfile%/Templates
>rm longstring

This is all the places the virus has written itself to your computer. Now, to fix the registry, remove the following keys, if they look infected:

HKEY_CURRENT_USER\Software\Classes\.exe "(Default)" = 'ah'
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%LocalAppData%\<random 3 chars>.exe" -a "%1" %*
HKEY_CLASSES_ROOT\ah
HKEY_CURRENT_USER\Software\Classes\ah "(Default)" = 'Application'
HKEY_CURRENT_USER\Software\Classes\ah "Content Type" = 'application/x-msdownload'
HKEY_CURRENT_USER\Software\Classes\ah\DefaultIcon "(Default)" = '%1'
HKEY_CURRENT_USER\Software\Classes\ah\shell\open\command "(Default)" = "%LocalAppData%\<random 3 chars>.exe" -a "%1" %*
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = "%LocalAppData%\<random 3 chars>.exe" -a "%1" %*
HKEY_CLASSES_ROOT\ah\shell\open\command "(Default)" = "%LocalAppData%\<random 3 chars>.exe" -a "%1" %*
HKEY_CLASSES_ROOT\ah\shell\open\command "IsolatedCommand"

Repair the registry with the following correct key copy (I attached it).

If you don't know what I am talking about, try finding someone to help you.

Attachments: