How to remove goingonearth virus from windows 7 published 24th July 2011 by Steve.

Despite scanning a file I had received, without issue, I knew something was wrong  within seconds of opening it. The file itself disappeared from the my folder view and my system went into a ‘Microsoft minutes’ moment. I pulled up taskmanger via right clicking on the taskbar and ended as many non-essential processes as I could identify. I tasked an on boot scan and left the machine to it.

Couple of hours later… on boot scan completed I spot immediately that that security centre is disabled and security essentials isn’t able to start – without thinking I start to google ‘starting security centre’ and find I am redirected to goingonearth.com search results (with a blank webpage).

System OS – very high level view

  • Windows 7 64bit – patched up to date.
  • Microsoft Security Essentials – fully updated.
  • Windows firewall.

Symptoms -

  • No security
  • No windows updates
  • No System Restore
  • browser redirection to goingonearth.com
  • sluggish system

Having tried various goingonearth fixes and many, many scans using goingonearth removal tools and the usual anti-malware  products, each time finding that on reboot I was back to square one – with exactly the same symptoms; very frustrating.

My fix how I removed goingonearth -

  • Run, with administrator privileges, Combofix. Removes an exe file from C:\Windows
  • Run a full scan with Malwarebytes, which removed objects with a FakeAlert theme from the following areas -
    4 – Registry Keys
    1 – Registry Values
    5 – Files Infected
  • Having rebooted, don’t be disheartened that you still have no security open services.msc and look for ‘Security Center’ – right click -> properties -> Startup type = Automatic -> Apply -> OK
  • Perform an update of Microsoft Security Essentials (just download and install in situ)
  • Reboot again.

By this point Robert should be your mothers brother.

Popularity: 100%

WordPress logout error published 2nd July 2011 by Steve.

The connection to the server was reset while the page was loading

You have most likely arrived here suffering from the WordPress affliction - ‘The Connection Was Reset - The connection to the server was reset while the page was loading.’ The main thing here is the connection has been reset.

fatcow hosting customers jump over here.

Modify php.ini for the folder/or site.

  1. Set the max script execution time to 90 seconds. ( It was 300 ).
  2. Set the php memory limit to 128m. ( It was 32m )
  3. Verified that the session.save_path was accurate. This may involve some interaction with your  hosting provider.
  4. Enabled (true) zlib.output_compression

The fatcow.com hosted process

  1. Log into your FatCow control panel and click “Scripting and Add-Ons” from the main menu.
  2. Click “CGI and Scripted Language Support”.
  3. Click “PHP Scripting”.
  4. Near the bottom of the page you will see an area highlighted in orange saying “Edit your php.ini file for PHP”
  5. Copy the entire text from the PHP.ini file into a blank text file so I had a handy backup.
  6. Paste that same text into Notepad++ which is a handy free code editor
  7. Change line 244 to: max_execution_time = 90
  8. Change line 246 to: memory_limit = 128M
  9. Verify that line 881 was in the format: session.save_path = /home/users/web/YOURBOX/moo.YOURSITE/cgi-bin/tmp
  10. Finally, change line 126 to: zlib.output_compression = On

Thanks to squishy79 who did the leg work only to have the resource squirrelled away.

Popularity: 41%