applehebi

[frustrated]

OMG! I got it too! after downloading winrar from an ad on download.com
I tried everything you guys have posted, including running malwarebytes in
safe, mode but I still can't use google or facebook or anything like
that...is rebooting my only option?

 

[Veronika]

Someone should tell "Download.com", that's where I got it from also.
After I run all those virus scans etc in save mode, I deleted one too many
files and was not able to use my mail.
I ended-up just running windows restore and all is well for me. Why don't
you try it?? (Repair Windows using System Restore - Under "back-up and
restore"

Good luck.
Veronika

 

[Ryan]

Jesus Christ forums freaking suck.

 

[LissyJT]

As previous poster said, get rid of it.
Install, update and scan with the 2 programs listed below.
Scan in Safe Mode, if necessary.

'The home of Spybot-S&D!' (http://www.spybot.info/en/index.html)

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware Program.
Download, install, update, and immunize your System with it.
Then SCAN with it.
Update it, and scan your System once a fortnight.

'Malwarebytes.org' (http://www.malwarebytes.org/mbam.php)

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download from
Download.com, or Major Geeks.com

Download, install, and update.

Important Safe Mode
If you happen to find a problem that you can’t uninstall / delete,
reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and use U
arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with your Anti-Virus, Malwarebytes and Spybot S
D
while in Safe Mode.

--
Mad Mike


:
-
I don't know where else to ask, but suddenly I got this box appearin
on my
screen with "applehebi" on it! I rebooted my vista desktop and now i
shows
"blocked start up programs".
I never installed any applehebi and I cannot indicate that I want t
remove
it from the start up.
this is what is shows in the description:
applehebi

File Name: explore.exe
Display Name: applehebi
Description: Not Available
Publisher: applehebi Install
Digitally Signed By: NOT SIGNED
File Type: Application
Startup Value: C:\Windows\system32\explore.exe
File Path: C:\Windows\system32\explore.exe
File Size: 61440
File Version: 1.00
Date Installed: 07/11/2008 12:27:54 PM
Startup Type: Registry: Local Machine
Location: Software\Microsoft\Windows\CurrentVersion\Run
Classification: Not yet classified
Ships with Operating System: No
SpyNet Voting: In Progress

What it is??

-

So any idea how to delete the system32 file? I tried to delete it an
got the message: You need permission to perform this action.......not
sure why as I am the only user and my user acct is set as
administrator.

 

[Snidley W.]

So any idea how to delete the system32 file? I tried to delete it and
got the message: You need permission to perform this action.......not
sure why as I am the only user and my user acct is set as
administrator.

Because your "administrator" account doesn't have FULL admin
priviliges.

You could first try to delete the file while in Safe Mode.

If that doesn't work, then enable the hidden Administrator account:

Open a command window (with admin privileges).

Type (without quotes) "net user administrator /active:yes"

Logout and you should see that account available.

Log back in with it and give it a whirl.

 

[Ryan Metroka]

So it's me again and I fixed this stupid spyware virus once and for all! Do as the previous posters said and delete the explore file from your hard drive and run malwarebytes and spybot snd in safe mode (it also helps to slick start, run, type in reg edit. In the edit tab click find and type applehebi. It will find an icon titled applehebi. Delete this). THEN reboot your computer in normal mode and open spybot snd. Click view mode on the top and run it in advanced mode. It will prompt you just click yes. On the left pane you will now see a "tools" option. Click on it. From there click on host files. This will bring up a list of URL's and their host addresses. Find a site you can not get on to due to the virus (if you can't, open an internet browser and type one in, and then refresh your hosts list). Delete all the sites on this list with the same address as the site you can't access (because they are all affected the same way) by holding CTRL and clicking on all of them, then click on the remove from list option. This fixes the problem totally. If you run firefox, you will have to clear your private data and it will work!!

SWEET!

 

[NewTech]

As I posted very early yesterday morning with the fix. The only thing you
need is malwarebytes running in safe mode of course and it will find and
delete the trojan including the registry entries. Re-boot and then run your
hijackthis program and delete all of the host files with the ip
204.16.197.121.

I was working on my system @ 2 or 3 in the morning. Went through all post
about this applehebi and found nothing. Found no one even mentioned these
host files. Until.......

 

[NewTech]

No I don't think so, It re-directed and highjacked the most popular sites
people go to like your google, face-book, etc. to get you to click and their
so called virus scanner. Don't know what would have happened had you clicked

 

[ashlin86]

Hullo, I would just like to vouch that Ryan Metroka's solution does, in fact, work. One of my friends accidentally downloaded a bum version of winrar that came with this delightful little surprise in it. (We have decided, as a matter of fact, to heretofore refer to Very Annoying People as "Applehebis")


I went down the forums and tried everything everyone said--nothing worked, or part of it worked, but then when I did the other thing the previous problem came back. Oy ve. Anyway, I finally got to Ryan's post and did everything in that exact order!!!! and it took care of the problem.

So there you go. Thanks ever so Ryan Matroka--if I knew where to find you I'd kiss you.