Applehebi

1. Download Malwarebytes’ Anti-Malware (mbam-setup.exe) and save it on your Desktop.
2. After downloading, double-click on mbam-setup.exe to install the application.
3. Follow the prompts and install as “default” only
4. Before the installation completes, check on the following prompts:
- Update Malwarebytes’ Anti-Malware
- Launch Malwarebytes’ Anti-Malware
5. Click “Finish.” Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
6. Scan your computer thoroughly.
7. When scanning is finished click on the “Show Results”
8. Make sure that all detected threats are marked, click on Remove Selected.
9. Restart your computer.

Note: Applehebi may prevent mbam-setup.exe from downloading and running. You can download and rename this program from a different computer before running it on infected system.

This does not fix the browser hijack and you will still be unable to use the internet properly! most browsers will be redirected to fake web pages which instruct you to pay and download a fake antivirus program DO NOT DO THIS!
First click START the RUN and type ‘regedit’ then click EDIT and SEARCH for ‘Applehebi’ you will see one entry with this title DELETE THIS.
To remove the browser hijack problem you need to download ‘Hijackthis’ from trend micro ‘http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis’ just copy this link into your address bar.
Then when you run it you will see a huge amount of websites which all have the same ip address, check the boxes next to all these ip addresses and click FIX on hijackthis, this should delete them and alow your browser to function properly……i have learned all this the hard way! Good luck!

Malwarebytes’ Anti-Malware

I removed winrar from pc and installed above it ran a test free I could not believe it removed all my problems including applehebi i will definitly be looking into buying this program.WHEN SCANNING USE THE QUICK SCAN it worked for me
john

ok that worked but when i try to connect to the internet i get a fake microsoft security site. How do u get rid of that

Simple fix for this…. All you have to do is go to c:windows\system 32\explore

in this folder find the item named “explore”. Mine looked like a WinRar file. Select it and check the properties it will say applehebi. If so it is the right item just deleted and your problem is fixed……. Has not happened to me since….

explore.exe can’t be deleted on my computer. Please advise

That happened to me too, and it can’t be deleted. I’ve seen on other sites people saying that once they restart their computer they can’t get onto websites anymore, which sounds like a virus we recently had. I don’t know what to do!

I had the virus and removed it using hi-jack. it’ll lock the explore so you cant remove it, but when you run hi-jack it’ll release the lock and you’ll be able to remove it. thanks for the help adeptus

most of those methods work but by the way if you are waiting for the check just click another window so as not to close the popup and it wont keep appearing

I still get the fake Microsoft antivirus site. and i did just about everything you guys said to do. i uninstalled winrar, i got malware and hijack, and i deleted the winrar file explorer. and i still cant get onto google.

If you can’t delete the explore.exe rename it to whatever you want. If the applehebi appears again just close it and cannot find file pop-up will appear. Go back to your renamed file, you can delete it now. Hope this helps.

Ok, I deleted the .exe and the popups stopped, but I still couldn’t get onto certain websites. This is EXACTLY what I did to fix it, and it worked!

1. Click Start, and click Run.
2. If your computer is running Windows 95, Windows 98, or Windows ME:
In the Open field, type: notepad %windir%\hosts
If your computer is running a Windows NT-based operating system, such as Windows 2000 or Windows XP:
In the Open field, type: notepad\drivers\etc\hosts
– for example, on Windows 2000:
In the Open field, type: notepad C:\WINNT\system32\drivers\etc\hosts
– or on Windows XP:
In the Open field, type: notepad C:\Windows\system32\drivers\etc\hosts
You have to open it in notepad.
3. Delete all text in the HOSTS file.
4. On the first line of the HOSTS file, type: 127.0.0.1 localhost
At this point the HOSTS file contains nothing but this one line of text.
5. Save the file to the same location you opened it from.
6. Close Notepad.

I got those directions from here: http://www.microsoft.com/security/portal/Entry.aspx?name=SettingsModifier%3aWin32%2fPossibleHostsFileHijack&threatid=1758608427027806866

i went to c:windows\system 32 and i couldn’t find explore anywhere..also i tried resaved the hosts file with only 127.0.0.1 localhost and it is still not working..please help!!!

ive just tried adeptus’s method of getting rid of the applehebi, and so far so good, i can now get back on to facebook without any problem, thanks adeptus…