In this post I will tell you how to get rid of the virus "Yandex oh"... This is a kind of continuation of the good old banners and social network blockers - Classmates, In contact with and Mail.ru. Yandex Oy virus, as you might have guessed, is related to the search engine Yandex.... Its meaning is that it blocks the main page. Yandex. and replaces it with its own, where, in the Yandex style, the message is displayed: We are very sorry, but the requests received from your IP address look like automatic ones. But the main thing is that you need to enter a phone number.
Attention! Do not enter the number under any circumstances! This is cheating and cheating
.
Now I will tell you how what to do if you are visited by a virus Yandex Oy and how to remove or get rid of it.
Removing the Yandex virus Oops or what to do if Yandex writes Oops!
Well, I'll start with the fact that the official name of the virus " Yandex Oy ", then on which it passes in the bases - Trojan.Majachok.
Step 1. Checking the system with antivirus software.
Yes, you should start by checking your system with special utilities. DrWeb CureIt! and Kaspersky Virus Removal Tools... This passive antivirus scanners
and they are quite simple to download and run, since they do not require installation on the system. Of course, before starting them, you must disable the existing antivirus (well, of course, if you have it installed at all).
— DrWeb CureIt!- link .
Be sure to check the system drive, usually C: \
,
completely, since the virus can be not only in the system catalogs, but also have copies in other folders.
After checking with antiviruses, restart your computer and check access to Yandex.
Step 2. Remove the Yandex Oy virus through the registry editor.
We use this method only if if it didn't help Step 1.
Selecting a menu item Start >> Execute... Or press the key combination Win + R.
In the Run window, write the command regedit and press the button OK.
In the opened registry editor, open the branch:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Windows
In it we find the parameter "AppInit_DLLs"... We click on it and look at the file to which it refers. This is the Yandex Oy virus.... Remember the folder in which the virus is located and its name.
Delete the parameter value and set the value instead «=»
or leave it blank altogether.
Close the registry editor, go to the folder where the virus is located and remove it.
We reboot the computer.
Yandex search can be blocked if many simultaneous requests are received from the same IP address. In this case, the search queries of programs and people are difficult to distinguish. For example, if several people use a Yandex service from devices connected to the Internet from the same IP address. In this case, Yandex perceives all these users as one and displays a captcha - a character recognition test.
Captcha example:
How can someone else access the network from my IP address?
Requests coming from your IP address are not necessarily sent from your device. Internet service providers sometimes combine several subscribers under one IP address.
If you are connected to a public network, for example, in a cafe and access the Internet via Wi-Fi, then you have the same IP address with everyone using the same Wi-Fi hotspot.
Your computer can also be infected with a virus that sends automatic requests. We advise you to check the system with the anti-virus utility CureIt! by Dr.Web or the Virus Removal Tool of Kaspersky Lab.
How to return to the search if I am shown a captcha?
To return to the search page, enter the characters that you see in the captcha image and click the Submit button.
To update the captcha picture, click the icon.
Instead of symbols from the picture, you can enter numbers from the sound captcha. To do this, click the icon → Pronounce and listen to the message.
Attention. Yandex asks only for characters from the picture and never asks for a phone number, send an SMS or re-enter your username and password. If you are faced with similar requirements, you have ended up on a fake page. Let us know about this via the feedback form.
If the characters are entered correctly, Yandex will remember your browser as a verified one for a long time (provided that cookies are permanently stored in your browser).
If you need to make automatic requests to Yandex, use the Yandex.XML service.
I can't see the captcha picture, what should I do?
Check if image loading is enabled in your browser.
If you see the Yandex logo, but do not see a picture with symbols, check if any browser plugins or firewall settings are blocking the download.
If you encounter this problem at work, contact your network administrator.
Error 403. What to do?
Error 403 means that access to Yandex services is denied. This happens when an automated program (bot) tries to bypass captcha and makes too many concurrent requests from dedicated IP addresses or through open proxy services. Sometimes bots can use IP addresses that belong to living people. In this case, access to services is also blocked.
If you encounter such an error, please use the feedback form at the end of this page. The specialist will consider the complaint and unblock the IP address ahead of schedule if the requests to the services came from a person, and not from an automatic program.
If you are faced with the fact that Yandex does not work, and instead of displaying a standard page, it writes "Oh ... Requests received from your address look like automatic" and asks to enter a phone number in order to continue the search - first of all, do not believe it: this just another way for scammers to get your money by using malicious software.
In this article, we'll look at how to get rid of this message and return the normal Yandex.
What is it and why does Yandex write this way?
First of all, the page you see is not a Yandex site at all, it just uses the same design to mislead you. Those. The essence of the virus is that when you request popular sites (in our case, Yandex), it does not display a real page, but transfers you to a fake phishing site. Something similar happens when classmates and other social networks do not open and you are also asked to send an SMS or enter your phone number.
Requests from your IP address look like automatic
How to fix the Oy page on Yandex
And now how to fix this situation and remove the virus.
So, if Yandex writes Oh, then we do the following:
After that, you can restart your computer in normal mode and, most likely, if you try to open Yandex in your browser, it will open successfully.
Another way is with the AVZ antivirus utility
This option, in general, repeats the previous one, but, perhaps, it will be more convenient and understandable for someone. To do this, we need a free antivirus utility AVZ, which can be downloaded for free from here: http://z-oleg.com/secur/avz/download.php
After downloading, unpack it from the archive, run it, and in the main menu, click "File" - "Investigation of the system". After that, click the "Start" button, you do not need to change any settings (the only thing you need to specify is where to save the report).
In the final report, after research, find the "Autostart" section and find the DLL file, the description of which says HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft \WindowsNT \CurrentVersion \Windows,AppInit_DLLs. From this point you should remember (copy) the file name.
Then look in the "Scheduler Tasks" report and find the exe file, which is located in the same folder as the DLL from the previous paragraph.
After that, in AVZ select "File" - "Run script" and run the script with the following content:
Begin DeleteFile ("path to the DLL from the first item"); DeleteFile ("path to EXE from the second point"); ExecuteSysClean; RebootWindows (true); end.
After executing this script, the computer will automatically reboot and the "Oops" message will no longer appear when Yandex starts.
Hello dear readers of my blog! Today's conversation will focus on a non-working search engine, and more specifically, the question sounds like this: Yandex writes OH ... what to do? As usual, I will tell you about several problems that can be associated with this and cause this behavior in the Russian search engine.
Probably the most important advice. If you are asked enter your phone or sendSMS, then in no case don't do it... Attackers are just waiting for users who do not understand the essence of the problem itself. Thus, you personally send money to their wallets.
Follow all the recommendations in turn, some users abuse the reading of articles between the lines, thereby skipping the necessary information to resolve this issue. We are done with the water part, now let's get down to business.
Firstly. Many users think that this problem appears when there is some kind of snag with the Internet. They run to check the light bulbs on the router or go into the system settings to make sure that the Internet still comes to them on a computer or laptop. They carefully look at the connectors where the wires are connected, thinking that there are bad contacts and try to reconnect them again.
And the most stubborn users call the provider and complain about the services. The cases described above are not fictional and, in fact, are the pure truth. But the Internet has nothing to do, when your browser, when entering Yandex, says OUTS. To make sure that you have the Internet, go to any site. Are you here? As you understand, then this is not the problem!
If you urgently need to find some information on the Internet and are used to using the Yandex search engine, you can enter the verification code, thereby "telling" Yandex that you are not a bot. Although this method does not solve the problem, you can still find urgent information.
Note: Captcha input is shown in the picture above.
I'm done with a little introduction. Now let's get down to solving this problem.
Viruses
The very first thing that needs to be done when you report OUCH, you should check your computer for viruses.
To remove the virus, we will use the popular AVZ program. It does not require installation, although before opening the program, turn off or deactivate the standard antivirus on your computer for a while. Download the program. After downloading, run the avz.exe file.
After opening the program, click on the icon on the right to automatically update.
Wait a while while the program downloads all updates. If an error appears, please select a different update source. To do this, click on the tab at the top right of the program and select another site.
It is possible that the update does not work because you are using an old version of the program. Therefore, I highly recommend downloading a more recent version.
When the program is updated, a message about this operation will appear. Click "OK".
Before you start checking for viruses, you must also make some pre-settings for the program.
1. It is necessary to indicate where you are going to check for viruses with this program. To do this, check the boxes for all local drives.
Go to the "File Types" tab.
Also go to the "Search parameters" tab and set the settings, as shown in the screenshot below.
Now we are ready to scan your computer for viruses. Click the Start button.
You can go have tea while your computer is being checked. After checking, restart your computer and try to go to Yandex.
If this antivirus did not find viruses on you, but you suspect that you still have them, then I can also recommend the very effective program Dr.Web Cureit. This utility is also free, like AVZ, but from other developers. It does not require any technical knowledge and, moreover, does not require installation. If in the future there are some viruses on your computer, you can use it to detect them.
Modified hosts file
We have to make changes to the hosts file, for sure you have heard about it before. For those who are not in the know, this file contains the settings for the domain names of the sites. Thus, let's take, for example, the same Yandex. We can write a site, for example Yandex, and opposite it an IP address, which will not lead to the Yandex site, but will allow the attackers to visit the site. After that, going to Yandex.ru in the address bar of the browser, we will get to the site, the IP of which was specified in the hosts file.
Accordingly, there are programs that modify this file as they need, these are viruses, one of which probably got to you. There are many programs with which you can edit this file and make it as it was by default, as well as make everything with pens.
I talked about a program that changes the hosts file and further protects it (according to the developer) in one of my articles. You can read more about this program in the article: "".
Of course, it is best and faster (if you know how) to do everything yourself, that is, with your own hands. We go the following way: "Local drive C" (or any other on which Windows is installed) - "Windows" - "System32" - "drivers" - "etc". Right-click on the file, select "Open", then look for the "Notepad" program, double-click and you're done!
We delete all lines at the beginning, which are missing the symbol # (this indicates that this line is a comment and is not executed by the system).
In order for you to understand what I want to say, look at the image below:
After the changes made, naturally, do not forget to save this file. After that, Yandex will stop writing "Oh!", And will offer you to search for something on the Internet, which in fact he is obliged to do. For novice users, I recommend using the Reset Hosts program for editing, since for some users the manual method may seem difficult and, of course, there will be some fear that you can spoil the system, but in fact there is no need to worry.
If you find viruses on your computer, then you should think about installing an antivirus. It is only because of one virus you have wasted so much time.
Browser extensions
If you are engaged in the creation of sites or with a similar type of activity, then most likely you have various extensions installed. For example, Rds Bar or similar. In this situation, disable or uninstall (if installed and do not use them) these extensions. Ask what is the connection? If an extension constantly requests, for example, Yandex statistics, it may think that you are a bot and you are doing this on purpose.
Let's take a look at an example of disabling extensions in the Google Chrome browser. Click on the 3 horizontal lines at the top of the browser on the right. After that, in the drop-down list, move the mouse pointer "Tools", and then click "Extensions".
In the settings page that opens, find the basket on the right - if you want to remove the extension, if you need to disable it, just uncheck the Enabled box.
And that's all for today.
After wandering around the Internet a little in search of a problem, I found a video where they suggest installing the CharlesProxy program. How to use it, see the video:
If you are faced with the fact that Yandex does not work, and instead of displaying the standard page, writes “ Oops ... Requests from your address look like automatic"And asks you to enter your phone number in order to continue the search - first of all, do not believe it: this is just another way for scammers to get your money by using malicious software.
In this article, we'll look at how to get rid of this message and return the normal Yandex.
What is it and why does Yandex write this way?
First of all, the page you see is not a Yandex site at all, it just uses the same design to mislead you. Those. The essence of the virus is that when you request popular sites (in our case, Yandex), it does not display a real page, but transfers you to a fake phishing site. Something similar happens when classmates and other social networks do not open and you are also asked to send an SMS or enter your phone number.
Requests from your IP address look like automatic
How to fix the Oy page on Yandex
And now how to fix this situation and remove the virus.
So, if Yandex writes Oh, then we do the following:
1. Start the registry editor by clicking the buttons Win + R and enter the command regedit.
2. Open the registry branch
Quote
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Windows
3. Pay attention to the parameter AppInit_DLLs and its value - right-click on it, select “ Change", Remove the path to the DLL specified there. Remember the location of the file so you can delete it later.
4. Open up Windows Task Scheduler and view the active tasks in the scheduler library - among others, an item should appear there that launches some exe file with the same location as the library in AppInit_DLLs... Delete this job.
5. Restart your computer, preferably in Safe Mode.
6. Remove the two files in the virus location - the DLL and the Exe file from the job.
After that, you can restart your computer in normal mode and, most likely, if you try to open Yandex in your browser, it will open successfully.
Another way is with the AVZ antivirus utility
This option, in general, repeats the previous one, but, perhaps, it will be more convenient and understandable for someone. To do this, we need a free antivirus utility AVZ, which can be downloaded for free from here:
After downloading, unpack it from the archive, run it, and in the main menu, click “ File» - « System investigation". Then press the button " Start», You do not need to change any settings (the only thing you need to specify is where to save the report).
In the final report, after research, find the section “ Autostart"And find the DLL file, the description of which says
Quote
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Windows, AppInit_DLLs.
