As far as I understood, the address opened by this infection is changing (it was 2inf.net, it became smartinf.ru, then Funday24.RU) and it is possible that after a while after writing this manual, the address will be new. In any case, the method of deletion, I think, will be saved up to date and, in which case I will update this article. The problem may occur with any browser - Google Chrome, Yandex, Mozilla Firefox or Opera and in any OS - Windows 10, 8.1 and Windows 7. And, in general, it does not depend on them.
Update 2016: Instead of SmartInf.ru now, users began to open the same site FUNDAY24.RU. The essence of the removal is the same. As the first of the steps I recommend the following. See which site is incremented in the browser before redirecting on Funday24.ru (you can see it if you turn on the computer with the Internet disabled, for example). Run the registry editor (Win + R keys, enter the REGEDIT), after which you select "Computer" on the left side at the top, and then in the Edit menu. Enter the name of this site (without www, http, just site.ru) and click "Find". Where there is - delete, then press the Edit menu again - find further. And so, until you delete the sites, redirecting on Funday24.ru throughout the registry.
For the final removal of Funday24.ru, it may be necessary to re-create browsers: removing them from the taskbar and desktop, creating from folders with browsers in Program Files (x86) or Program Files, and this should not be .bat file, and .exe file browser. In files with the extension .Bat is also prescribed to start these sites. Additional, more detailed information, including with solutions proposed by readers - hereinafter.
Steps to remove Funday24.ru or SmartInf.ru
So, if you start FUNDAY24.RU (SmartInf.ru) immediately after logging into your standard browser, then to get rid of it, you should start with the launch of the Windows registry editor.
To launch the registry editor, you can press the Windows keys (with the emblem) + R on the keyboard, enter in the "Run" regedit window and press ENTER.
In the left part of the registry editor, you will see "folders" - registry sections. Open HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run and look at the right side.
If you saw there (in the "value" column):
- CMD / C START + Any address of the site (there will be no smartinf.ru there, but another site, redirecting to it, such as manlucky.ru, simsimotkroysia.ru, bearblack.ru, etc.) - Remember this address (write) After that, right-click on the same line, but in the "Name" column and select Delete.
- The path to the EXE files starting with C: \ users \ user_name \ APPDATA \ LOCAL \ TEMP At the same time, the file name is strange (set of letters and numbers), remember the location and name of the file or write it down (copy it to the text document) and, , as in the previous case, delete this value from the registry.
Attention: If you did not find a similar item in the specified registry section, then in the Editor menu, select Edit - search and find CMD / C START - what is found, it is it, only elsewhere. The remaining actions remain the same.
Update: Recently, Funday24 and Smartinf is prescribed not only through CMD, but also in other ways (through Explorer). Solution Options:
- From the comments: When the browser is started, quickly press ESC, look at the address bar, from which site is being redirected to SmartInf.ru, search in the registry by site name. (You can also try using the back button in the browser).
- Disable the Internet and see which page is trying to open in the browser, search in the registry by site name.
- Survey in the registry according to the word HTTP - results there are many, find out which redirection perform (just entering the address in the browser, usually these are domains .ru), work with them.
- Check the START Page parameter value in the HKEY_CURRENT_USER \ Software \ Microsoft Registry section \ Internet Explorer \ Main
- Find the UTM_SOURCE phrase in the registry - then delete the value containing the address of the site, after which UTM_Source goes. Repeat the search until you find all the entries in the registry. If this item is not found, try simply to find UTM_ (judging by the comments, other options appeared, but also begin with these letters, for example, UTM_CONTENT).
Do not close the registry editor (you can minimize, it will be required at the end), and go to the task manager (in Windows 8 and Windows 10 through the menu called Win + X keys, and in Windows 7 via Ctrl + Alt + Del).
In Windows 7 Task Manager, open "Processes", in Windows 8 and 10, click "More" below and select the "Details" tab.
After that, in order, follow these steps:
- Find the names of the files that you remember in the second paragraph with the previous action.
- Click on this file with the right mouse button, select Open File Location.
- Without closing the open folder, return to the Task Manager, click on the process again and select "Remove the task".
- After the file disappears from the processes list, delete it from the folder.
- Do it for all such files if there are several of them. The contents of the AppData \ Local \ Temp folder can be deleted completely, it is not dangerous.
Close Task Manager. And run the Windows job scheduler (the control panel in which the viewing mode is turned on in the form of icons - Administration - Task Scheduler).
In the task scheduler, select Left "Job Planner Library" and pay attention to the task list (see Screenshot). Under it, select the "Action" tab and go through all tasks. You must confuse those that are performed every hour or at the input system, we carry either strange names, or Nethost Task, and in whose "Action" field specifies the launch of the program in the folders C: \ Users \ Username \ APPDATA \ LOCAL ( and its subfolders).
Remember what file and in which location is started in this task, click on the right mouse button and delete it (changes are made to the registry, as a result of which you have Funday24.ru or SmartInf.ru).
After that, go to the folder with the specified file and remove it from there (by default, these folders are usually hidden, so turn on the display of hidden files and folders or enter their address manually at the top of the conductor, if not clear how, look at the end of the instructions in the video) .
Also, if in C: \ Users \ user_name \ appData \ Local You see the folders with the names of Systemdir, "enter the Internet", "Search on the Internet" - boldly remove them.
Last steps left to finally remove SmartInf.ru from the computer. Remember, we did not cover the registry editor? Return to it and on the left pane, select the top item "Computer".
After that, in the main registry editor menu, select "Edit" - "Search" and enter a part of the site name, which we remembered at the very beginning, enter it without http and text after the point (RU, NET, etc.). When you find any registry values (those on the right) or partitions (folders) with such names, delete them using the context menu on the right mouse click and click F3 to continue the search for the registry. Just in case, look for SmartInf in the registry.
After all such items have been deleted, close the registry editor.
Note: Why do I recommend this order of action? Is it possible at the very beginning to find sites in the registry, which are redirected to smartinf.ru, etc.? Just according to my estimates, the specified order of steps minimizes the likelihood that during the removal of the virus you will work with a computer in the task scheduler and the specified records will appear in the registry again (and you will not notice, and simply write that the instruction does not work).
Update from comments, for browser Mozilla Firefox:- The infection is evolving, now by all other things if everything described above needs to check for: C: \ users \ your name \ APPDATA \ Roaming \ Mozilla \ Firefox \ Profiles \ 39BMZQBB.Default (maybe another name) File with the name of the User type. JS (Extension should be JS)
- It will be a JS code like: User_Pref ("browser.startup.homepage", "orbevod.ru/?utm_source=startpage03&utm_content=13dd7a8326acd84a9379b6d992b4089c"); user_pref ("browser.startup.page", 1);
Boldly delete this file, the task is to slip your left start page.
Return a normal start page in the browser
It remains to remove the SmartInf.ru page from the browser, because with a high probability she remained there. To do this, I recommend first to simply remove shortcuts to your browser from the taskbar and from the desktop, then click right-click on the empty desktop location - create a shortcut and specify the path to the browser (usually, somewhere in the Program Files folder).
You can also click on the existing browser label with the right button and select the "Properties" item and if in the tab "Label" in the Object field you will see any characters and Internet addresses after the path to the browser, remove them from there and apply changes.
Well, finally, you can run your browser and change the settings of the starting page in its settings, more they should not change without your knowledge.
Additionally, it may make sense to check the computer for malicious according to one of the ways described in the article how to get rid of advertising in the browser.
Video: How to get rid of Funday24.ru and SmartInf.ru
Well, now the video in which in order is shown all the actions that were described in the instructions. Perhaps so it's easier for you to remove this virus so that no sites open without your knowledge in the browser.
I hope I could help you. In my opinion, I did not forget any nuances. Please, if you have our own ways to remove Funday24.ru and SmartInf.ru, share them in the comments may be able to help many.