Hello, dear readers of my blog! Today's conversation will be about a non-working search engine, and more specifically, the question sounds like this: Yandex writes OH..., what should I do? As usual, I will tell you about several problems that may be associated with this and cause this behavior in the Russian search engine.
Probably the most important advice. If you are asked enter your phone number or sendSMS, then in no case don't do this. Attackers are just waiting for users who do not understand the essence of the problem itself. Thus, you personally send money to their wallets.
Follow all the recommendations one by one; some users abuse reading between the lines of articles, thereby missing the necessary information to resolve this issue. We're done with the water part, now let's get down to business.
Firstly. Many users think that this problem appears when there is some kind of problem with the Internet. They run to check the light bulbs on the router or go into the system settings to make sure that the Internet still reaches their computer or laptop. They carefully look at the connectors where the wires are connected, thinking that there are bad contacts and try to reconnect them again.
And the most stubborn users call the provider and complain about the services. The cases described above are not fictitious and in fact are pure truth. But the Internet has nothing to do with it when your browser says OH when you access Yandex. To make sure that you have Internet access, go to any website. Have you come in? As you understand, this is not the problem!
If you urgently need to find some information on the Internet and are used to using the Yandex search engine, you can enter a verification code, thereby “telling” Yandex that you are not a bot. Although this method does not solve the problem, you can still find urgent information.
Note: entering the captcha is shown in the picture above.
I'm done with a little introduction. Now let's start solving this problem.
Viruses
The very first thing you need to do when receiving an OP message is to scan your computer for viruses.
To remove the virus, we will use the popular AVZ program. It does not require installation, although before opening the program, turn off or deactivate the standard antivirus on your computer for a while. Download the program. After downloading, run the avz.exe file.
After opening the program, click on the icon on the right to automatically update.
Wait a while for the program to download all updates. If an error appears, select a different source for updating. To do this, click on the tab in the upper right part of the program and select another site.
It is possible that you cannot update because you are using an old version of the program. Therefore, I strongly recommend downloading a more recent version.
When the program is updated, a message about this operation will appear. Click "OK".
Before you start checking for viruses, you also need to make some pre-settings for the program.
1. You must indicate where you are going to scan for viruses with this program. To do this, check the boxes for all local drives.
Go to the "File Types" tab.
Also go to the “Search Options” tab and set the settings, as shown in the screenshot below.
Now we are ready to scan the computer for viruses. Click the Start button.
You can go have some tea while your computer is checked. After checking, restart your computer and try logging into Yandex.
If this antivirus did not find viruses on you, but you suspect that you still have them, then I can also recommend the very effective Dr.Web Cureit program. This utility is also free, like AVZ, but from other developers. It does not require any technical knowledge and also does not require installation. If there are any viruses on your computer in the future, you can use it to detect them.
Changed hosts file
We have to make changes to the hosts file, you've probably heard about it before. For those who are not in the know, this file contains the settings for website domain names. Thus, let's take, for example, the same Yandex. We can write a website, for example Yandex, and opposite it an IP address that will not lead to the Yandex website, but, let’s say, to the website of the attackers. After this, by going to Yandex.ru in the address bar of the browser, we will be taken to the site whose IP was specified in the hosts file.
Accordingly, there are programs that modify this file as they need, these are viruses, one of which probably came to you. There are many programs with which you can edit this file and do it as it was by default, and also do everything manually.
I talked about a program that modifies the hosts file and further protects it (according to the developer) in one of my articles. You can read more about this program in the article: "".
Of course, it’s best and fastest (if you know how) to do everything yourself, that is, with your own hands. We go the following way: “Local drive C” (or any other on which Windows is installed) - “Windows” - “System32” - “drivers” - “etc”. Right-click on the file, select “Open”, then look for the “Notepad” program, double-click and you’re done!
We delete all lines at the beginning that are missing the symbol # (this means that this line is a comment and is not executed by the system).
In order for you to understand what I want to say, look at the image below:
After making the changes, of course, do not forget to save this file. After which Yandex will stop writing “Oh!”, and will suggest you to look for something on the Internet, which is what it is actually obliged to do. For novice users, I recommend using the Reset Hosts program for editing, since some users may find the manual method difficult and, of course, there will be some fear that you can ruin the system, but in fact there is no need to worry.
If you find viruses on your computer, then you should consider installing an antivirus. It's only because of one virus that you spent so much time.
Browser extensions
If you are creating websites or are involved in similar activities, then most likely you have various extensions installed. For example, Rds Bar or similar ones. In this situation, disable or remove (if installed and do not use them) these extensions. What is the connection, you ask? If any extension constantly requests, for example, Yandex statistics, then it may think that you are a bot and are doing this on purpose.
Let's look at an example of disabling extensions in the Google Chrome browser. Click on the 3 horizontal lines at the top right of the browser. Then, in the drop-down list, hover your mouse over “Tools”, and then click “Extensions”.
In the settings page that opens, find the trash can on the right - if you want to remove the extension, if you need to turn it off, then simply uncheck the “Enabled” checkbox.
And that's all for today.
After wandering around the Internet a little in search of the problem, I found a video where they suggested installing the CharlesProxy program. Watch the video to see how to use it:
If you are faced with the fact that Yandex does not work, and instead of displaying the standard page it says “ Oops... Requests coming from your address seem to be automatic” and asks you to enter a phone number in order to continue the search - first of all, do not believe it: this is just another way for scammers to get your money by using malicious software.
In this article we will look at how to get rid of this message and return to a normal Yandex page.
What is this and why does Yandex write this way?
First of all, the page you see is not a Yandex website at all, it just uses the same design to mislead you. Those. The essence of the virus is that when you request popular sites (in our case, Yandex), it does not display a real page, but transfers you to a fake phishing site. Something similar happens when Odnoklassniki and other social networks do not open and you are also asked to send an SMS or enter your phone number.
Requests coming from your IP address appear to be automatic
How to fix the Oy page on Yandex
Now let’s talk about how to fix this situation and remove the virus.
So, if Yandex writes Oops, then we do the following:
1. Launch the registry editor by clicking the buttons Win+R and enter the command regedit.
2. Open the registry key
Quote
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
3. Pay attention to the parameter AppInit_DLLs and its meaning - right-click on it, select “ Change", remove the path to the DLL specified there. Note the location of the file so you can delete it later.
4. Open Windows Task Scheduler and look at the active tasks in the scheduler library - among others, an item should appear there that launches some exe file with the same location as the library in AppInit_DLLs. Delete this task.
5. Restart your computer, preferably in safe mode.
6. Remove two files in the virus location - the DLL and the Exe file from the job.
After this, you can restart your computer in normal mode and, most likely, if you try to open Yandex in a browser, it will open successfully.
Another way is to use the AVZ antivirus utility
This option, in general, repeats the previous one, but perhaps it will be more convenient and understandable for someone. To do this, we will need the free antivirus utility AVZ, which can be downloaded for free from here:
After downloading, unpack it from the archive, run it, and in the main menu click " File» - « System Research" After that, click the button Start", you do not need to change any settings (the only thing is that you will need to indicate where to save the report).
In the final report, after research, find the section “ Autostart" and find the DLL file whose description says
Quote
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows,AppInit_DLLs.
I wanted to install a broken FTP client and got myself a virus. The virus put me in a panic, as all my pages on social networks were hacked. An inscription appeared on vk.com:
"We detected suspicious activity and temporarily froze your page to take it out of the hands of attackers." When trying to restore access to the pages, no SMS was sent to the phone. There was a question about what to do if you don’t receive an SMS. There, an id number of some kind is issued, which needs to be sent to a short number. I sent it. Nothing. Sent it to the second number listed. Nothing. In general, I realized that something was wrong, I logged in from another computer and everything went smoothly. In the end, I sent two SMSs, and they charged me 300 rubles. The first thing I did was call Megafon and leave a request for a refund and verification of these short numbers. The second thing was to log into all accounts from another computer and change the passwords. The third thing I did was go to Yandex to start Googling how to remove this virus. Yandex was also replaced by this:
"Oh... We're sorry, but the requests coming from your IP address seem to be automated. For this reason, we are forced to temporarily block access to search.
To continue your search, please enter your phone number in the input field and click "Submit". "
The same thing happened with Google:
Thank God, the completely worthless Rambler at least worked.
Attempts to remove the virus:
1.
I started the treatment by scanning the system with my Microsoft Security Essentials antivirus
This is a free antivirus from Microsoft.
Download here: http://windows.microsoft.com/ru-ru/windows/security-essentials-download
He found nothing.
2.
I looked in startup and searched for the virus manually in
C:\Documents and Settings\Administrator\Application Data
C:\Documents and Settings\Administrator\Local Settings\
C:\Documents and Settings\Administrator\Local Settings\Application Data
There was nothing
3.
I cleared the entire system with all cookies and caches in all browsers using CCleaner.
The program is very good, it cleans out a lot of unnecessary junk from the computer. I've been using it for 10 years now.
Download here: http://www.piriform.com/ccleaner (free)
Did not help
4.
Then I manually deleted all the entries in the registry through a search where the name of the program that I installed and which caused the virus was found.
Start->Run->regedit
The combination Cntrl+F searches
Did not help.
5.
Then I scanned the system with Ad-Aware from Lavasoft.
A good program for searching for any kind of malware (http://ru.wikipedia.org/wiki/Malware).
The program is old, not sure if it is supported yet.
She found some dangerous crap, deleted it, rebooted it, it didn’t help.
6.
I downloaded a free utility from Dr.Web - drwebcureit.
I scanned it and found two jambs. The first is that my hosts file has been changed, but I changed it myself and everything is correct there, there were no new entries or a hidden file. Secondly, this utility complained about Multi Password Recovery, this is the program I need and I know that it wasn’t the one that hacked it all, since I’ve been using it for half a year now and everything was fine.
That is, drwebcureit didn’t help either.
7.
I downloaded the avz program and scanned the computer, the program corrected something, rebooted, it didn’t help.
8.
Then I read it here http://pc-polzovatel.ru/internet/oj-v-yandeks-poiske.html
that you need to check the boxes in avz in a certain way in order to get the result.
Scanned again. I flipped through the resulting report and saw that I had some kind of crap sitting in my
C:\Documents and Settings\All Users\Application Data\Mozilla
there was an executable file that none of the antiviruses deleted and the rafypfm.dll file
I deleted the exe file, rafypfm.dll could not be deleted, but I erased its extension and rebooted.
Voila it worked! Everything is fixed! I deleted the rafypfm.dll file after a reboot and created a hidden folder of the same name with the same name, this is done so that the file is not overwritten here again, a virus file with the same name cannot be overwritten over the hidden folder.
I spent about 3.5 hours fixing it.
Outcome/solution: You can’t trust anyone who asks you to send an SMS! All serious companies send SMS messages to your phone, VKontakte for example. I solved my problem using the avz program, in the report after scanning I saw where the malicious files were and deleted them manually. Theoretically, if I had searched better when trying to find viruses manually, I might not have had to poke around for so long.
Here are some other options for how to deal with the situation:
http://mdex-nn.ru/page/trojan-redirector.html
http://mdex-nn.ru/page/kak-razvodjat-na-dengi-v-socsetjah.html
http://pc-polzovatel.ru/internet/oj-v-yandeks-poiske.html
P.S. The virus pretends that you have been blocked not only on VKontakte, Yandex and Google, but also on Odnoklassniki, Facebook and Skype.
I dug through a bunch of different videos, forums and articles and put in my personal experience to find a solution.
If my post helped you, you can buy me a beer)
__________________________________
Tags for search engines: Vkontakte, VKontakte, vk.com, banned, closed, access, Yandex, yandex, closed, banned, virus, antivirus, what to do, solution, problem, issue, Odnoklassniki, Facebook, Skype, Trojan, sms, social
If you are faced with the fact that Yandex does not work, and instead of displaying a standard page it writes “Oh... Requests received from your address look like automatic ones” and asks you to enter a phone number in order to continue the search - first of all, do not believe it: this Just another way for scammers to get your money by using malicious software.
In this article we will look at how to get rid of this message and return to a normal Yandex page.
What is this and why does Yandex write this way?
First of all, the page you see is not a Yandex website at all, it just uses the same design to mislead you. Those. The essence of the virus is that when you request popular sites (in our case, Yandex), it does not display a real page, but transfers you to a fake phishing site. Something similar happens when Odnoklassniki and other social networks do not open and you are also asked to send an SMS or enter your phone number.
Requests coming from your IP address appear to be automatic
How to fix the Oy page on Yandex
Now let’s talk about how to fix this situation and remove the virus.
So, if Yandex writes Oops, then we do the following:
After this, you can restart your computer in normal mode and, most likely, if you try to open Yandex in a browser, it will open successfully.
Another way is to use the AVZ antivirus utility
This option, in general, repeats the previous one, but perhaps it will be more convenient and understandable for someone. To do this, we need the free anti-virus utility AVZ, which can be downloaded for free from here: http://z-oleg.com/secur/avz/download.php
After downloading, unpack it from the archive, run it, and in the main menu click “File” - “System Research”. After this, click the “Start” button; you do not need to change any settings (the only thing you will need to specify is where to save the report).
In the final report, after research, find the “Startup” section and find the DLL file whose description says HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\WindowsAppInit_DLLs. From this point you should remember (copy) the file name.
Then look for “Scheduler Jobs” in the report and find the exe file, which is located in the same folder as the DLL from the previous paragraph.
After that, in AVZ select “File” - “Run script” and run the script with the following content:
Begin DeleteFile("path to the DLL from the first paragraph"); DeleteFile("path to EXE from the second point"); ExecuteSysClean; RebootWindows(true); end.
After executing this script, the computer will automatically reboot and the “Oops” message will no longer appear when Yandex is launched.
Now a new virus has appeared on the Internet, which disguises itself as a standard Yandex request, asks you to enter a code and confirm its reality. The same thing happens when you enter your mail, the Odnoklassniki website in Contacts, etc. If you have suffered from this virus, then this article is for you!
If you received this message from the Yandex search engine:
Oh…
We're sorry, but the requests coming from your IP address appear to be automated. For this reason, we are forced to temporarily block access to search.
To continue the search, please enter the characters from the image in the input field and click “Submit”.
You need to enter only a digital code, as indicated in the Yandex instructions (for Yandex it consists only of numbers). This message is a common standard check that proves that you are a human and not a robot trying to spam the search engine.
All browsers (Opera can work fine) display this message when you try to log into Yandex, your mail, the Odnoklassniki website, VKontakte, etc.
I can’t log into social networks.
If you receive a message asking you to send an SMS, Do not send it under any circumstances! Yandex never asks for your phone number, much less sends you SMS.
Don't send SMS They will take a lot of money from you, but there will be no result, because this message has nothing to do with Yandex.
More likely, you have a virus, I strongly recommend checking your computer with an antivirus. Myself "Yandex" gives the following instructions in this regard:
I recommend using Kaspersky antivirus, it has free versions for 1 month if you download it from the official Kaspersky Lab website and a free version of the antivirus for 6 months if you download the Yandex version.
Download Kaspersky antivirus for free for 1 month, official website:
http://www.kaspersky.ru/trials
Download Kaspersky anti-virus for free for 6 months, Yandex version:
http://kaspersky.yandex.ru/
If checking with an antivirus does not help, I suggest the following methods:
METHOD #1 - edit the hosts file
C:\WINDOWS\system32\drivers\etc\hosts- check this document (open with notepad), if there is mention of VKontakte (vkontakte.ru, vk.com) or any other lines - delete everything and leave only: 127.0.0.1 localhost
METHOD No. 2 - remove malware.
It also happens that when entering the VKontakte website, it is blocked by malware. These programs need to be removed. Go to Start -> Search -> Files and folders -> Additional options -> Check all the boxes (search in system files, hidden files, etc.) and look for files svc.exe, vk.exe and vkontakte.exe. If you find it, delete it.
METHOD #3 - check the registry
Your computer is infected with a virus that has edited the registry. Incorrectly modifying the registry may disrupt the operation of your system.
To get rid of the virus, follow these steps:
1. Start - Run - regedit.exe
2. In the window that appears, select the path -
\HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
3. In the Parameters tab on the right side of the window, a menu with the file name will appear,
its type and meaning. Select DataBasePath and right click on it
mouse button, select Edit. Replace the value with
%SystemRoot%\System32\drivers\etc
If you have the same value, then you do not need to replace it and it is necessary
check file contents hosts from "Method No. 1".
METHOD No. 4 - using the AVZ utility
If the previous 3 methods did not help, try the following. Download the latest free antivirus utility AVZ from the official website http://z-oleg.com/secur/avz/download.php, run.
METHOD No. 5 - removing browsers
For Windows 7
Boot the operating system in safe mode, go to the folder c:\program data\mozilla\ and delete the exe file and dll file.
After a reboot, search engines should work in all browsers.
For Windows XP
It's more difficult in XP. First, remove all browsers from your computer through the “uninstall programs” menu. Boot the computer from the LIVE CD on the disk, select “boot operating system”.
Go to the folder c:\program files\mozilla\ and delete exe file And dll file.
The disk contains registry cleaning utilities, for example CCleaner. Start it up and clean it.
After reboot, install the browser.
Everything should work like new! (Personally, this method helped me)
How to boot Windows in Safe Mode?
- restart your PC;
- When booting/rebooting the PC, press quickly many times F8 immediately when you turn on the computer and before the operating system boots (if the Boot Device selection window appears, select the hard drive on which the operating system is installed (usually C), click Enter, then again F8 until it appears Menu);
- V Menu For more Windows boot options, use the arrow keys to select Safe mode.
ATTENTION. In all cases you must:
- after all that has been done, check your computer for viruses, run registry cleaning utilities;
- change passwords from a mailbox, in Odnoklassniki, VKontakte, etc.;
- You must be administrator on your computer.
Reinstalling the system is the most extreme measure to combat the virus! Our task is to find and neutralize the virus!
Main! Don't send any SMS! Look for viruses! Good luck!
A. Zotov, Volgograd region.
You can discuss virus problems on our
P O P U L A R N O E:
As practice has shown, information today is not cheap, especially confidential information. Nowadays, it is hardly possible to surprise anyone with wiretapping. There are more and more ways to listen; we will list the main methods that are actively used in our time.
Loading...
