How to Remove a Host Block Virus

The Host Block Virus can keep you from visiting anti-virus websites.

The Host Block Virus, also known as Win32/Hostblock and Win32/Qhost, is a fake anti-virus program. The Host Block Virus notifies you that your computer is infected with a virus and then attempts to procure your financial information under the guise of removing the virus. The Host Block Virus is particularly dangerous because it makes changes to the hosts file in order to prevent you from visiting certain sites, such as virus removal sites.

Instructions

End Infected Processes

1. Press the three-key command \"Ctrl,\" \"Alt\" and \"Delete.\"

2. Click on the \"Task Manager.\"

3. Click on the \"Processes\" tab.

4. End the below processes. To end a process, simply right-click on it and select \"End Process.\"<br /><br />\"ProgramFiles\\[RANDOM NAME]\\rhccv9j0e1b1.exe\"<br />\"ProgramFiles\\[RANDOM NAME]\\Uninstall.exe\"<br />\"System\\[RANDOM NAME].exe\"

Delete Infected DLL Files

1. Click on the \"Start\" menu.

2. Click on \"Run.\"

3. Type \"cmd\" into the open box and click \"OK.\" The command prompt will open.

4. Type the following into the command prompt window. Be sure to press \"Enter\" after every line. <br /><br />\"regsvr32 /u MFC71.dll\"<br />\"regsvr32 /u MFC71ENU.dll\"<br />\"regsvr32 /u msvcp71.dll\"<br />\"regsvr32 /u msvcr71.dll\"<br />\"regsvr32 /u rhccv9j0e1b1.dll\"

Delete Infected Registry Values

1. Click on the \"Start\" menu.

2. Click on \"Run.\"

3. Type \"regedit\" into the open box and click \"OK.\" The registry editor will open.

4. Locate the following registry values in the left pane of the registry editor and delete them. To delete a registry value, right-click on it and select \"Delete.\" <br /><br />\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\[RANDOM NAME]” = C:\\Program Files\\[RANDOM NAME]\\[RANDOM NAME].exe”<br />\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform\\AntivirXP08 = AntivirXP08?<br />\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\[RANDOM NAME]\" <br />\"HKEY_LOCAL_MACHINE\\SOFTWARE\\[RANDOM NAME]\" \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\[RANDOM NAME]\"

Delete Infected Files

1. Click on the \"Start\" menu.

2. Click on \"Search Files and Folders.\"

3. Search for and delete the below files. To delete a file, simply right-click on it and select \"Delete.\"<br /><br />\"UserProfile\\Application Data\\Microsoft\\Internet Explorer\\Quick Launch\\Antivirus XP 2008.lnk\"<br />\"C:\\Documents and Settings\\All Users\\Desktop\\Antivirus XP 2008.lnk\"<br />\"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Antivirus XP2008\\Antivirus XP 2008.lnk\"<br />\"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Antivirus XP 2008\\How to Register Antivirus XP 2008.lnk\"<br />\"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Antivirus XP 2008\\License Agreement.lnk\"<br />\"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Antivirus XP 2008\\Register Antivirus XP 2008.lnk\"<br />\"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Antivirus XP 2008\\Uninstall.lnk\"<br />\"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Antivirus XP 2008.lnk\" ProgramFiles\\[RANDOM NAME]\\database.dat\"<br />\"ProgramFiles\\[RANDOM NAME]\\license.txt\"

Delete Infected Directories

1. Click on the \"Start\" menu.

2. Click on \"Run.\"

3. Type \"cmd\" into the open box and click \"OK.\" The command prompt will open.

4. Type the below entries at the command prompt. Be sure to press \"Enter\" after every line. <br /><br />\"rmdir program_files\\antivirusxp2008\"<br />\"rmdir UserProfile\\Application Data\\[RANDOM NAME]\"

References

• CA World: Win32/Hostblock
• FasterPCCleanClean: How to Remove Win32/Qhost