Goingonearth.com is dangerous browser hijacker which will ask much effort when trying to remove it from the PC. Mostly, people enter this domain unwillingly, by being redirected by browser instead of their desired website. If you find yourself on this domain, you should leave it as soon as possible because Goingonearth.com may distribute more other viruses that lead computers into a total mess. This hijacker may follow all your surfing actions and significantly set back your system performance. When removing Goingonearth.com, you will need a good, reputable anti-spyware program because manual removal mostly fails.
G-o-i-n-g-o-n-e-a-r-t-h browser hijacker uses trojans in order to get inside the system undetected and start its activity. It is designed to be capable enough to infect Chrome, Internet Explorer, and Mozilla Firefox browsers by modifying DNS settings. One specific sign of infection are anagrams shown from words Goingonearth. As a result, the unsuspecting computer user will start facing problems with his browser what means that he will be randomly redirected to goingonearth.com or other malicious domains. So, if you find problems with G-o-i-n-g-o-n-e-a-r-t-h, never click any buttons there because you may lead your computer into more problems linked to dangerous viruses. You should remove Goingonearth.com ASAP. This might require various anti-rootkit tools or alternate OS scanners. For rootkit tools we recommend trying Gmer, TDSS killer. As all-around scanner and remover we recommend scanning with Hitman Pro. We also recommend trying out updated version of spyhunter or Malwarebytes Anti-Malware. Some people had good results with ComboFix (available on CNET )
If removal fails and you are still seeing redirects, try out our guide on browser redirection.
Automatic Malware removal tools
(Win)
Note: Spyhunter trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions,
(Mac)
Note: Combo Cleaner trial provides detection of parasites and assists in their removal for free. limited trial available, Terms of use, Privacy Policy, Uninstall Instructions, Refund Policy ,
I’ve had this, but ComboFix helped me. Thumbs up!
I had this annoying virus too.
I tried; malware bytes, combofix, superantispyware and spybot.
Spybot search and destroy worked. Finally.
After the scan I flushed my DNS and it doesn’t seem to have come back.
Yay!
This is the first page on google with search words:
goingonearth & g-o-i-n-g-o-n-e-a-r-t-h So I will post this here.
Goingonearth browser hijacker. A HIDDEN Scheduled Task!
Runs a hidden scheduled task! ( Gjtquun.job )
Uses the run dll executable to execute cero6.dll which is the hijacker.
Adds two registry entries to execute the task. Gjtquun
Disables the windows security center.
Adds a boat load of trojans and what have ya. which gets removed by most anti-viruses, but leaves the cero6 dll hijacker. (a hidden locked dll)
FILE NAMES May be different: Search your registry for .job (See any Gjtquun.job or similar names?) The DLL file is a Hidden LOCKED File. The reg key is locked.
Search for a locked dll in: Syswow64. I believe it was the only locked one there. Change Folder views: Show hidden system files.
Infected: windows 7: Firefox.
First use malwarebytes, & your anti-virus or similar to get rid of all the trojans it installs.(full scan)
Use the free software UNLOCKER to move or delete the dll. If you move it..right-click it,select propertise, UNcheck read-only. Now delete it. Once you move the dll the tasks are also removed. Leaves the now useless locked registry entries. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures
(Right click Signtures key, select propertise. advanced. select your admin name. give yourself full control.. apply. Now delete the two keys in Signatures.)
Close browser off..delete all temp files. run ccleaner a few times until you see nothing but your anti-virus log.
Now Flush your dns: (StartKey + R) type in cmd: type in: ipconfig /flushdns.
Use spybot to delete the reg key that disabled windows security center.
Now Go to system services, double click security center. Change disabled to Automatic. Then click start service. If the service starts,You just got rid of goingonearth! If it doesn’t, check for more hidden scheduled task or trojans.
If it starts but you still get redirected. flush out your router. I don’t have one so I can’t tell ya the steps for that.
* After u remove the reg keys, restart if security center will still not start.
* NOW.. Start surfing using FIREFOX with the addon NOSCRIPT and ADBLOCK PLUS.
* and not go to rogue adult sites or install software without first researching it.
Only two anti-viruses detected it from virustotal : Avira and SUPERAntiSpyware.
Files already sent to: Avg,avast,kaspersky,malwarebytes,spybot,adaware & a few others here shortly. But only the ones with free versions get the file. 😉
Post about the files are also available at adaware,spybot,& malwarebytes forums.
IN YOUR FACE Goingonearth!!!! Muh huh huh huh ha ha! WAT DAT DO!
(Do not infect my family members newbie pc’s! Cause I got to fix it!)
It was clever.. but not clever enough. I know how to find you!
Oop sorry.. I forgot to add: Look in C:\windows\tasks to find the tasks.
Change your folder views to show hidden files.
See above of how to delete the locked reg key.
SilentBob:
Are you aware that Virus Total submits the samples to most of the anti-virus makers, paid or not ? 🙂
Also, paying for anti-virus funds development of such tools.