sábado, 22 de febrero de 2020

How I succesfully removed "xml.oceanreefs.xyz"

If your internet browser keeps showing ads (at a higher rate than previously), and you notice that the browser is opening a new window with the address "xml.oceanreefs.xyz" that quickly redirets to something other (like https://www.aliexpress.com/), you have a virus in your computer. They call them sometimes ad-ware but let's face it, something that makes your computer make things you don't want it to make is basicly a virus.

I have opened several pages about "How to remove xml.oceanreefs.xyz" and nothing worked. No antivirus detected it, there was no mention of "xml.oceanreefs.xyz" in the registry or any folder with that name...

But finally I managed to get rid of it. This is how:

The virus has indeed modified the registry, but not using the address "xml.oceanreefs.xyz", but this other:
"cityskyscraper.com"
So this is what you have to look for.

Click on Start and type regedit (or reg.exe).
Once it opens click on Search (Ctrl + F) and type "cityskyscraper.com"

Delete every entry of the registry where this address is mentioned.

Just in case, you can search for "xml.oceanreefs.xyz" and delete any entry mentioning it (but in my case there was none with this address).

Messing with the registry is dangerous, so you want to be sure that you do not delete anything else.


I also made a second step afterwards to be completely sure, I scanned my PC with Malwarebytes (there is a free version).
So if cleaning the registry was not enough, you can try to scan your computer with Malwarebytes.