Browsers forum: Browser points to Hungary

Total posts: 11 (Showing page 1 of 1)

Thread display preference:
Collapsed
Expanded

Back to Browsers

Tracked Track this thread

Answers

Answer Best answer as chosen by user BagelAnne

Hosts

by BagelAnne - 4/22/12 5:20 PM

In Reply to: Browser points to Hungary by BagelAnne

when I deleted google and Bing in hosts I did a "save as" and chose "all files" but it still comes back with the browsers listed with the Deninet KFT ip address.
This computer was infected as follows:
This is my sister's computer and she said it was running "strange" I did some scans. I tried to scan with GMER but it caused the computer to crash and restart.
I scanned with TDSS and it found Rootkit.Boot.Piharib but said it was fixed.
As soon as it was fixed, Norton sent an alert showing it found threats: (said all were fixed)
tsk0010.dta - trojan horse
tsk0006.dta - Backdoor.pihar
5.dta - TrojanGen
4 Backdoor.pihar
3 Trojan.Gen.2
2 Trojan horse
1 Trojan.gen
4 others were detected by Sunar(sp?) and quarantined

Rescanned with Norton360 and it found Trojan.Tracur

I turned off systen restore, rebooted and turned it back on.

Slim cleaner found in the startup group and removed
afcdaeebad (etc)
Gmer found nothing
Malwarebytes found nothing.
Rootkit buster listed a bunch of files it said unable to fix.
Panda Rootkit scan found nothing.
It seems to be running well except for the two browsers.

Was this reply helpful? (0) (0)

Staff pick

I think I fixed it

by BagelAnne - 4/22/12 5:46 PM

In Reply to: Hosts by BagelAnne

I just renamed the Hosts file to "hosts.bad"
I tried to create a new hosts file with notepad but would only save it as a text file even though I set it to "all files".
Should it be an ASCI file?

Was this reply helpful? (0) (0)

Staff pick

Hmm, interesting

by MarkFlax - 4/23/12 5:02 AM

In Reply to: I think I fixed it by BagelAnne

I can't do it that way now either, but I'm using Windows 7.

When you changed the name of the existing HOSTS to HOSTS.bad, did you try a reboot, (restart the computer), to see if XP re-creates the file?

If so and it doesn't, try this.

In that folder, (the folder where HOSTS should be), right click any empty part of the folder and select New > Text document, (it may be Text file in XP). A new blank Txt file should be created with its name highlighted waiting for you to rename it. Name it HOSTS and delete the .txt extension, then press Enter. Windows will warn you about the change but just accept that.

Now, open that file, add anything in that you need to add, (like the blank HOSTS file always has), then File > Save. (Not Save as, I think that is where I misled you and I apologise for that).

Some questions for you;

1] Where are we now? You mention that various malware threats have been removed, but are they recurring?

2] What about the browsers, what situation are they in?

Mark

Was this reply helpful? (1) (0)

Staff pick

You are Good!!!

by BagelAnne - 4/23/12 9:23 AM

In Reply to: Hmm, interesting by MarkFlax

When I renamed to hosts.bad I did rebot but the hosts file was not recreated.
I followed your instructions and now have a fully functioning Hosts file. Thank you!
Browsers wording very well. All seems good except can't get a good scan from Trend Micro Rootkit Buster.
It finds 44 items that are listed with "Unable to Fix"
I am thinking that they just want to sell their product???

Was this reply helpful? (0) (0)

Staff pick

Glad to see

by MarkFlax - 4/23/12 12:17 PM

In Reply to: You are Good!!! by BagelAnne

everything is all working again and glad I could help in some way.

About Trend Micro's Rootkit Buster. I haven't tried it myself but I do trust Trend Micro and have used their online anti-virus scan many times.

I wonder if it is finding remnants of rootkit files that the other tools you used above left over when they got rid of the rootkits? If so, they are likely not harmful.

But that said if you are not sure, Trend does have forums of its own here; http://community.trendmicro.com/t5/Home-and-Home-Office-Forum/bd-p/homeoffice

If you registered there and posted a question about this, you may get more expert advice about their product.

Good luck

Mark

Was this reply helpful? (1) (0)

Staff pick

Thanks again

by BagelAnne - 4/23/12 3:47 PM

In Reply to: Glad to see by MarkFlax

I will check out the Trend micro forum.
Thanks for your great support and for sticking with me through the whole process!

Was this reply helpful? (0) (0)

Staff pick

Answer Best answer as chosen by user BagelAnne

Browser issue

by pgc3 - 4/22/12 8:57 AM

In Reply to: Browser points to Hungary by BagelAnne

Just out of curiosity what does your home page (internet options) show as? Just off the top it sounds like a redirect that might have been created by malware, it does sound strange. Did this just happen? A little more infor might help.

Was this reply helpful? (0) (0)

Staff pick

Answer Best answer as chosen by user BagelAnne

You've been hit by malware.

by MarkFlax - 4/22/12 12:06 PM

In Reply to: Browser points to Hungary by BagelAnne

If you cannot amend the HOSTS file then you have been hit by malware.

But changing HOSTS should be simple if you remember one important thing. HOSTS does not have a file extension. If you open HOSTS in Notepad, delete the entries then save the file, it is likely to be saved as a.txt file. The browsers do not look for HOSTS.txt.

To re-save as HOSTS you use Save As in the File menu, make sure the name does not have a file extension, then make sure the "Save As file type" is changed to "All files" and not .txt files.

If you open HOSTS up again in Notepad and nothing has changed, see if the file has been set as "Read only" in it's Properties. If so, change that and try again.

In any case, you need to run a full scan with your anti-virus and also with the free versions of Malwarebytes Anti-malware and SUPERAntiSpyware.

Mark

Was this reply helpful? (2) (0)

Staff pick

read only

by BagelAnne - 4/22/12 5:30 PM

In Reply to: You've been hit by malware. by MarkFlax

You were correct it had been read only and I un checked that option.
I was allowed to delete the files and they went back on when I closed etc and system 32, windows, c.
They were back when I looked for hosts again.

Was this reply helpful? (0) (0)

Staff pick

Answer Best answer as chosen by user BagelAnne

Internet options

by BagelAnne - 4/22/12 5:13 PM

In Reply to: Browser points to Hungary by BagelAnne

My home page still looks normal and will browsers Live search and Norton search work fine.
This is my sister's computer and she said it was running "strange" I did some scans. I tried to scan with GMER but it caused the computer to crash and restart.
I scanned with TDSS and it found Rootkit.Boot.Piharib but said it was fixed.
As soon as it was fixed, Norton sent an alert showing it found threats: (said all were fixed)
tsk0010.dta - trojan horse
tsk0006.dta - Backdoor.pihar
5.dta - TrojanGen
4 Backdoor.pihar
3 Trojan.Gen.2
2 Trojan horse
1 Trojan.gen
4 others were detected by Sunar(sp?) and quarantined

Rescanned with Norton360 and it found Trojan.Tracur

I turned off systen restore, rebooted and turned it back on.

Slim cleaner found in the startup group and removed
afcdaeebad (etc)
Gmer found nothing
Malwarebytes found nothing.
Rootkit buster listed a bunch of files it said unable to fix.
Panda Rootkit scan found nothing.
It seems to be running well except for the two browsers.

Was this reply helpful? (0) (0)

Staff pick