jacked, locked Hosts file

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by madurobob, Oct 15, 2010.

  1. madurobob

    madurobob Private E-2

    Help please?
    First off - I've lurked here for years and have cleaned many a PC with knowledge picked up here - thanks for that.

    My problem. I bought my wife this cute Toshiba 64bit windows 7 laptop a month or so ago. She was thrilled, but, against my advice, loaned it to our 10 year old before I had a chance to load it up with protection. My wife started using it for real a few days ago and started complaining about its weird behavior.

    I loaded AVIRA, SS&D and HJT. Booted to safe mode and ran Avira and it found hundreds of infections and cleaned them all. I thought all was cool. But, before turning it back over to my wife I browsed the registry and saw a couple of DNS IP addresses I knew were wrong. Curious, I ran HJT and it told me the Hosts file cannot be accessed. I open it with Notepad (run as administrator) and see dozens of entries that don't belong, delete them... and sure enough I get a "read only" error when I try to save.

    Then I ran SS&D. It found several hijacks, but also said it cannot access the Hosts file to correct them. I tried HostsXpert to change the read/write parameters - no luck; same error.

    Any suggestions?

    I've run through the "read and run first" steps and will post the resulting log files below in a few minutes. After running though all the steps, I still have a hijacked hosts file and HJT and SS&D still error out.

    FWIW, the redirects in my Hosts file are almost all 74.125.45.100 and 98.142.243.60

    Thanks
     
    madurobob, Oct 15, 2010
    #1
  2. madurobob

    madurobob Private E-2

    Adding logs ...
     

    Attached Files:

    madurobob, Oct 15, 2010
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Did you follow these steps:
    Download HostsXpert and then follow the below steps.

    • Unzip HostsXpert.zip
    • It will create a folder named HostsXpert in whatever folder you extract it to.
    • Run HostsXpert.exe by double clicking on it.
    • Click the Make Writeable? button. (if you only see a Make Read-Only selection, it is already writeable so skip this button).
    • Click Restore Microsoft's Hosts File and then click OK.
    • Click the X to exit the program
     
    TimW, Oct 15, 2010
    #3
  4. madurobob

    madurobob Private E-2

    Thanks, TimW. Yes, I followed those steps with the addition of right-clicking on HostsXpert and "Run as Administrator". It will not make the file writeable and when I clikc "restore" I get an error messge that the Hosts file is inaccessible.

    I'm wondering if fileassassin or something like that might be able to delete the hosts file, so I can recreate it with HostsXpert?

    ETA: nope, FileASSASSIN cannot unlock or delete it. WTF?
     
    madurobob, Oct 15, 2010
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Let's try a batch file:


    • Open Notepad.
    • Copy and Paste everything from the Code Box below into Notepad: (Do not include the word Code:)
      Code:
      @Echo off
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
del %0
    • Go to File >> Save As
    • Save File name as FixHosts.bat
    • Change Save as Type to All Files and save the file to your Desktop.

    Now double click on the desktop FixHosts.bat to run the batch file. It will self-delete when completed.
     
    TimW, Oct 15, 2010
    #5
  6. madurobob

    madurobob Private E-2

    Dang - no dice. It ran and self deleted. I then opened HostsXpert thinking that would be the fastest way to check - the bad hosts file is still there, still won't let me restore.
     
    madurobob, Oct 15, 2010
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    TimW, Oct 15, 2010
    #7
  8. madurobob

    madurobob Private E-2

    :) I know its bad when I'm sent to MS support. I didn't mention in my opening post, but I had already found and tried this fix. I've tried both the manual and "fix it for me" versions, they don't work.

    Surely there is a way to unlock or delete this damned file!
     
    madurobob, Oct 15, 2010
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Have you tried in safe mode?
     
    TimW, Oct 15, 2010
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    My next suggestion is to download and install SpyBot and see if it can fix it.
     
    TimW, Oct 15, 2010
    #10
  11. madurobob

    madurobob Private E-2

    I've tried all of the steps in safe mode as well as regular boot. I Have Spybot and it runs and finds the errors. But, when I click "fix" it also gives the the no access error.

    It finds 3 entries for "Microsoft.Windows.RedirectedHosts" and 15 entries for "Fraud.WindowsProtectionSuite". But, it can't do anything about them!
     
    madurobob, Oct 15, 2010
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Can you attach the log from Spybot?
     
    TimW, Oct 16, 2010
    #12
  13. madurobob

    madurobob Private E-2

    Hi TimW, sorry, I was away for the weekend. Here is the spybot log:

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    4-open-davinci.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    securitysoftwarepayments.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    privatesecuredpayments.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    secure.privatesecuredpayments.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    getantivirusplusnow.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    secure-plus-payments.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    www.getantivirusplusnow.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    www.secure-plus-payments.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    www.getavplusnow.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    safebrowsing-cache.google.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    urs.microsoft.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    www.securesoftwarebill.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    secure.paysecuresystem.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    paysoftbillsolution.com=74.125.45.100

    Fraud.WindowsProtectionSuite: [SBI $B197733A] Redirected host (Redirected host, nothing done)
    protected.maxisoftwaremart.com=74.125.45.100

    Microsoft.Windows.RedirectedHosts: [SBI $B89FBA81] Redirected host (Redirected host, nothing done)
    www.securesoftwarebill.com=74.125.45.100

    Microsoft.Windows.RedirectedHosts: [SBI $19781685] Redirected host (Redirected host, nothing done)
    secure.paysecuresystem.com=74.125.45.100

    Microsoft.Windows.RedirectedHosts: [SBI $CEFF52BA] Redirected host (Redirected host, nothing done)
    paysoftbillsolution.com=74.125.45.100


    --- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

    2009-01-26 blindman.exe (1.0.0.8)
    2009-01-26 SDFiles.exe (1.6.1.7)
    2009-01-26 SDMain.exe (1.0.0.6)
    2009-01-26 SDShred.exe (1.0.2.5)
    2009-01-26 SDUpdate.exe (1.6.0.12)
    2009-01-26 SDWinSec.exe (1.0.0.12)
    2009-01-26 SpybotSD.exe (1.6.2.46)
    2009-03-05 TeaTimer.exe (1.6.6.32)
    2010-10-15 unins000.exe (51.49.0.0)
    2009-01-26 Update.exe (1.6.0.7)
    2009-11-04 advcheck.dll (1.6.5.20)
    2007-04-02 aports.dll (2.1.0.0)
    2008-06-14 DelZip179.dll (1.79.11.1)
    2009-01-26 SDHelper.dll (1.6.2.14)
    2008-06-19 sqlite3.dll
    2009-01-26 Tools.dll (2.1.6.10)
    2009-01-16 UninsSrv.dll (1.0.0.0)
    2010-06-29 Includes\Adware.sbi (*)
    2010-10-12 Includes\AdwareC.sbi (*)
    2010-08-13 Includes\Cookies.sbi (*)
    2010-09-22 Includes\Dialer.sbi (*)
    2010-10-12 Includes\DialerC.sbi (*)
    2010-01-25 Includes\HeavyDuty.sbi (*)
    2009-05-26 Includes\Hijackers.sbi (*)
    2010-10-12 Includes\HijackersC.sbi (*)
    2010-09-15 Includes\iPhone.sbi (*)
    2010-08-02 Includes\Keyloggers.sbi (*)
    2010-10-12 Includes\KeyloggersC.sbi (*)
    2004-11-29 Includes\LSP.sbi (*)
    2010-09-13 Includes\Malware.sbi (*)
    2010-10-12 Includes\MalwareC.sbi (*)
    2010-05-18 Includes\PUPS.sbi (*)
    2010-10-12 Includes\PUPSC.sbi (*)
    2010-01-25 Includes\Revision.sbi (*)
    2009-01-13 Includes\Security.sbi (*)
    2010-10-12 Includes\SecurityC.sbi (*)
    2008-06-03 Includes\Spybots.sbi (*)
    2008-06-03 Includes\SpybotsC.sbi (*)
    2010-06-29 Includes\Spyware.sbi (*)
    2010-10-12 Includes\SpywareC.sbi (*)
    2010-03-08 Includes\Tracks.uti
    2010-08-04 Includes\Trojans.sbi (*)
    2010-10-12 Includes\TrojansC-02.sbi (*)
    2010-10-12 Includes\TrojansC-03.sbi (*)
    2010-10-12 Includes\TrojansC-04.sbi (*)
    2010-10-12 Includes\TrojansC-05.sbi (*)
    2010-10-12 Includes\TrojansC.sbi (*)
    2008-03-04 Plugins\Chai.dll
    2008-03-05 Plugins\Fennel.dll
    2008-02-26 Plugins\Mate.dll
    2007-12-24 Plugins\TCPIPAddress.dll
     
    madurobob, Oct 19, 2010
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Let's try this>

    Download OTM by Old Timer and save it to your Desktop.


    • Right-click OTM.exe And select " Run as administrator " to run it.
    • Paste the following code under the [​IMG] area. Do not include the word Code.


    Code:
    :Processes
explorer.exe


:Commands
[ResetHosts]
[purity]
[createrestorepoint]
[emptytemp]
[start explorer]
[Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
    • Push the large [​IMG] button.
    • OTM may ask to reboot the machine. Please do so if asked.
    • Copy everything in the Results window (under the green bar), and paste it in your next reply.


    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach this log file to your next message.
     
    TimW, Oct 20, 2010
    #14
  15. madurobob

    madurobob Private E-2

    Thanks TimW!

    I also had posted this problem over at the spybot forums and Blad81 there also suggested OTM just a little while ago today. I ran it twice, using scan/fix parameters I was given (VERY similar to yours) and the problem seems to have been fixed - the hosts file is no longer hijacked nor locked.

    I'm now updating JRE and a few other things, then removing several of the malware tools I've installed, and then I think my wife's computer will be good to go.

    Thanks for all of your help - you guys are indispensable.

    Here is my thread at spybot in case it helps:
    http://forums.spybot.info/showthread.php?t=59946
     
    madurobob, Oct 20, 2010
    #15
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Sorry it took so long to finally fix this issues.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:




    Support MajorGeeks with Geek Wear!
     
    TimW, Oct 20, 2010
    #16

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds