The page cannot be displayed virus

cdido · Aug 9, 2008

I followed directions up to where I need to download tools. (I am using my lap top to research problem for my PC) Anytime I try to go to a virus/spyware removal or protection website, I get "The page cannot be displayed". In addition, I can only get to other websites by typing in the address bar, I can not search and click on links. I can not get to HighjackThis for the same reason, I keep getting the error message. There are hundreds of links in my host file that I can not delete because I get the error "Cannot create the C:\WINDOWS\system32\drivers\etc\hosts file""Make sure pathways are correct". I would appreciate any help available. Thanks

TimW · Aug 10, 2008

First try the below......

FAQ 14: I can't go to certain webpages...either to download antivirus patches or to get help from malware fighter sites. What happened?

Answer: Your HOSTS file is probably hijacked.

The HOSTS file is a non-extension file found in this location:

C:\Windows\System32\Drivers\ETC\HOSTS XP

C:\WINNT\System32\Drivers\ETC\HOSTS Windows 2000

C:\Windows Windows 98 and Millennium

Two ways to fix...rename and replace or edit the original:

1. Rename and Replace HOSTS file (recommended)

Open Windows Explorer: type the word explorer at Start/Run box and click OK:

Find this file: (XP systems)
C:\Windows\system32\Drivers\ETC\HOSTS file

Rename the file HOSTS to HOSTS.OLD. (a fresh new HOSTS file will be created when you restart Windows). Later you can delete the HOSTS.OLD file when things are back to normal.

2. Edit HOSTS file:

To open and view the HOSTS file to doublecheck for bad entries, left button double click on the HOSTS file. A message will appear saying Windows can't open the file. Check the circle at the bottom entitled:

Select the program from a list.

Now click OK. In the next window....Scroll down in programs until you see Notepad and select it and click OK.

If you see this line below the header info:

127.0.0.1 localhost

....And nothing below it then you have not been hijacked.

If you see many double column entries and most are antivirus and anti-malware sites then remove all the entries leaving only the 127.0.0.1 localhost entry.

You can install a HOSTS protection file replacement to make it less vulnerable.

I use this one http://mvps.org/winhelp2002/hosts.htm (Download it, unzip it, and replace your old HOSTS file with this excellent protector). Full details on that page with a good overview of the HOSTS file and how it works.
Click to expand...

If this lets you navigate....then Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

If something does not run, write down the info to explain to us later but keep on going.

Do not assume that because one step does not work that they all will not.

READ & RUN ME FIRST. Malware Removal Guide

Note: If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode. You can running steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

cdido · Aug 10, 2008

Thanks for helping...

I renamed the Host file to HOSTS.OLD

Installed host protection file

Went through Read & Run Me Frist, but still can't navigate to antispyware sites.

Also, I just went to remove eFax Messenger and I received a caution box stating: The following files are currently being used and cannot be updated by Setup: C:\WINDOWS\system32\spool\drivers\w32x86\2\J2GEUM35.dll - not sure if this is related to navigation problem?

Is there something else I can try???

TimW · Aug 10, 2008

Please attach the logs from the Read and Run First instructions.

I am assuming you did a restart after renaming the host file.

cdido · Aug 10, 2008

I restarted after renaming host, the new host had thousands of entries again, this time it let me delete and save. I restarted again, additional entries didn't reappear, but still can't navigate.

Sorry if I'm misunderstanding, but I can't download any of the tools in Read & Run Me First because I can't get to any website related to antivirus or spyware, I can't run any of the programs, so I don't have any logs.

I am using my laptop to get to your site.

TimW · Aug 11, 2008

Have you downloaded to your laptop and tried transferring using either a cd or a thumb drive?

Be aware that a thumb drive is writable and could pick up the malware.

You should first try combofix.

cdido · Aug 11, 2008

Why didn't I think of that...guess that's why I'm on this side of the problem.

I really appreciate your help.

I saved a copy of ComboFix and put it on my PC.

I only had my original XP disk and have since installed SP2, so it wouldn't let me move forward with disk because it was an older version of what was currenlty being used...

and of course I couldn't navigate to MS link provided by bleepingcomputer because of virus re-directing me, so I saved WindowsXP-KB310994-SP2-Pro-BootDisk-ENU to a disk and copied to my PC desktop...

I dragged it on top of ComboFix and everything proceeded as shown in tutorial.

Once the log poped up, I noticed the first warning says this machine doesn't have the recovery console installed. When I close the log all I have is a blue screen. I can use Ctrl Alt Del to get to files and folders but I'm not sure what to do from here. It wouldn't let me save log to a disk, I can only print and scan PDF logs to my laptop. Can I type up the log?

TimW · Aug 11, 2008

Did you rename COmboFix? DId you try running it in safe mode? Same with the other scans ......try them in safe mode. We need to get some logs.

cdido · Aug 11, 2008

Just got it to work, here is the ComboFix log:-D

I no longer have VIRUS ALERT on my files and I can get to all websites so far!!!

I will go ahead and run all other scans in Read & Run Me and attach logs.

cdido · Aug 12, 2008

Here are the 3 additional logs. Spybot didn't find anything.

Everything seems to be running normal , except connection keeps dropping to low or no connectivity only on PC. PC seems to have changed after running MGTools, maybe?

I recieved error message #4 "The application failed to initialize properly (0xc0000135). I installed .NET Framework and ran dotnetfx.exe and re-ran MGTools but received same error #4 again.

TimW · Aug 12, 2008

You have no anti-virus program installed!

It appears as though the scans removed the problems ......though your wireless connection is an issue for the networking forum.

Did you run SAS and MWB's on the other user account?

cdido · Aug 12, 2008

I know, sorry. We had Norton for a while, but my husband wouldn't stop complaing about how slow his computer was, so I finally gave in and removed it. I have read all of your recommendations and promise to follow all of them from now on!!!

As far as I can tell we only have one user account set up. We have a 2nd hard drive for storage, but I assumed the scans (other than the MGTools) would cover both drives.

Am I clear to continue with clean up and removing downloads?

TimW · Aug 12, 2008

Sometimes the threads seem to blend together.....LOL

If you are not having any other malware problems, it is time to do our final steps:

You can uninstall SUPERAntiSpyware now.

We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combo-fix folder from combofix.

If we had you run Avenger, you can delete all files related to Avenger now.

If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

cdido · Aug 12, 2008

I can not thank you enough!!!! I can finally breath again (although, I have to admit I think I actually enjoyed fixing the problems.)

It is amazing to me that you guys provide the help that you do. We should all follow your example and be a little more generous with our time and knowledge.

Is there a donation link that I am overlooking? Will buying a t-shirt help support majorgeeks?

TimW · Aug 13, 2008

LOL...buying a T-shirt will help both MG's and you.....Be a proud member and show the world your geekiness.

Oh, and you are most welcome.

Log in or Sign up

The page cannot be displayed virus

cdido Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

cdido Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

cdido Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

cdido Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

cdido Private E-2

Attached Files:

ComboFix log.txt

cdido Private E-2

Attached Files:

MGlogs.zip

SAS Log 08-11-08.txt

mbam-log-8-11-08.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

cdido Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

cdido Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

The page cannot be displayed virus

cdido Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

cdido Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

cdido Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

cdido Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

cdido Private E-2

Attached Files:

ComboFix log.txt

cdido Private E-2

Attached Files:

MGlogs.zip

SAS Log 08-11-08.txt

mbam-log-8-11-08.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

cdido Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

cdido Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches