Printable View
Hi All,
Greetings, i m having MS Antispyware, zonealarm and a couple of other safety stuff on my xp box, but as always i did visit some technical "might not waana visit" sites , and i ended up having some unwanted stuff on my box, some dialougues pop up every now and then,
some IE pages open up pointing to unwanted sites.
MS Antispyware is not able to detect nor is anti virus , but u know they are irritating.
Request any pointers or help to remove such unwanted stuff.
Regards
Have you tried scanning with any other spyware apps such as AdAware or Spybot? Sometimes certain adware/spyware won't be picked up by one scanner but will by another. Further, are your AV engine/DAT's and your antispyware apps fully updated?
Were you using Internet Explorer as your web browser?
Another thing you might want to download is the Google Toolbar, as I find it makes searching easier and has a built in pop-up blocker.
hi all,
thank you all for your time, i will try with spybot once again, but i was looking for a little indepth stuff like ...
a) is their a way to explicity determin any registry settings they make so that explicitly they can be delted.
b) any specific ports to be blocke etc.
although this is really not my domain but a little knowlege to tweak wont harm :)
Thank you all once again.
Well ... Spy and malware usually installs without you knowing it , so finding out which registry settings they perform can be difficult.Quote:
a) is their a way to explicity determin any registry settings they make so that explicitly they can be delted.
As a solution you can use some third party apps. to monitor your registry on the fly ... it will tell you when a registry setting gets altered or when a new registry setting is needed when installing a program or app. (so if you are not installing an app or program then it will tell you when there is a change in the registry requested by something).
There is also a script available on THIS SITE as a free alternative... There might be more free registry monitors available but you will have to google for them.
I'm not sure if Spyware uses any other port then port 80 (or your proxy port when you use one), but trojans and other nasty vermin use many different ports. a list can be found HERE ... But if you have a good anti-virus and a good firewall I don't think you need to worry , as any change to your ports normally gets reported by your firewall.Quote:
b) any specific ports to be blocke etc.
Hope this helps to clarify things... Anyone feel free to add comments or more recommendations.
C.
In order to keep track of Registry changes by trojans/worms etc. and clean them you may useQuote:
a) is their a way to explicity determin any registry settings they make so that explicitly they can be delted
1. The Cleaner ( http://www.moosoft.com/products/cleaner/ )
2. A-Squared ( http://www.emsisoft.com/en/software/free/ )
If you want real time protection against any changes, check out these two programs:
Process Guard
and Winpatrol
Also you should, seeing as how you are using IE (Get FireFox ) check out the HOSTS blocking file here:HOSTS FILE :p
I was forgetting about the free Regmon from Sysinternals to be found here.
It does live monitoring of your registry, so you could keep an eye on what gets changed.
C.
Wow,
Thx buddies.. what i found was the following entries in the host files, hence not getting detected by probably any antispam softwares.
I m trying to access the admin id and replace the file. I have not been able to succedd though
127.0.0.1 www.igetnet.com
127.0.0.1 code.ignphrases.com
127.0.0.1 clear-search.com
127.0.0.1 r1.clrsch.com
127.0.0.1 sds.clrsch.com
127.0.0.1 status.clrsch.com
127.0.0.1 www.clrsch.com
127.0.0.1 clr-sch.com
127.0.0.1 sds-qckads.com
127.0.0.1 status.qckads.com
127.0.0.1 www.qoolaid.com
127.0.0.1 www.qoologic.com
127.0.0.1 www.CLKPrecision.com
127.0.0.1 www.urllogic.com
127.0.0.1 www.clkoptimizer.com
127.0.0.1 www.isearch.com
127.0.0.1 isearch.com
127.0.0.1 www.idownload.com
127.0.0.1 idownload.com
127.0.0.1 www.mytotalsearch.com
127.0.0.1 mytotalsearch.com
127.0.0.1 www.lop.com
127.0.0.1 lop.com
127.0.0.1 www.websearch.com
127.0.0.1 websearch.com
127.0.0.1 www.page-not-found.net
127.0.0.1 page-not-found.net
127.0.0.1 www.isearchhere.com
127.0.0.1 isearchhere.com
127.0.0.1 xads.offeroptimizer.comm
127.0.0.1 search.offeroptimizer.com
127.0.0.1 ximages.offeroptimizer.com
127.0.0.1 xlime.offeroptimizer.com
127.0.0.1 xadsj-o.offeroptimizer.com
127.0.0.1 xadsj.offeroptimizer.com
127.0.0.1 www.offeroptimizer.com
127.0.0.1 as.adwave.com
127.0.0.1 sr.adwave.com
127.0.0.1 www.adwave.com
127.0.0.1 adwave.com EVENT:HOST:127.0.0.1
127.0.0.1 www.pacimedia.com
127.0.0.1 www.pacimedia.com
127.0.0.1 www.pacimedia.com
STOP!
That looks OK to me, those are redirects to 127.0.0.1 which is your PC...............they won't go anywhere :)
And for that matter, they seem to be redirecting spyware sites. (i.e. lop.com)Quote:
Originally posted here by nihil
STOP!
That looks OK to me, those are redirects to 127.0.0.1 which is your PC...............they won't go anywhere :)
-X
Yeah STOP don't delete it or change itQuote:
STOP! That looks OK to me, those are redirects to 127.0.0.1 which is your PC...............they won't go anywhere
And this is the reason WHY
C.
yeah like nihil said, those are supposed to be there, to edit a HOSTS file or to go back to the default, you can use the program HOSTER from this site http://www.mvps.org/winhelp2002/hosts.htm :p
And under any circumstances do not remove these puppies:
127.0.0.1 www.isearch.com
127.0.0.1 isearch.com
127.0.0.1 www.idownload.com
127.0.0.1 idownload.com
127.0.0.1 www.mytotalsearch.com
127.0.0.1 mytotalsearch.com
127.0.0.1 www.lop.com
127.0.0.1 lop.com
isearch =
idownload=mytotalsearch=Quote:
Spyware.ISearch
Last Updated on: September 19, 2005 03:23:14 AM
Type: Spyware
Name: ISearch Toolbar
Version: 1.0.0.1
Publisher: iDownload.com
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
Risk Impact: High
From Castlecops http://castlecops.com/startuplist-6243.htmlQuote:
Field Value
Name MyTotalSearch Email Plugin
Command mtsoemon.exe
Status X
Description MyTotalSearchBar adware
Viewed 451 times since 23 May 2005, 1825 Hours UTC-4.
STATUS KEY:
"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown
And the last one LOP is a real problem.
Description
lop is a family of programs that set your start page and IE’s search features to use the site lop.com (’Live Online Portal’) or one of its clone sites. Known lop sites include:
LOP Sites
So unless you want to spend hours cleaning your PC, stay away from these sites, keep a good HOSTS file if you insist on using IE (Get Firefox) also check out IESPYAD
Cemetric
Didn't see your post, I was hung up on mine for abit :p
Yes, I have just checked and Spybot Search & Destroy certainly has an option to use that technique. I suspect that MS Antispyware and some other security products do the same?
I would set up Spybot to start in advanced mode then you can use the tools and look at Hosts, Browser Helper Objects, LSP stack and so on. Winpatrol also has some useful analysis, and a very nice "suspend" facility that lets you turn things off and back on again.
:)
Your HOSTS file can also be infiltrated and used to "Redirect" you to other sites as well as block your Auto update features on Windows, Spybot and Adaware to name a few.
Quote:
Beware of ungracious hosts
Robert Vamosi April 11, 2005
Taking a page from virus writers, identity thieves could soon use a tiny file on your computer to redirect you to their fraudulent sites.
A few weeks ago, I wrote about a new trend among identity thieves called pharming, where whole domains are hijacked, and users unwillingly find themselves on familiar-looking yet fraudulent Web sites. Pharming exploits a weakness in how the current Internet is structured, namely the Domain Name System (DNS), which translates easy-to-remember URLs into the IP addresses that networks use to route data packets across the Internet. Since that column, I've been thinking about other ways to accomplish a similar feat. For example, rather than poison or change the data on a remote DNS server, why not use a common file on your computer to redirect your desktop computer somewhere else instead?
Internet Connection primer
Almost all Internet-connected computers -- Windows, Mac, Linux, even Unix -- use a hosts file (NB: this type of file has no extension).
Whenever you access a site on the Internet, instead of typing its IP address (say, 220.127.0.0), you simply type www.zdnet.co.uk. Your computer must first learn the IP address of the server hosting the ZDNet site before it can connect, and it does so by asking a DNS server. As mentioned in my pharming column, identity thieves have been known to compromise DNS entries so that anyone trying to find www.yourbank.com instead gets a very good replica located on a fraudulent Web site -- and all the while, the URL displayed on your address bar in your browser looks just fine to you.
But the TCP/IP protocol also allows for a hosts file to trump any DNS address query. Using Notepad or any text editor, you can view your own computer's hosts file contents. On a Windows machine, the hosts file is generally located within the Windows folder; on Windows NT, 2000 and XP, it's within a subfolder with your Windows drivers. A fresh hosts file should look something like this (and for the record, I don't recommend altering your hosts file):
# Copyright (c) 1998 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP stack for Windows98
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#'
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
 127.0.0.1 Localhost
Virus writers know about hosts files
Unfortunately, virus writers know that hosts files can block Internet address requests -- especially requests to view antivirus and security vendor Web sites. The recent Mytob virus is one that attacks the hosts file on Windows systems. Virus writers do this by associating the local host address of 127.0.0.1 next to the antivirus company's URL in the hosts file; 127.0.0.1 is a special loopback address for the machine you are currently using, which means that your request to go out onto the Internet to a Web site simply loops right back to your computer. Should you find yourself unable to reach an antivirus software company to obtain the latest antivirus signature file to contain or remove a virus, you might want to check your hosts file. In this one exception to the rule to not change your hosts file, I recommend first using a text editor to save the existing hosts file to something distinct, such as HostsOld, then delete all the blocked antivirus or security vendor associations (or mark them with #s to comment them out) and save the edited file as hosts (with no extension).
You might be thinking that you can also use your hosts file to block spyware and adware? You can, but I don't recommend it. Not manually. First, the list will be hard for you to maintain. Instead, I recommend downloading a free anti-spyware program, such as Microsoft AntiSpyware (Beta), Spybot or Ad-aware. Second, long lists within your hosts file often slow your computer's access to the Internet.
Scam artists also know about hosts files
You might also be thinking that if a hosts file can exclude, can it also redirect? Yes, it can. Say you have a favourite site called BrandX.com, and it has an archrival site called BrandY.com. BrandX.com lives at 123.456.00.00 while BrandY.com lives at 122.222.0.0. If someone were to alter your hosts file so that every time you typed BrandX.com on your browser it would return BrandY.com's site instead, you'd be cross, I'm sure. That alteration in your hosts file would look like this:
 122.222.0.0 BrandX.com
Unfortunately for you and me, scam artists are lazy. Rather than changing BankOne's DNS registration (which involves some social engineering and work), an identity thief or so-called pharmer could simply alter your hosts file instead. This would be a slow process, and updating individual computers would produce rather little profit. However, if a virus writer fell under the employ of a pharmer (or a spam merchant) and could somehow infect thousands, if not millions, of computers with a compromised hosts file, the rewards would be even greater.
Is this happening right now? Yes and no. In some countries, such as Brazil, malicious Trojan horses are redirecting users away from local banks and toward criminal sites, but this has yet to become widespread. And although a large-scale version of this attack (say, targeting many financial sites at once) hasn't happened, there's little reason to think it won't.
Protection
Any good antivirus product (such as Trend Micro's PC-cillin) that's kept up-to-date should keep your system safe. Better yet, try a good security suite (such as ZoneAlarm Security Suite 5.5), and you'll have all of your antivirus, firewall and anti-spyware bases covered.
ZDNET Review
No biggie ..Saves him from clicking the link anyway :DQuote:
Didn't see your post, I was hung up on mine for abit
C.
Hmmmm,
I don't entirely agree with him. I use the hosts file but I have it locked until such time as I update the antimalware.
If you then browse it with Spybot it will show you the new entries so you can check that they are OK then lock it again.
I agree that it is not something that I would want to do manually :)
nihilQuote:
Hmmmm,
I don't entirely agree with him.
Are you referring to me or the article. :(
You know the default HOSTS file is considered adequate if you use Spywareblaster and Spywareguard in conjunction with Microsoft Antispyware Beta 1.
It comes down to user preference on how to use a HOSTS file, there is a good tool at MVSP HOSTS site called HOSTMAN as well as HOSTER.
You can also reset the default HOST file through a reboot
Restoration of the host file (Windows and Linux)
When a program hijacks the host file, it may be necessary to restore it.
1. Identify the location of the host file for your operating system
2. Create a backup copy
3. Open it with a basic text editor such as Notepad or vi
4. Remove all entries for the sites which are hijacked. Some may have been added for legitimate programs. Always be sure to back up your host file. By default, most systems will only have the following line:
127.0.0.1 localhost
1. Save the file
2. Restart your computer (Windows)
You can also see and edit the HOSTS file through the HJT program.
The article of course :DQuote:
Are you referring to me or the article
Actually, the tools section of Spybot S&D allows you to manage entries, clear the file and restore it ;)
hi all,
thank you for all the information.. but now i need some more practical advice.
these pop ups for websites have made it a hell, when i goto etc/ hosts.sam and try to edit
it says this file is currently in use.
so wether i use the admin id or w/o network , it just says the file is in use and does not allow me to modify.
i m already scanning with MS antispyware - spybot etc etc. :( .
pls help ..
regards
Have you tried booting into safe mode ?
HiQuote:
these pop ups for websites have made it a hell, when i goto etc/ hosts.sam and try to edit
Why are you attempting to change the hosts.sam file, it is the HOSTS file without the extension which holds the information.To read that file you can open it in notepad or wordpad.
To understand about HOST files check this site out:All you ever wanted to know about the HOST
Also if you have been following the advice given, the pop-up problems should have been resolved by now.
Switch to Firefox and put the adblock extension on it. Also as has been mentioned previously, do your scans in safe mode, delete all temp files, empty your recycle bin,check for rogue processes with the task manager.
If after you have done all of these and are still getting pop ups, then go to safe mode and disable your System Restore, and reboot into normal mode, this will flush out all of your previous restore points.
Run your scans again, and do a disk cleanup and defrag, then re-enable the system restore if the pop-ups have disappeared.
Your etc folder for WinXp pro should look like this. The file that has the addresses in it is the one marked in Upper Case HOSTS on some OS's it may appear in lower case, but in XP pro and home it is in Upper Case and is important to note this, so when you add the txt extension to it it remains as Upper Case.
... id reccomend
scan with ad aware spybot spydoctor and spysweeper what one misses other one will pick it up it worked for me perfectly fine when i had a problem like that
also there was this program its free you load it an if you use IE... he will block all the bad sites for you block all the known activeX and such i mean its not much but it still helps
Hi Dalek,
Dont get offended i m right now typing this email from firefox , but this seemed to have made the situations worse. ? HOW ? IE opens a new window on popup , but this firefox so far tends to open those junk sites on Current window which means i retype content like this twice :(
Nihil - I went in the safe mode , and it helped me deleting those entries , the moment i came out in the normal it corrupted the host file .. so now i follow what has been suggested earlier. -
- i will try and change the hosts file in safe mode, at the same time try and use host file security as stated in above posts.
- used spybot and MS antispy ware, and norton not to miss out, but still the popups are coming
- i will check those other softwares as well stated in the above post.
let me know if there is anything i can try as well...
Once again thank you all for the consistent support.
Regards
Hi
Not a problem ;)
Would like you to do this though! go to Merjin
read up on Highjack this logs and post it here, maybe there is more to the problem then just pop-ups. :p
Has anybody tried CWShredder ??? I have had this problem before, and when i used CWShredder it did solve the problem. (looking at what you posted as your hosts file, i had the 'i get net' thing that you had too)