google

[ideaz]

I went to search on google and I cant connect. All of the other search engines work and so do the websites I visit. This happens using explorer 7 and firefox 2.0. Can anyone tell me where to look to see if I have accidentally blocked access? I have the trend micro PC-cillin software and windows xp.

This is what I get on the search bar...
http://www.google.com/search?q=car&ie=utf-8&oe=utf-8&rls=org.mozilla:en-US:official&client=firefox-a

[insyder]

Are you getting a "page cannot be displayed" error?

Look for the following file: C:\WINDOWS\system32\drivers\etc\hosts

Open the file with notepad.

It might look similar to this...# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
127.0.0.1 www.google.com
127.0.0.1 google.com
127.0.0.1 castlecops.com
.
.
.
.

Notice the entries above for google? They are being redirected by the hosts file back to your own machine. Remove the entries and save the file.

This is a common trick that is used by spyware/malware type of websites.

[ideaz]

Thanks... it worked. Two questions...

1. How did google get on this list?

2. Are the other web addresses on this files a threat?

Heres is what I show:

127.0.0.1 localhost
127.0.0.1 forums.techguy.org
127.0.0.1 www.castlecops.com
127.0.0.1 castlecops.com
127.0.0.1 www.microsoft.com
127.0.0.1 siri.urz.free.fr
127.0.0.1 www.majorgeeks.com
127.0.0.1 majorgeeks.com
127.0.0.1 www.spywareinfo.dk
127.0.0.1 spywareinfo.dk
127.0.0.1 www.superantispyware.com
127.0.0.1 superantispyware.com
127.0.0.1 www.compu-docs.com
127.0.0.1 compu-docs.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 pandasoftware.com
127.0.0.1 download.bleepingcomputer.com
127.0.0.1 www.bleepingcomputer.com
127.0.0.1 bleepingcomputer.com
127.0.0.1 www.ewido.net
127.0.0.1 ewido.net
127.0.0.1 www.greyknight17.com
127.0.0.1 greyknight17.com
127.0.0.1 help.lockergnome.com
127.0.0.1 www.lavasoftsupport.com
127.0.0.1 lavasoftsupport.com
127.0.0.1 cleanup.stevengould.org
127.0.0.1 stevengould.org
127.0.0.1 www.tomcoyote.org
127.0.0.1 tomcoyote.org
127.0.0.1 www.depannetonpc.net
127.0.0.1 depannetonpc.net
127.0.0.1 www.wilderssecurity.com
127.0.0.1 wilderssecurity.com

[Dopesick]

looking at the sites listed in there, you had some sort of hijack roll in...

REMOVE EVERYTHING IN THAT LIST EXCEPT "127.0.0.1 localhost"

[Sane_Man]

Originally posted by Dopesick
looking at the sites listed in there, you had some sort of hijack roll in...

REMOVE EVERYTHING IN THAT LIST EXCEPT "127.0.0.1 localhost"

He may want to make that file Read Only to keep it from being changed. Also, plug any security holes that allowed this to happen.

[insyder]

Originally posted by ideaz
1. How did google get on this list?
Some sort of malware (maybe a software crack?) was run on your box. Part of the .exe/.bat/.vbs altered your HOSTS file. Pretty elementary "trick"...

Originally posted by ideaz
2. Are the other web addresses on this files a threat?
Judging by some of the addresses...looks like the malware writer was attempting to block access to common help sites in order to keep you from figuring out why the -f- you can't get to google, etc.

A lame hack. As Sane Man said, run your spyware/malware checking softwares to make sure there aren't other things going on that your might not know about.

[ideaz]

Originally posted by insyder
Some sort of malware (maybe a software crack?) was run on your box. Part of the .exe/.bat/.vbs altered your HOSTS file. Pretty elementary "trick"...

Judging by some of the addresses...looks like the malware writer was attempting to block access to common help sites in order to keep you from figuring out why the -f- you can't get to google, etc.

A lame hack. As Sane Man said, run your spyware/malware checking softwares to make sure there aren't other things going on that your might not know about.

I do remember running a software crack and then google not working. Thats definitely a lesson learned

Four more questions...

1. When i did a search for this file two versions came up.

-A "File" type and
- A "Sam file" type.

Does the Sam File pose a threat? I cant open it with note pad so I do not know whether to delete it or not.

2. When I ran the software crack I scanned it for viruses and PC-cillin found none. Is malware considered a virus and is that why my anti virus didn't catch it or should I look for another anti virus program?

3. I ran a virus scan and one file was infected. I quarantined the folder but I am not sure wheteher to delete it or not. Is anyone familiar with this

File Name: A0096318.exe
Location: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP539\

4. Since this was due to the software crack are there any other folders or files I should check?

[Dopesick]

1: No you want the BARE file. It exists at... C:\windows\system32\drivers\etc\

2: Not all "Anti-virus" and or ad/spy ware removers are the same. Malware, Spyware, Adware, are not all considered virii. They are each their own classification - Although as virii they do indeed perform undesirable functions.

3: if in doubt, leave it be.

4: I wouldn't worry about it, however I'm not going to condone or chastize you for "Cracking" but I will tell you this. Get a better adware/anti-virus setup then what your using. And SCAN the files you download before using.

I know AVG as of next month is no longer FREE, but for $70 I'll be buying a license. I've had a GREAT run with AVG for the last 5 years. I couple it with Lavasoft's Ad aware, and have not had 1 issue in 5 years.