Strange, I have made VBForums as my default webpage but ths morning this is the one coming out... I have AVG, S&D and SpywareGuard... What seems to be wrong? I have uninstalled FireFox but still the problem persists...
Printable View
Strange, I have made VBForums as my default webpage but ths morning this is the one coming out... I have AVG, S&D and SpywareGuard... What seems to be wrong? I have uninstalled FireFox but still the problem persists...
you should post this in the General PC forum. Also, look for my post about Google Search in the same forum, I think the same solution will work for you.
More people are frequenting ChitChat than General PC so I posted it here. I'll take a search, couldnt you provide the exact thread?
Look at your start page, if it is vbf, then look in the hosts file
Hey baja_yu, I found your thread but I cannot understand those things, I'm a bit noob to this kind of situations... What is hosts file? Where can I find it?
http://www.vbforums.com/showthread.php?t=345343
Download HijackThis and use it to remove the problem makers you might have.
Also check your hosts file, it is located in the Windows folder, it is called "hosts" (just that, no extension).
There is no "host" file in my Windows directory...
make sure you enable "Show hidden files" and/or "Show protected system files"
This is the result of HijackThis... What are the ones I should remove?
Remove the second R1.
Also, maybe third and fourt O16, but I am not sure, I dont know what software you have installed. If you dont know what the HouseCall control is you should maybe remove it.
The error still persists and I still cant find any "host" file... :( :cry:
Here's the latest result of HijackThis...
There should be a 'hosts' file in you "C:\Windows" folder. Are you sure you enabled listing hidden system files? Look here: http://www.xtra.co.nz/help/0,,4155-1916458,00.html
Anyway, download this, it will list your hosts file: http://www.funkytoad.com/download/hoster.zip
Download: http://www.mvps.org/winhelp2002/DelDomains.inf
To use: right-click and select: Install (no need to restart)
Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.
That Hoster said "HOSTS file does not exists"... Is that normal?
hmm... I'm not sure, probably not but here's mine. Copy it to your windows folder.
This is what the Hoster shown, what should I do now? The problem still persists... :cry:
Ok, the hosts file is ok. Now, try removing the O6, O16, O16, and O17 items from your last HijackThis log.
This is the latest result of HijackThis after I have scanned my computer with Microsoft AntiSpyware but still the problem persists....
When I change the Default Page to www.codeguru.com and tried to start IE it actually goes to codeguru, but when i changed it back to www.vbforums.com and tried to run IE that page in my first page is still the one being shown! Its as if it is being redirected to that page if I use www.vbforums.com, when I try to refresh the actual page of vbforums is shown... What's happening? :(
Remove R1 and O17 if that IP address that they show is unknown to you.
Also, download and run this app: http://www.cexx.org/lspfix.zip
when you run it, it will list some files in the box on the left. Post the filenames here.
I have removed O17 now...
The files listed are:
1. mswsock.dll (tcpip)
2. winrnr.dll (ntds)
3. rsvpsp.dll (protocol handler)
That is all ok. I'm not sure what could be the problem... let me think
Does the problem occur on any other browser except IE?
Yes, it also occurs in FireFox so I have uninstalled FireFox thinking it might be the cause since the page being shown is about Mozilla...
What would happen if you set your homepage to:
http://www.vbforums.com/forumdisplay.php?f=1
that will make it go directly to Classic VB.
That works fine... Its only www.vbforums.com that is somehow being redirected, how come?
I have no idea ....... ?!?
I am currently running Panda ActiveScan right now and its not yet finished but somehow it has detected something infected in the registry, I hope when its finished and I could fix the infected part of the registry all will be fine already....
A million thanks baja_yu!
No problem :)
If its being redirected then its the hosts file?
The reason he can't find the hosts file is because on Windows XP it isn't stored in C:\Windows, its in,
C:\Windows\System32\drivers\etc\hosts
Yeah, but I sent him a link for hosts file examination application. The hosts file is ok.
Now I found that Host file you are talking about, thanks Pc_Madness, do you have any recommendations or suggestion why this is happening?
Open that file and post it's contents here. It should look like the one I sent you.
Were the contents of that file empty? (apart from 127.0.0.1 localhost)
"hmm... I'm not sure, probably not but here's mine. Copy it to your windows folder."
Seems to imply that you copied the one baja_yu sent you to C:\Windows. If the program above is as dodgy as I'm thinking it is, then its just reading the one in C:\Windows (which has no effect on your net connection). If it did know where to find it on XP, it shouldn't have said that the file was missing?
Otherwise, I'm not sure, it has to be something local if you can view a particular parts of the site, just not the homepage. Tried visiting without the www? vbforums.com
If it isnt the same, then copy the one I sent you over your file.
Quote:
Originally Posted by dglienna
I guess nobody saw this? :eek:
I saw it before you even posted it noob! :l33t:Quote:
Originally Posted by dglienna
Panda ActiveScan reported that I'm infected with Adware/Ucmore...
I hate pandas :)
Kaspersky rules! :D
Where can I find Kaspersky? Does it have Online scanner?
Probably on download.com or on twocows.net
I am not sure about the online scanner though.
Darn, the problem still persists! I cannot seem to follow the instruction from Panda on how to remove it since the file they have mention cannot be located on my computer!
Any help would be highly appreciated...
It was post #4, before you imagined it.Quote:
Originally Posted by Pc_Madness
Try here. It is a good link:
http://housecall.trendmicro.com/
Type nslookup at Start Menu --> Run and type www.vbforums.com. You should get a reply which looks something like this:
If the IP address is different then it means there is something wrong with the DNS cache. The fact that it is going to the Mozialla Developer site suggests to me that it is not spyware.Code:Non-authoritative answer:
Name: www.vbforums.com
Address: 63.236.73.220
To clear the dns cache goto the command prompt by typing cmd at Start Menu --> Run and enter the following:
Also try doing Ctrl+F5 on www.vbforums.com, it may be that the local cache is holding the wrong page.Code:C> ipconfig /flushdns
Attached is the result of nslookup...
When I press CTRL+F5 everything works, what should I do now? I have already tried C> ipconfig /flushdns...
Type IPCONFIG /ALL to see if you have any DNS servers set. Maybe something got hosed there, or they have changed. You would have to check with your ISP.
Did you try the online virus check? I think you have to use IE to get it.
You should really set up some DNS servers. Windows uses its own root servers by default to resolve names but its faster if you use the ones given to you by your ISP.
How do you connect to your ISP?