1

My Windows XP hosts file has been tampered with, and I can't fix it. This is particularly bad because whatever tampered with the hosts file left these:

...
188.124.7.190 www.google.com 
188.124.7.190 google.com 
188.124.7.190 google.com.au 
188.124.7.190 www.google.com.au
188.124.7.190 google.be 
188.124.7.190 www.google.be
...

If I understand this correctly the hosts file is responsible for mapping IP addresses to names, correct? It appears that someone went through the effort of mapping google (all languages), bing and yahoo all to one ip address but whatever server my google searches were being routed to has been taken down, thus cutting me off from any form of search engine whatsoever. I had to log in to Super User with my Wordpress account just so I could post this.

I've tried manually deleting those lines from the hosts file but for some reason I'm unable to save it. I'm running as Administrator right now, and I've tried this in safe mode as well, nothing I've tried works. It's worth mentioning now that I disabled System Restore. Could anyone help?

edit: I've already tried running AV and anti-malware, Spybot S&D couldn't touch the hosts file either.

eleven81
  • 16,182
user27210
  • 13

10 Answers10

4

You've got a virus, or some other intruder. My advice is to backup, disconnect from the Internet, reformat and reinstall your operating system. Consider your Wordpress password (and indeed, all of your other passwords you may have recently typed into that computer) compromised; whatever software is rewriting your hosts file may contain a key logger.

You might consider disconnecting that machine from the Internet to research the symptoms and see if you can conclusively determine the source of intrusion, but I would strongly advise against using the computer for anything else in the meanwhile. Until it's disconnected, consider all your actions and the contents of that machine to be visible to some hostile 3rd party.

A quick check shows that the address in question is actually serving up Google's content more or less seamlessly, with the exception that they're using a self-signed SSL certificate. I would change all of your passwords, especially for google.com and gmail.

user229044
  • 407
1

This is typical of many malware apps. Do you have a good AV installed and up to date? Use other tools like Spybot Search and Destroy, Adaware amd Malwarebytes to scan. I would use all three. Double check that system restore is off and stays off. Be aware that some malware will block you from these sites and AV sites so you may have to download and install from alternate medis.

MalwareBytes

Spybot

Adaware

Dave M
  • 13,250
1

Note: This answer will not help you fix the problem. It is a stopgap only.

Until this is fixed, should you need to google, enter any of google's IP addresses in your address bar.

C:\>nslookup www.google.com
*** Can't find server name for address 10.2.1.3: Non-existent domain
*** Default servers are not available
Server:  UnKnown
Address:  10.2.1.3

DNS request timed out.
    timeout was 2 seconds.
Non-authoritative answer:
Name:    www.l.google.com
Addresses:  74.125.45.103, 74.125.45.104, 74.125.45.105, 74.125.45.106
          74.125.45.147, 74.125.45.99
Aliases:  www.google.com


Edit: To search, you'll need to manually build your query.

For example:

http://74.125.45.103/search?q=dns+hijack+problem
eleven81
  • 16,182
1

I recommend trying to use some live Linux distributions to startup your computer - these distros run directly from the CD. They can read the Windows partition, and often write to it as well.

Be warned however that you can really mess up your computer if you don't know what you are doing or don't know how to use Linux. I can recommend Puppy Linux bas quite a user friendly distro with its own browser and other essential tools. It should be seen as a temporary solution, but may be a lifesaver!

A good feature is that you can move files and take backups from your hard drive into a USB hard drive without needing Windows.

Gareth
  • 19,080
Victor Mena
  • 11
1

I used winternals, found the Hosts file in C:\windows\system32\drivers\etc. proceeded to delete the file and then created a new one. Afterwards rebooted, ran all the anti malware and spyware removers.

AL1
  • 11
0

You could try running ComboFix on your computer. This may fix the problem, some sort of malware.

eleven81
  • 16,182
0

If you have already done all the anti malware tools (and I advise you follow these steps), then the virus is most likely taken care of.

After this, if it is strictly a permission issue; it could be that the malware changed the file permissions.

Simply right click on the file and go to Properties. Go to the Security Tab and add check what is set to denied, and uncheck them as well as making sure that you have full permissions.

The defaults for the hosts file should look like this:

alt text

alt text

alt text

If it is not a permission issue, and/or if you are still having trouble after this, download Microsoft / Sysinternals Process Explorer, go to search/find and type hosts. It should be able to tell you which process is locking the file. This may be something innocent such as AV or similar, or it could be more malicious and be a result of malware still being present.

Community
  • 1
William Hilsum
  • 117,648
0

Get to another computer and download the programs Combofix and SmitFraudFix. Boot into safe mode and run both. This should fix the problem.

Gareth
  • 19,080
Carl Croom
  • 81
0

Some malware creates a new rogue hosts file with attributes making it a hidden protected system file. In order to see it and delete it, uncheck Hide protected operating system files under Folder Options in the Control Panel.

Rename the file to hosts.old and reboot.

Delete the file using Malwarebytes > More Tools > File Assassin. Then create a new hosts file.

(See: How can I reset the Hosts file back to the default?)

wonea
  • 1,877
Rik
  • 1
-1

Microsoft has this tutorial for you:

How do I reset the hosts file back to the default?

If necessary, do this in Safe Mode.