computer help - possible hack related

markh · **Joined:** 13th Oct, 2008 **Posts:** 903

Help me Hive mind, my computer knowledge is turd, and i think something is up!
Right, when i go to google.co.uk, i notice advanced search is spelt advansed, also its copyright 2009 i use my other computer and it's spelt correctly and c2010!
Also suddenly it's also stopped running windows update too....
I've run my mcafee full scan and it finds nothing! Noithing else seems wrong but this is odd.

Any help welcome (other than 'nuke from orbit')

Thanks!

throughsilver · **Joined:** 30th Mar, 2008 **Posts:** 6197

I found this from here:

Quote:

Your DNS (Domain Name Server) has been corrupted by Malware.

Control Panel > Network Connections > Right click Internet Connection > Properties > Internet Protocol > Properties.

Now is it set to Use the following DNS server addresses - with some odd values in the fields?

Try setting it to "Choose DNS server address automatically" which is the usual setting.

See if that works.

Doctor Glyndwr · **Joined:** 30th Mar, 2008 **Posts:** 32624

Also type windows+r and paste this command

Code:

notepad C:\Windows\System32\drivers\etc\hosts

and copy and paste the contents of that file into this thread.

kalmar · **Posted:** Thu Mar 25, 2010 10:28

Doctor Glyndwr wrote:

copy and paste the contents of that file into this thread.

*closes browser in panic*

markh · **Joined:** 13th Oct, 2008 **Posts:** 903

Sounds good, Ahem, being particularly dense though, do you know the path to that place in Windows 7?

zaphod79 · **Joined:** 16th Apr, 2008 **Posts:** 14537

throughsilver wrote:

I found this from here:

Quote:

Your DNS (Domain Name Server) has been corrupted by Malware.

Control Panel > Network Connections > Right click Internet Connection > Properties > Internet Protocol > Properties.

Now is it set to Use the following DNS server addresses - with some odd values in the fields?

Try setting it to "Choose DNS server address automatically" which is the usual setting.

See if that works.

Could also be a hacked hosts file

http://en.wikipedia.org/wiki/Hosts_file

Or more complex , worth checking your AV is actually up to date (perhaps manually updating it) - and depending on how much you have on the machine you actually care about a nuke from orbit is often a good step in these circumstances.

Cras · **Joined:** 30th Mar, 2008 **Posts:** 49252

markh wrote:

Sounds good, Ahem, being particularly dense though, do you know the path to that place in Windows 7?

Same place.

zaphod79 · **Joined:** 16th Apr, 2008 **Posts:** 14537

markh wrote:

Sounds good, Ahem, being particularly dense though, do you know the path to that place in Windows 7?

%SystemRoot%\system32\drivers\etc\hosts

markh · **Joined:** 13th Oct, 2008 **Posts:** 903

throughsilver wrote:

I found this from here:

Quote:

Your DNS (Domain Name Server) has been corrupted by Malware.

Control Panel > Network Connections > Right click Internet Connection > Properties > Internet Protocol > Properties.

Now is it set to Use the following DNS server addresses - with some odd values in the fields?

Try setting it to "Choose DNS server address automatically" which is the usual setting.

See if that works.

Sorry i meant the path to the above.
Heres the results from the good doctors advice:
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
::1 localhost

Cras · **Joined:** 30th Mar, 2008 **Posts:** 49252

Well that's all fine.

Doctor Glyndwr · **Joined:** 30th Mar, 2008 **Posts:** 32624

HAHAH HE FELL FOR IT. NOW LET'S PWN HIS BOX.

Ahem. I mean, that's fine. No problems in the hosts file. Load a command prompt (windows+r, cmd) and run

Quote:

ipconfig /all

then paste the results here.

Zardoz · **Posted:** Thu Mar 25, 2010 10:42

Send up a drone and get Chloe to frownpout. NOW!

markh · **Joined:** 13th Oct, 2008 **Posts:** 903

Here we go, don't be too cruel...!
Incidentally i just can't get on with Win7 control panel - no idea where that throughsilver's suggestion bit is hidden.

Doctor Glyndwr · **Joined:** 30th Mar, 2008 **Posts:** 32624

Those two DNS servers, 93.188.162.97 and it's brother, are the source of one of your problems. The issue here is you never know how many other bad things have been done to the machine at the same time.

You can easily fix this and remove them, but if it were me, I would reinstall Windows from scratch. I'd never trust any program on that machine again.

markh · **Joined:** 13th Oct, 2008 **Posts:** 903

Merci, much appreciated. How would i do this in the interim, as i have a ton of music to back up which is a weekend job!

TheVision · **Posted:** Thu Mar 25, 2010 10:49

Great advert for McAfee there...

markh · **Joined:** 13th Oct, 2008 **Posts:** 903

Correct, don't think i'll bother with that again... Don't even do much on that computer, just run itunes/internet browse. Hardly got or installed any programs...

Cras · **Joined:** 30th Mar, 2008 **Posts:** 49252

markh wrote:

Incidentally i just can't get on with Win7 control panel - no idea where that throughsilver's suggestion bit is hidden.

Start -> Network (on the right) -> Manage Network Connections (on the left).
Right click on the one that calls itself the "nVidea nForce Networking Controller" and select properties.

Doctor Glyndwr · **Joined:** 30th Mar, 2008 **Posts:** 32624

Control panel | Network and Internet | View Network Status and Tasks

Look for a connection called "Local Area Connection", click it, click Properties, click "Internet Protocol Version 4 (TCP/IP)", click Properties, and in the dialog you should see "Use the following DNS server addresses" populated with these bad numbers.

Replace them with Google's DNS: 8.8.8.8 and 8.8.4.4.

Then reboot and repeat the above steps. I think you'll find the DNS will have changed back to the bad servers, but I hope I'm wrong.

Cras · **Joined:** 30th Mar, 2008 **Posts:** 49252

Craster wrote:

markh wrote:

Incidentally i just can't get on with Win7 control panel - no idea where that throughsilver's suggestion bit is hidden.

Start -> Network (on the right) -> Manage Network Connections (on the left).
Right click on the one that calls itself the "nVidea nForce Networking Controller" and select properties.

Yeah, ignore this. For some reason I thought my Vista machine was my Win7 machine. Do what the Doc says.

TheVision · **Posted:** Thu Mar 25, 2010 10:54

Incidently, I've always used Bullguard as my virus software. I buy it every year from Amazon for about £20 and it does a great job.

It might be worth considering after the reinstall.

Doctor Glyndwr · **Joined:** 30th Mar, 2008 **Posts:** 32624

Oh, and if you don't have the data backed up, then you don't care about it. Treat every hard disk in your life as if it is about to fail at any second. Sure, you'll grouse now at having to spend £50-100 on a new backup drive, and then when a hard drive does fail, it'll be the best money you've ever spent.

markh · **Joined:** 13th Oct, 2008 **Posts:** 903

Yep, i have itunes on a seperate hard drive backed up, but the back up needs replacing!
Incidentally the 'bad numbers' fix worked so google is correct if nothing else, curse those 'bad numbers'

Many many thanks, and a tactical nuking to order...

Grim... · **Posted:** Thu Mar 25, 2010 11:04

Attachment:

windows2.png

Tabs are a good thing, yo.

markh · **Joined:** 13th Oct, 2008 **Posts:** 903

I can never get on with tabs, another sign of my luddite-ness I guess!

Fantastically that resetiing of DNS seems to have done a trick, windows update kicked in, mcafee update kicked in...

Thanks again

Grim... · **Posted:** Thu Mar 25, 2010 11:11

Doctor Glyndwr wrote:

I'd never trust any program on that machine again.

While your updates are now coming through, that's still the case.

Be Excellent To Each Other

computer help - possible hack related

Who is online