Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a laptop that has some sort of malware infection. I can't contact microsoft.com, symantec.com and so on. I've checked the HOSTS file, but there are no unusual entries. By what other means might a piece of malware orchestrate such an effect? I've not taken any measures yet to clean up the infection, but am interested in understanding this mechanism before I clean it up.

EDIT: As mentioned in a comment below, nslookup against the configured DNS server yields the correct results.

share|improve this question
add comment

6 Answers

up vote 4 down vote accepted

seems like conficker

here is more info and removal tools for conficker. http://en.wikipedia.org/wiki/Conficker

share|improve this answer
    
From the wikipedia link: "An in-memory patch is also applied to the system resolver DLL to block lookups of hostnames related to antivirus software vendors and the Windows Update service." This looks like the droid I'm looking for. Will investigate this avenue. Thanks for the tip. –  user12575 Sep 28 '09 at 14:18
    
It looks like this was the right one. Running Sophos conficker kit has turned up an infection. Going to do a scan from a BartPE bootdisc to flush out any other stuff, but imagine that I will probably end up reformatting. Bah. Cheers. –  user12575 Sep 28 '09 at 16:38
add comment

This actually sounds like an issue I had with a DNS changer infection. It was actually a Trojan horse described http://www.spywareremove.com/removednschanger.html where it would change my DNS settings and causing internet connection issues. Also, that System Security 2009 is not a real antispyware program, it is a fake. You will want to scan your system with a real antimalware program to clean it off of those files causing this issue. Good luck!

share|improve this answer
add comment

Generally it is usually just the hosts file. Sometimes they may try and change your actual network DNS server settings to a different (hacked) DNS server, so that may be worth a try.

Also, try going to command prompt and type

netsh int ip reset

This should reset the ip stack on your machine, but only use as a last resort.

share|improve this answer
1  
The hosts file may be found on "C:\Windows\System32\drivers\etc\hosts". Ensure that it only contains "127.0.0.1 localhost" and "#::1 localhost". –  harrymc Sep 28 '09 at 13:59
    
I didn't add that as in the question, he already said he checked the hosts file - but still, good to see it - +1 –  William Hilsum Sep 28 '09 at 14:02
add comment

There are LOTS of places thse buggers can hide themselves. They could have installed some hooks into your browser/browsers. There could also be a program similar to Dell/Google's Search Help installed. As Wil said, there's also DNS settings they could have hacked, they could be sending you through a proxy. There could be a rootkit that has your kernel all FUBAR'd. If you had an idea of what you had run into, that would also be a big help if figuring out where it was dug in.

Good luck.

share|improve this answer
    
It's definitely borging my DNS, which doesn't resolve to a few specific sites. nslookup against my configured DNS server does however produce the correct results. I'll probably end up reformatting, because I don't hold much trust in malware removal nowdays. –  user12575 Sep 28 '09 at 14:03
    
Yes, formatting is a good idea after a Malware infection. –  Powerlord Sep 28 '09 at 15:44
add comment

First, define the malware. Then delete it. It is wrong to work on the symptoms when you know you have a problem. Start with /root!

share|improve this answer
add comment

This sounds like something I dealt with "System Security 2009"... Take a look at Trojan.Poison.J.

Part of the problem is that I believe it adds a BHO, that will automatically bounce you to a "This web page is hazardous message, any time you go to the Antivirus (or Microsoft's) web site. Darn effective, and annoying.

If you are quick, you can see Windows Update load, and then it loads a different page as the BHO bounces you.

Original source here: http://blog.plaitsolutions.com/2009/09/25/update-to-previous-post-on-emails-that-are-bogus.aspx?ref=rss

So, here's what you do if this vile piece of malware is inhabiting your PC (read this through carefully before starting the work):
Removing System Security 2009 manually******:

1.  Boot into Safe Mode.

2.  Browse to and remove the following files:

C:\Documents and Settings\All Users\Application Data\00308937*\pc00308937ins*
C:\Documents and Settings\All Users\Application Data\00308937*\00308937.exe*
C:\Documents and Settings\All Users\Application Data\00308937*\config.udb
C:\Documents and Settings\{your username directory}**\Desktop\System Security 2009.lnk
C:\Documents and Settings\{your username directory}**\Start Menu\Programs\System Security\System Security 2009 Support.lnk
C:\Documents and Settings\{your username directory}**\Start Menu\Programs\System Security\System Security 2009.lnk
* - The number in this command (00308937) may not be the actual number you see in the directory.  If so, replace that number with the one in the directory.

** - replace "{your username directory)" with the name of the user's folder under Documents and Settings.  For example, my username is "Sid", so the path to the System Security 2009.lnk file would be:

 C:\Documents and Settings\Sid\Desktop\System Security 2009.lnk
3.  Delete the following registry entries:

HKEY_LOCAL_MACHINE\Software\00308937*
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run “00308937″*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemSecurity2009
* - The number in these registry entries (00308937) may not be the actual number you see in the directory.  If so, replace that number with the one in the directory (the same one you used in the previous step).

****** - Manual removal of System Security 2009 is a dangerous task if you aren't familiar with the registry.  If you remove the wrong keys, you could cause your computer to stop working. While it has worked in every case for me so far, the malware may reappear.  I suggest you either use an automated tool or call a professional to remove it.
share|improve this answer
    
This proved to be a blind alley (it affected everything, not just IE and its BHO stuff), but thanks for your time anyway –  user12575 Oct 1 '09 at 8:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.