Member Avatar for kedarc68

Hi all.

I have this peculiar problem, that all popular antivirus sites have been redirected to localhost (127.0.0.1). My computer has Windows XP prof. SP2.

I've checked the hosts file (windows\system32\drivers\etc), and it is fine. I next checked the system for virus with latest stinger, it didn't find anything wrong.

I can browse non antivirus sites, email sites, but not antivirus sites. Even when I am not connected to internet, I can ping antivirus sites like symantec.com, , trendmicro.com, safer-networking.org, etc. I get a reply from 127.0.0.1. Now, even my Norton Antivirus 2008 says it need activation again. Without a connectivity to symantec.com, I can't do anything about it.

Has anybody faced a similar situation? Actually, I found one unwanted (Actually, it is not signed by Microsoft) file called "csrcs.exe" getting loaded through registry (HKLM\Microsoft\Current Version\Run), and removed the entry and renamed the file. On googling the file, I found that it is some type of a spyware.

I am left without protection, and am in danger. Pls reply.

  • 7 Contributors
  • 13 Replies
  • 286 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by ibcoloder

Dani AI

Generated

Short expert summary and follow‑ups (adds to and ): the symptom — multiple AV vendor hostnames resolving to 127.0.0.1 even when other sites work — indicates name resolution is being intercepted on the machine (or upstream). In this case the stray autorun entry for csrcs.exe was almost certainly the culprit and an anti‑malware removal (as reported by and confirmed by ) restored normal resolution. For completeness, the following diagnostic checks and remediation steps help find the exact interception point and prevent re-infection.

Common causes

  • tampered hosts file or persistent hosts-like replacement
  • a local proxy/redirector or malicious service binding to loopback
  • Winsock/LSP or DNS client hijack by malware
  • router/DNS server hijack (less common but possible)

Useful diagnostics (run from an elevated prompt)

ipconfig /displaydns        (see Windows DNS cache entries)
ipconfig /flushdns          (clear cache)
nslookup example.com        (queries DNS server directly — helps distinguish hosts vs DNS)
netstat -ano | find "127.0.0.1"   (look for local processes bound to loopback)
tasklist /FI "PID eq <pid>"      (map PID to process)
netsh winsock reset         (repair Winsock/LSP; reboot after)

Practical next steps

  • Inspect startup entries, services, scheduled tasks and drivers (Sysinternals Autoruns is useful) and remove anything matching the suspicious csrcs.exe or unknown items.
  • If a local process is listening on loopback and returning 127.0.0.1, identify its executable, stop the service, then quarantine and remove it.
  • After cleanup, reset WinSock and flush DNS, then recheck resolution with nslookup.
  • If malware resists removal or rootkit behavior is suspected, scan from clean rescue media or offline environment and consider rebuilding the system if persistence cannot be eliminated.

Notes and cautions

  • Back up the hosts file before editing.
  • Changes to router DNS or malicious proxy settings on the router can affect all LAN machines — verify router settings if multiple clients are affected.
  • The thread’s outcome shows an anti‑malware sweep removed the persistent redirect; however, following the above checks reduces risk of recurrence and helps identify the infection vector.

Recommended Answers

All 13 Replies

Member Avatar for caperjack

try a scan with this program ,.
Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.

Member Avatar for kedarc68

Jack,

It worked. It got installed, updated and found a dozen errors. After removing them and on restarting them, I could actually connect to other antivirus websites and got NAV 2008 reactivated.

Thanks friend.

Kedar.

Member Avatar for caperjack

Jack,

It worked. It got installed, updated and found a dozen errors. After removing them and on restarting them, I could actually connect to other antivirus websites and got NAV 2008 reactivated.

Thanks friend.

Kedar.

your welcome ,good to hear it solved you problem .

Member Avatar for Frank Wallis

CaperJack thanks for sharing this
link but I wanted to know that how come
this user was able to ping the anti-virus
websites inspite of not being connected to
internet?

Member Avatar for caperjack

CaperJack thanks for sharing this
link but I wanted to know that how come
this user was able to ping the anti-virus
websites inspite of not being connected to
internet?

hi,you need to re-read there first post ! they could get on the net ,just not popular antivirus sites .
also i don't see where they say anything about pinging web sites

Member Avatar for thomas72

try a scan with this program ,.
Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.

Hi jack, i faced a similar problem. And when i wanted to download from majorgeeks.com, i was similarly prevented from going in. Any other link or sites i can download the malwarebytes? Pls help.
Thanks.
thomas

Member Avatar for caperjack

Hi jack, i faced a similar problem. And when i wanted to download from majorgeeks.com, i was similarly prevented from going in. Any other link or sites i can download the malwarebytes? Pls help.
Thanks.
thomas

you may have to download it on another computer ,http://www.malwarebytes.org/
as the trojans you have will likely stop you from getting it from any site ,also try the link in my signature for superyantispyware ,

Member Avatar for thomas72

Hi jack, i faced a similar problem. And when i wanted to download from majorgeeks.com, i was similarly prevented from going in. Any other link or sites i can download the malwarebytes? Pls help.
Thanks.
thomas

Hi Jack, thanks for prompt reply.
I managed to download the file from another PC and saved to my thumbdrive; but it won't start the installation. Seems like whatever trojan/virus in my laptop is not allowing the mbam-setup.exe from executing. What else can i do?
pls advise

Member Avatar for Thinka

Hey thomas

Have you tried copying from your removable drive to your desktop and installing from there? If that doesn't work, how about superantispyware? If the malware is preventing those as well, a system repair might be the last option.

Member Avatar for caperjack

Hi Jack, thanks for prompt reply.
I managed to download the file from another PC and saved to my thumbdrive; but it won't start the installation. Seems like whatever trojan/virus in my laptop is not allowing the mbam-setup.exe from executing. What else can i do?
pls advise

hi just change the name of the EXE file .i call mine .biteme.exe

Member Avatar for misterken

Hi Jack, thanks for prompt reply.
I managed to download the file from another PC and saved to my thumbdrive; but it won't start the installation. Seems like whatever trojan/virus in my laptop is not allowing the mbam-setup.exe from executing. What else can i do?
pls advise

Renaming the setup file worked for me to get it installed.

But then the main exe was being blocked, but again, renaming the exe got it running.

Member Avatar for thomas72

hi just change the name of the EXE file .i call mine .biteme.exe

hi jack n misterken, thanks for advice. I did just that, by renaming the setup file to install and renaming the exe file to run program. It was successful. Now everything is good Thanks for advice again
thomas

Member Avatar for ibcoloder

Another trick for you - you can run Malwarebytes in Safe Mode. between that and the rename, you should almost always be able to get it to run.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.