Member Avatar for chessermom

I am getting redirected to random websites when I click on search engine links and I also get a "Failed to Connect" message when I try to access anti virus web sites. My AVG earlier today detected "trojan horse SHeur:chkn" today.
AVG and my computer freezes up before i can clear any of this up. I tried clicking on some of the links to download that were mentioned in other post regarding the same issue but i can't because of the failed to connect message.

Any suggestions what i can do?
Thanks!

  • 4 Contributors
  • 7 Replies
  • 276 Views
  • 22 Hours Discussion Span
  • Latest Post Latest Post by Bob_180_Bob

Dani AI

Generated

Short expert summary and next steps tailored to what’s already been posted by , , and .

The symptoms you describe — browser redirects on search clicks, inability to reach antivirus web sites and an AVG detection of a heuristic trojan — match a class of kernel/network rootkits (TDSS/Alureon-style) that intercept networking calls and block security tools. That explains why editing the hosts file or checking DHCP/DNS looked normal but the problem persisted. (bleepingcomputer.com)

Practical priority one: scan from outside the infected OS. Use a known-clean PC to download a vendor rescue image, create bootable media, boot the infected machine from that media, update signatures, and run a full on-disk scan (this avoids any malware that hides itself while Windows is running). Vendor rescue/live tools to consider are ESET SysRescue and Kaspersky’s rescue/virus-removal tools — create USB/CD on a clean machine and run from there. (eset.com)

Check the local network stack and the router next. Compromised home routers or malicious DNS/proxy settings can also redirect or block access; if a router is old or remotely manageable, do a power cycle, review the router’s DNS and admin settings from a separate clean device, disable remote management, update firmware or factory-reset and set a new strong admin password if anything looks suspicious. The FBI/IC3 and router security researchers document this class of router/DNS abuse. (ic3.gov)

Inspect and repair the Windows network stack and startup persistence (only after rescue-scans or from Safe Mode): reset the Winsock/TCP stack, and use Sysinternals Autoruns and Process Explorer to find nonstandard autostart entries, drivers or suspicious processes added by the malware. Example command to run in an elevated command prompt to reset Winsock is shown below (Microsoft documents this sequence); reboot after running it. (learn.microsoft.com)

netsh winsock reset

If offline rescue media removes nothing or the system is unstable, backup personal data from a rescue environment and plan a clean reinstall or professional removal — persistent kernel/rootkit infections can be extremely difficult to remove while the OS is running.

Recommended Answers

All 7 Replies

Member Avatar for HoustonIT

Your hosts file has probably changed. go to c:\windows\system32\drivers\etc (it may be hidden) and open the hosts file with notepad. The only entry is usually the 127.0.0.1 localhost address. Delete anything below that.

Member Avatar for chessermom

When i checked the host file this is what it showed me.

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# # source server
# x.acme.com # x client host

127.0.0.1 localhost

Member Avatar for Freaktech

Open a command prompt and type ipconfig /all. Post the results.

Member Avatar for chessermom

Is this whta you wanted me to do?


Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\HP_Administrator>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : Chesser
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : hsd1.tx.comcast.net.

Ethernet adapter Local Area Connection 4:

Connection-specific DNS Suffix . : hsd1.tx.comcast.net.
Description . . . . . . . . . . . : Realtek RTL8169/8110 Family Gigabit
Ethernet NIC
Physical Address. . . . . . . . . : 00-1A-4D-7C-DC-CB
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . :
Subnet Mask . . . . . . . . . . . :
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . :
DNS Servers . . . . . . . . . . . :


Lease Obtained. . . . . . . . . . : Tuesday, September 09, 2008 1:10:58
PM
Lease Expires . . . . . . . . . . : Wednesday, September 10, 2008 8:06:2
6 AM

C:\Documents and Settings\HP_Administrator>

Member Avatar for Freaktech

Your DNS looks good. Hmm. Open command prompt and type ipconfig /flushdns. See if this helps.

Member Avatar for HoustonIT

Can you run avg in safe mode?

Member Avatar for Bob_180_Bob

While they get a working solution to fix your PC try:-

Rather than type out a page of information for different problems, I have listed a lot of easy fixes below. A lot of problems can be fixed with a simple solution, please try to one or, if necessary, all of the following to try and get your PC working again. Start at the first, working your way to the last, that is, if you are able to access the programs shown. If you know your way around a PC, I am sorry for the full details but this is to help people that don’t know how.

Check Disk

1. Right click your disk drive icon (normally “C”),
2. Click “Properties.”
3. Click “Tools”
4. In “Error checking” click “Check Now”
5. Check the 2 boxes, “Automatically fix file system errors” and “Scan for and attempt recovery of bad sectors”
6. Click “Start”
7. At the pop-up window “The disk check could not……” Click “Yes”
8. Re-boot your PC and allow disk checker to start. (Do not press any key before it starts)


Check Disk from Boot

1. Re-boot PC, after the single “Beep” tap F8 several times until the windows boot window appears.
2. Scroll to “Safe Mode with command prompt”
3. At command prompt Type “ chkdsk /f” (Note;- Space after chkdsk.)


Alternative Start Mode

1. Re-boot PC, after the single “Beep” tap F8 several times until the windows boot window appears.
2. Scroll to “Start with last known good configuration.)
3. Press “Enter”

Or
4. Re-boot PC, after the single “Beep” tap F8 several times until the windows boot window appears.
5. Scroll to “Safe Mode” (With networking, if you want to access the internet)
6. Press “Enter”


Verify Window’s Files

1. Go “START”, “RUN” type “CMD” Press “OK” or Boot PC into “safe mode with command prompt”
2. Type sfc /scannow /f (note:- space after sfc)
3. Windows file protection will check your files. Follow any prompts; you may be required to use your XP CD.
4. Re-boot your PC

System Restore from boot

1. Re-boot PC, after the single “Beep” tap F8 several times until the windows boot window appears.
2. Scroll to “Safe Mode” and press “Enter”
3. A window will open asking if you want to use “System Restore”
4. Select “Cancel” to enter “System Restore”
5. Ensure “Restore to an earlier time” is checked and click “Next”
6. Select an earlier date when your PC worked well. (Must be a highlighted date)
7. Click “Next”
8. Allow system restore and reboot.
9. Check to see if problem still exists.

System Restore

1. Go “Start”
2. “All programs”
3. “Accessories”
4. “System tools”
5. “System Restore”
6. Ensure “Restore to an earlier time” is checked and click “Next”
7. Select an earlier date when your PC worked well. (Must be a highlighted date)
8. Click “Next”
9. Allow system restore and reboot.
10. Check to see if problem still exists.


Clean Boot

1. Go “Start”
2. “Run”
3. Type “msconfig”
4. Click “OK”
5. Click “Services”
6. Check box “Hide all Microsoft services”
7. Click “Disable All”
8. Click “Apply”
9. Click “Restart”
10. System will reboot, Check if problem still exists. (Do not access the internet or open any file you are unsure of as you have no virus protector running.)
11. If problem is fixed, enable the disabled items 1 at a time until you find the one causing the problem. If not fixed, re-enable all and re-boot.

On-line Virus Scan

Go to one or all of these sites and do an online virus scan.

housecall.trendmicro.com

us.mcafee.com/root/mfs/default.asp

Check Malware

Go to http://www.besttechie.net/tools/mbam-setup.exe
and download and run Malwarebytes' Anti-Malware.

Check Spyware

Go to www.safer-networking.org and download and run Spybot

If you have not installed Service Pack 3 yet, do a Windows repair, if you have installed it, first try…..

Post a detailed report

Go to:- www.majorgeeks.com/download3155.html download and run Hijack this. “Do not try to do any repairs yourself.” Save the report and send it with your next post along with any error logs.
To check error logs, go to “START” “RUN” type “eventvwr.msc” Click “OK” and check if there any errors in the logs. Include any information that could help:-
1. What were you doing on the PC when the problem occurred?
2. Does it happen every time you do this?
3. What progs are running as well?
4. What have you done to fix this problem?
5. How long has the problem been happening?
6. Have you installed/uninstalled or updated any progs recently?
7. Any other information that may help resolve your problem. Remember, no one here can see your PC; you are the only one that can tell someone else about the problem.


To Repair Windows XP from your XP CD…..

1. Re-start PC with XP CD in drive (Have your serial number handy)
2. As your PC starts press “F12” for boot menu (Or what your PC may ask for)
3. Scroll to and select “boot from CD.”
4. At prompt “Press any key to boot from CD” Press “Any key”
5. In the Windows XP Setup window, Press “Enter” to set up windows XP, (Don’t worry, this is a repair only, not a fresh install.)
6. At next window, Press “F8” to accept license agreement
7. Wait until windows displays your current version of XP and asks “To repair the selected windows XP installation press R”
8. Press “R”
9. Enter serial number when prompted.
10. Wait for files to be copied (PC will indicate 39 mins, it will take a lot less.)
11. When asked to adjust Regional language options, click “Next” as it is still set.
12. PC will re-boot.
13. If you have AVG Free, copy serial number to a file as you will lose it on repair. After repair a window will pop up asking how you want to treat AVG, Click repair and when prompted enter serial number.
14. Check to see if problem still exists.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.