I'm probably overlooking something but I need help. I have a PC, which
was full of Viruses and Malware, but is now clean. I can run a scan of
several different virus engines and it detects nothing. So with that
being said, why can I not get to certain websites? Windows Update is
one, and if you try to go to safer-networking.org it takes you to a
totally different site. When trying to get to Windows Update it shows
IP 127.0.0.1 which is the loopback address. I checked my host file and
it is clean. Where is IE picking up this 127.0.0.1 from?

Already did. It's clean.

John Corliss wrote:
> Gre0145 wrote:
> > I'm probably overlooking something but I need help. I have a PC, which
> > was full of Viruses and Malware, but is now clean. I can run a scan of
> > several different virus engines and it detects nothing. So with that
> > being said, why can I not get to certain websites? Windows Update is
> > one, and if you try to go to safer-networking.org it takes you to a
> > totally different site. When trying to get to Windows Update it shows
> > IP 127.0.0.1 which is the loopback address. I checked my host file and
> > it is clean. Where is IE picking up this 127.0.0.1 from?
>
> Check your hosts file. It might be blocking those sites.
>
> --
> John Corliss

Even though your computer may be clean, some settings were probably changed
by the malware. I would run an XP repair. But this is all just my opinion.

"Gre0145" <(E-Mail Removed)> wrote in message
news:80a8b276-8aec-4b03-ac5f-(E-Mail Removed)...
> I'm probably overlooking something but I need help. I have a PC, which
> was full of Viruses and Malware, but is now clean. I can run a scan of
> several different virus engines and it detects nothing. So with that
> being said, why can I not get to certain websites? Windows Update is
> one, and if you try to go to safer-networking.org it takes you to a
> totally different site. When trying to get to Windows Update it shows
> IP 127.0.0.1 which is the loopback address. I checked my host file and
> it is clean. Where is IE picking up this 127.0.0.1 from?

I've ran the XP repair. I too, thought that would fix but did not.

Lisa wrote:
> Even though your computer may be clean, some settings were probably changed
> by the malware. I would run an XP repair. But this is all just my opinion.
>
> "Gre0145" <(E-Mail Removed)> wrote in message
> news:80a8b276-8aec-4b03-ac5f-(E-Mail Removed)...
> > I'm probably overlooking something but I need help. I have a PC, which
> > was full of Viruses and Malware, but is now clean. I can run a scan of
> > several different virus engines and it detects nothing. So with that
> > being said, why can I not get to certain websites? Windows Update is
> > one, and if you try to go to safer-networking.org it takes you to a
> > totally different site. When trying to get to Windows Update it shows
> > IP 127.0.0.1 which is the loopback address. I checked my host file and
> > it is clean. Where is IE picking up this 127.0.0.1 from?

"GlowingBlueMist" <(E-Mail Removed)> wrote in message
news:ga8jj1$134$(E-Mail Removed)...
> "Gre0145" <(E-Mail Removed)> wrote in message
> news:e9f5ba75-b391-424d-b0b8-(E-Mail Removed)...
>> I've ran the XP repair. I too, thought that would fix but did not.
>>
>> Lisa wrote:
>>> Even though your computer may be clean, some settings were probably
>>> changed
>>> by the malware. I would run an XP repair. But this is all just my
>>> opinion.
>>>
>>> "Gre0145" <(E-Mail Removed)> wrote in message
>>> news:80a8b276-8aec-4b03-ac5f-(E-Mail Removed)...
>>> > I'm probably overlooking something but I need help. I have a PC, which
>>> > was full of Viruses and Malware, but is now clean. I can run a scan of
>>> > several different virus engines and it detects nothing. So with that
>>> > being said, why can I not get to certain websites? Windows Update is
>>> > one, and if you try to go to safer-networking.org it takes you to a
>>> > totally different site. When trying to get to Windows Update it shows
>>> > IP 127.0.0.1 which is the loopback address. I checked my host file and
>>> > it is clean. Where is IE picking up this 127.0.0.1 from?
>
> Verify the DNS servers listed with an "ipconfig /all" are still your true
> DNS servers and not some malware site redirecting your outbound attempts.
>
> Possibly a tracert or two to known sites will help identify if your
> outbound attempts are actually making it outside your system.
>
> Verify that your actual hosts file is being used and not some other file
> hidden elsewhere on your system. Try replacing your existing hosts file
> with one that includes just the loopback entry and one other. The second
> entry would be a redirection of a site your existing computer setup can
> still reach, but redirect it to the loopback address. If your still reach
> the site you will at least have a starting point for your research.
>

One last thought, replace the loopback address in your hosts file with a
known good IP address, like one going to www.google.com [64.233.197.99] (one
that shows up here during a ping check) and see of the site currently going
to your loopback address turns up going to Google. If not, your hosts file
is not actually being used by the system.
>

Very good ideas. I will try them out this afternoon. Thanks!!!

GlowingBlueMist wrote:
> "GlowingBlueMist" <(E-Mail Removed)> wrote in message
> news:ga8jj1$134$(E-Mail Removed)...
> > "Gre0145" <(E-Mail Removed)> wrote in message
> > news:e9f5ba75-b391-424d-b0b8-(E-Mail Removed)...
> >> I've ran the XP repair. I too, thought that would fix but did not.
> >>
> >> Lisa wrote:
> >>> Even though your computer may be clean, some settings were probably
> >>> changed
> >>> by the malware. I would run an XP repair. But this is all just my
> >>> opinion.
> >>>
> >>> "Gre0145" <(E-Mail Removed)> wrote in message
> >>> news:80a8b276-8aec-4b03-ac5f-(E-Mail Removed)...
> >>> > I'm probably overlooking something but I need help. I have a PC, which
> >>> > was full of Viruses and Malware, but is now clean. I can run a scan of
> >>> > several different virus engines and it detects nothing. So with that
> >>> > being said, why can I not get to certain websites? Windows Update is
> >>> > one, and if you try to go to safer-networking.org it takes you to a
> >>> > totally different site. When trying to get to Windows Update it shows
> >>> > IP 127.0.0.1 which is the loopback address. I checked my host file and
> >>> > it is clean. Where is IE picking up this 127.0.0.1 from?
> >
> > Verify the DNS servers listed with an "ipconfig /all" are still your true
> > DNS servers and not some malware site redirecting your outbound attempts.
> >
> > Possibly a tracert or two to known sites will help identify if your
> > outbound attempts are actually making it outside your system.
> >
> > Verify that your actual hosts file is being used and not some other file
> > hidden elsewhere on your system. Try replacing your existing hosts file
> > with one that includes just the loopback entry and one other. The second
> > entry would be a redirection of a site your existing computer setup can
> > still reach, but redirect it to the loopback address. If your still reach
> > the site you will at least have a starting point for your research.
> >
>
> One last thought, replace the loopback address in your hosts file with a
> known good IP address, like one going to www.google.com [64.233.197.99] (one
> that shows up here during a ping check) and see of the site currently going
> to your loopback address turns up going to Google. If not, your hosts file
> is not actually being used by the system.
> >

Hi,

I can't remember where but, in the past I had to clean entries out of the
registry on system heavily abused by malware.
Usually when a system has been abused like this I recommend reinstalling the
OS and core productivity apps but, I know it isn't always feasible to do this
in the real world.
Search for entries relating to sites you can't get to in the registry and if
you are lucky; the redirections haven't been written in hex.

> ...I have a PC, which
> was full of Viruses and Malware, but is now clean. I can run a scan of
> several different virus engines and it detects nothing.

That does NOT mean the computer is clean! You have much more work to do:

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a thorough check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://spywarehammer.com/simplemachi...php?board=10.0, or other
appropriate forums for review by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Gre0145 wrote:
> I'm probably overlooking something but I need help. I have a PC, which
> was full of Viruses and Malware, but is now clean. I can run a scan of
> several different virus engines and it detects nothing. So with that
> being said, why can I not get to certain websites? Windows Update is
> one, and if you try to go to safer-networking.org it takes you to a
> totally different site. When trying to get to Windows Update it shows
> IP 127.0.0.1 which is the loopback address. I checked my host file and
> it is clean. Where is IE picking up this 127.0.0.1 from?

Gre0145 wrote:
>
> I'm probably overlooking something but I need help. I have a PC, which
> was full of Viruses and Malware, but is now clean. I can run a scan of
> several different virus engines and it detects nothing. So with that
> being said, why can I not get to certain websites? Windows Update is
> one, and if you try to go to safer-networking.org it takes you to a
> totally different site. When trying to get to Windows Update it shows
> IP 127.0.0.1 which is the loopback address. I checked my host file and
> it is clean. Where is IE picking up this 127.0.0.1 from?

That's because even if you remove viruses and malware you installed, the
damage they cause very often cant be repaired. No program available can
repair virus/trojan/malware damage. That is why it's best to NOT install
any viruses/malware/trojans in the first place. It's all up to you.

--
http://www.bootdisk.com/