Host Files Have Been Hacked

S

Susan

Every time I try to access www.msn.com, I get the
following error. Also, each time I reboot, my homepage
has been changed. I ran a full virus scan with Norton
Internet Security and it came back clean, but I think
something is out there. Any assistance would be greatly
appreciated.
_

If you see this page your hosts file has been hacked.
Please use the instruction below to clean your machine.

You cannot reach the site you where trying to reach
without following this procedure! - Please follow the
steps provided in this document and make sure to download
all patches for your computer from the Windows Update
Site which can be found here:
http://windowsupdate.microsoft.com

1. Start regedit,
find
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersio
n\Run ,
delete starting of svchost.exe file,
reboot your computer,
delete file svchost.exe in windows directory.

2. Reboot windows and start in
SAFE MODE (F8 key on keyboard before windows starting),
delete file winlogon.exe in directory: C:\Documents and
Settings\All Users\Start Menu\Programs\Startup

3. Clear your 'hosts' file.
How to edit your hosts file: locate it first, either by
browsing to the directory (as shown above) or by
hitting "Start - Search - select all files and folders -
type in 'hosts' (without the quotation marks) and hit
search. When the file is found, click with your right
mouse button on the file and select 'Open With...' This
will bring up a list of programs to edit the file with.
Select Notepad from that list and click OK. - Remove all
lines from the file and type in: 127.0.0.1 localhost. Now
close the file and save your changes.


For Windows XP machines: Locate the file hosts in your
C:\Windows\System32\Drivers\Etc directory. Just delete it
or edit it with a text editor like notepad and make sure
there is only one line there:
127.0.0.1 localhost
 
M

Mike Burgess

Susan,
NAV as with most other AV apps, do not detect trojans very well.
The instructions should work, but just to be safe follow-up with:

Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-15-03]
Please post replies to this Newsgroup, email address is invalid
 
S

Susan

Thanks for the quick response, Mike. I'll give it a try.

Susan
-----Original Message-----
Susan,
NAV as with most other AV apps, do not detect trojans very well.
The instructions should work, but just to be safe follow- up with:

Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
_________________________________________________________ ___
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-15- 03]
Please post replies to this Newsgroup, email address is invalid
--

Every time I try to access www.msn.com, I get the
following error. Also, each time I reboot, my homepage
has been changed. I ran a full virus scan with Norton
Internet Security and it came back clean, but I think
something is out there. Any assistance would be greatly
appreciated.
_

If you see this page your hosts file has been hacked.
Please use the instruction below to clean your machine.

You cannot reach the site you where trying to reach
without following this procedure! - Please follow the
steps provided in this document and make sure to download
all patches for your computer from the Windows Update
Site which can be found here:
http://windowsupdate.microsoft.com

1. Start regedit,
find
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersio
n\Run ,
delete starting of svchost.exe file,
reboot your computer,
delete file svchost.exe in windows directory.

2. Reboot windows and start in
SAFE MODE (F8 key on keyboard before windows starting),
delete file winlogon.exe in directory: C:\Documents and
Settings\All Users\Start Menu\Programs\Startup

3. Clear your 'hosts' file.
How to edit your hosts file: locate it first, either by
browsing to the directory (as shown above) or by
hitting "Start - Search - select all files and folders -
type in 'hosts' (without the quotation marks) and hit
search. When the file is found, click with your right
mouse button on the file and select 'Open With...' This
will bring up a list of programs to edit the file with.
Select Notepad from that list and click OK. - Remove all
lines from the file and type in: 127.0.0.1 localhost. Now
close the file and save your changes.


For Windows XP machines: Locate the file hosts in your
C:\Windows\System32\Drivers\Etc directory. Just delete it
or edit it with a text editor like notepad and make sure
there is only one line there:
127.0.0.1 localhost


.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads


Top