HOSTS file not working

[RJK]

I've had this before on the odd occasion but, never been able to pin it down
!

Installed new copy XP Home ed. SP2 on my Aunty's PC, ( had to telephone
activate - ...knew I should have zero-filled that hd first ! ). Not long
after completing installation and after installing mobo drivers and
ZoneAlarm free, AVG, Ewido, setting up a dial-up connection and setting IE6
Privacy to reject 3rd party cookies etc.
I tried to drag a new hosts file from my USB pen drive into the etc
directory and got "Unable to etc. ...file is locked in use..." Had to
reboot into Safe Mode to do it. (marked it read-only while I was in there).
Never had that before.

Now when visiting web pages that contain doubleclick ads. they load !
Any clues as to why gratefully accepted !

In the past, (never quite pinning it down), I remember suspecting that Proxy
settings in the dial-up connection have something to do with it. Because
FreeServe/Wanadoo has become Orange, after making her dial up connection and
getting connected, I ran the "retrieve connection" wizard from the Orange
web site, so her that proxy settings contain the most current domain name
{http://www-cache.orangehome.co.uk I noticed} and dial up telephone no.
and noticed that the "Bypass Proxy for local addresses is ticked," ...am I
digging along the right lines ? Also, do "Local Intranet" settings in IE6
| Internet Options | Security Zones paly any part ?

TIA

regards, Richard

 

[Noozer]

I've had this before on the odd occasion but, never been able to pin it
down !

Installed new copy XP Home ed. SP2 on my Aunty's PC, ( had to telephone
activate - ...knew I should have zero-filled that hd first ! ). Not long
after completing installation and after installing mobo drivers and
ZoneAlarm free, AVG, Ewido, setting up a dial-up connection and setting
IE6 Privacy to reject 3rd party cookies etc.

Lemmee guess... You were connected to the internet during your installation?
It takes <30 seconds to get infected.

 

[Larry Gardner]

More than likely, one of your newly installed programs has locked the hosts
file.

My bet is on ZoneAlarm, since it also locks certain keys in the registry and
prevents you from modifying them.

 

[Don Taylor]

Because FreeServe/Wanadoo has become Orange

....

So THAT explains the sudden spike in spam and phish from orange.fr
AND that www.orange.fr lists no abuse address anywhere.

Time to put all the orange.fr domain names in MY hosts file.

Thanks for explaining that

57044 SWEN virus received, 1730 sent from wanadoo.fr
and yes that is a completely automated virus reporting cannon.

 

[RJK]

Nope ! didn't connect until well after ZA was installed, and Hosts, and
Ewido, and AVG !

regards, Richard

 

[RJK]

As mentioned in my OP, I've come across this in the past, usually when
setting up a dial up connection, and it does appear to be some sort of
hijack, in the form of a microsoft script in the new install, that's
determined to load ?uk.msn.com web site before one is "permitted" to set a
different home page. The difference this time is that no amount of tweaking
will let me set a different home page, on this particular (mums sister's),
machine.
The URL in Internet options Home page is a long one with redir.dll to
msn.com in it - couldn't I just use hjt to knock it out, ...and the hosts
file is still not blocking ads from doubelclick. net.

I feel a zero-fill coming on ! (...so that we at least get 30 days to
activate after installation)

regards, Richard

 

[Larry Gardner]

Check these Registry keys:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

Look at these values:

Start Page
Local Page
Search Bar
Search Page

and see if anything shows up wacky.

Does this happened for all users on your system?
Does ads.doubleclick.net show in HOSTS file?

 

[RJK]

Thanks Larry, will check those next time am on that PC.

regards, Richard