Possible Hosts File Corruption ??

GunJack

Guys'n'gals,

looking for some opinion on this, it's a wierd one.....but to cut a long story short.....

guy's pc keeps having it's wireless connection reset after trying to log into ebay via a link on his favourites. After ruling out a hardware problem, I'm sure it's a dodgy link, and I'm now beginning to think his Hosts file has been corrupted by a previous infection, and which is directing the browser to a rogue site which is somehow causing the disconnect.

This always goes hand-in-hand with then being unable to flush the DNS cache as the connection is repaired. I've rooted out a likely fix for the DNS issue and am comfortable with checking/editing the hosts file, however I really need to get to the cause of the initial disconnect.

All this is made more difficult to diagnose as all work has to be done on-site as he runs his business with it so doesn't like it to be removed, so actual contact time is limited to an hour or two in the evenings.

Anyone got any thoughts ??

davb

Maybe worth checking the DNS server settings - I have seen some odd things happen when nasties change it to a rogue DNS server - which can redirect to wherever.

aliEnRIK

If you run a quick scan with DR WEB it should give you the option of putting the hosts file back to how it should be

aliEnRIK

Or a quicker way ~


Download HostsXpert
http://www.softpedia.com/get/Security/Security-Related/Hoster.shtml
and then follow the below steps.

* Unzip HostsXpert.zip
* It will create a folder named HostsXpert in whatever folder you extract it to.
* Run HostsXpert.exe by double clicking on it.
* click the Make Writeable? button.
* click Restore Microsoft's Hosts File and then click OK.
* Click the X to exit the program

GunJack

thanks guys

davb, I have already checked out the DNS settings, all fine.

RIK - nice one !! had forgotten about hostsxpert - was going to manually edit it back to scratch, but might just give hx a whirl

Must admit, if sorting out the hosts file and DNS cache issue (along with binning all his old Favourites links) don't work, I may just have run out of ideas with this one

Really don't fancy a fresh installation due to the amount of "work" stuff he's got on there....so if there's anything else I may have missed, please feel free to shout...

davb

Not much else I can think of, as I presume you have done all of the usual scans. You could look at scanning from a boot CD in case something is really hiding.
With the hosts file, take a look at it before repairing, as it may give a clue - there should only be one or two loopback addresses active.
The DNS issue could be caused by the DNS Client service being disabled - the startup is usually set to Auto, but it is sometimes disabled - which would just mean there would be no local cache, and it would have to look down the line every time. You may get a bit more info by trying to flush it manually at a command prompt with 'ipconfig /flushdns'

aliEnRIK

Try a combofix log and post it?

GunJack

davb wrote: »

Not much else I can think of, as I presume you have done all of the usual scans. You could look at scanning from a boot CD in case something is really hiding.
With the hosts file, take a look at it before repairing, as it may give a clue - there should only be one or two loopback addresses active.
The DNS issue could be caused by the DNS Client service being disabled - the startup is usually set to Auto, but it is sometimes disabled - which would just mean there would be no local cache, and it would have to look down the line every time. You may get a bit more info by trying to flush it manually at a command prompt with 'ipconfig /flushdns'

dav - the DNS client is on my list to check again, but I'm sure I've already reset it once. Although I did find a tip somewhere that if you don't hit Start again AFTER you've reset to Auto or Manual, the setting may not take. Thanks.

GunJack

aliEnRIK wrote: »

Try a combofix log and post it?

May have to try this again...have already combofixed it as part of the initial clearout. Will hold off until after I've checked the DNS and Hosts issues. It's sooooo annoying, as everything else on the pc is now running sweetly

Will let you know how it goes.....

aliEnRIK

Try LSPFIX too ~
http://www.cexx.org/lspfix.htm

GunJack

thanks guys...I'll be getting my hands on it over the weekend....see what happens....