Avast WEBforum
Other => General Topics => Topic started by: dlane123 on November 14, 2009, 07:34:20 AM
-
Something is blocking my google search engine. Any ideas that could help me?
-
We could need a screen shot of some sort..
In the meantime, use a boot-time scan from avast!..
Report back results^^
-AnimeLover^^
-
Step 1: Windows Disk Cleanup Utility ============
1 Press Windows Key + R
2 Type in: cleanmgr
3 Put a check beside: Temporary Internet Files and Temporary Files. Optionally, you may check other options too
4 Click OK
Step 2: Hijack This (HJT) ============
1 Download Trend Micro Hijack This here (http://www.filehippo.com/download_hijackthis/)
2 Install HJT in C:\Program Files\Trend Micro\HijackThis (the location is already displayed by default). Click Install
3 HJT Window will appear. Click Do a system scan and save a logfile. A notepad file will pop-up once the scan is completed
5 Click on the Notepad window and click File > Save As and save the file on your desktop
6 Go back here on your topic and start a reply. On the Reply window, click Additional Options
7 Attach the .txt file that HJT created and saved on your desktop
NOTE: Do not have HJT fix anything yet.
-
Not sure what is meant by boot time scan. I have been with Avast for 2+ years . Just ran Avast complete scan and got no infected files.
-
For L'arc. I am confused/stuck at Step 2, #3. Is the System scan an Avast system scan? HJT loaded OK. Thanks for you help.
-
Nope, the system scan meant for Step 2 #3 is for Hijack This.
-
Attached is the log file.
-
It appears like your HOSTS file is messed up. Please go to C:\WINDOWS\system32\drivers\etc. From that folder, right click hosts and select Open. You will be presented with a software to choose for opening the file. Select Notepad then click OK. A notepad text will appear. Click Edit > Select All then press Delete in your keyboard. All the entries would be deleted. Now, copy all the contents here in the codebox:
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
then paste it on the notepad file. Click File > Save. You may now close the notepad window. Please tell us if it works.
-
To prevent further hijacks, consider installing a firewall with Outbound Protection since XP's own does not support the said feature. Examples are:
- PCTools (http://www.pctools.com/firewall/)
- Agnitum Outpost (http://www.agnitum.com/)
- Online Armor (http://www.tallemu.com/)
NOTE: Install only one firewall. Two or more firewalls will cause system instability and conflicts.
Also considering some orther optionals, you may remove Ask Toolbar from your PC (unless you intended to install it) via Add/Remove Programs.
PS: Did you happen to have AVG 9 and Norton installed before?[/list][/list]
-
@dlane123
You can't run Norton anti vrus as well as avast! as they will conflict.
You have to choose between Norton or avast!
Download and run the Norton Removal Tool:
http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039
-
L'arc. I edited hosts as per your instructs and came back with same log file. no change on this but I didn't reboot yet.
I am running Norton and Avast at the same time and as Yo Kenny suggest could this be the problem?
I will delete Ask toolbar, but I don't activate it.
Please keep helping. Thanks
-
I plan to let Norton go bye bye.
-
I still have not gotten a solution to this problem. I am still blocked out from google. Please give me some additional advice. Have taken Norton out of the picture but problem persists. I would hate to rebuild my computer to solve this problem. I can go to anyother web site but not Google. Where is this site blocked on my computer? Please help anyone.
-
We'll try doing some more extensive scans.
Step 1: Windows Disk Cleanup Utility ============
1 Press Windows Key + R
2 Type in: cleanmgr
3 Put a check beside: Temporary Internet Files and Temporary Files. Optionally, you may check other options too
4 Click OK
Step 2: avast! Boot Time Scan ============
1 Double click avast! antivirus desktop icon and wait for memory test to complete
2 avast GUI will appear. Right click anywhere on avast!'s window and select Schedule Boot Time Scan...
3 Click Advanced options and select Move infected file to Chest on the first dropdown list and leave the other one as it was. Click Schedule
4 You will be asked for a system restart. Click Yes to do it now or No to let avast wait for you to manually restart your PC
NOTE: Optionally, you may enable scanning of archive files. If it is enabled, scanning would be more thorough but would take more time
Step 3: Malwarebytes Antimalware (MBAM) ============
1 Download Malwarebyes' Antimalware here (http://www.filehippo.com/download_malwarebytes_anti_malware/)
2 Proceed to installing MBAM after downloading
3 On the last dialog box, do not forget to leave Update Malwarebytes' Antimalware and Run Malwarebytes' Antimalware checked
4 Malwabytes' Antimalware GUI would appear, from there select Perform Quick Scan and click Scan
5 When scan is completed, click Show Results
6 Click Remove Selected and then, a notepad file will appear.
7 On the notepad window, click File > Save As and save it on your desktop. You may now close MBAM.
Step 4: Hijack This (HJT) ============
1 Download Trend Micro Hijack This here (http://www.filehippo.com/download_hijackthis/)
2 Install HJT in C:\Program Files\Trend Micro\HijackThis (the location is already displayed by default). Click Install
3 HJT Window will appear. Click Do a system scan and save a logfile. A notepad file will pop-up once the scan is completed
5 Click on the Notepad window and click File > Save As and save the file on your desktop
6 Go back here on your topic and start a reply. On the Reply window, click Additional Options
7 Attach the two .txt files that we created and saved on your desktop (click more attachments to have more slots for attaching files)
NOTE: Do not have HJT fix anything yet.
-
L arc, thanks for your help. Completed all steps succesfully and here are the two resulting files. Hjackthis suggested a manual fix.
-
I see:C:\Program Files\Norton AntiVirus\Engine\17.1.0.19\ccSvcHst.exe
You can't run Norton anti virus as well as avast!
Go to Add/Remove Programs and un-install it.
Sun Java is also vulnerable and needs to be un-installed as well.
Download Norton removal as Norton is hard to remove completly:
http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039
-
Norton is uninstalled. The blocking of Google continues, but I agree I should not have two. I have been a long time user of Avast, but don't have a clue how I got into this predicament. Thanks for your suggestion Yokenny.
-
Oh forgot Yokenny, would that be Java 2 Runtime environment?
-
Did you run the Norton removal tool?
Download and run JavaRa to completely remove old Java applications:
http://raproducts.org
Install Java Version 6 Update 17:
http://www.java.com/en/download/manual.jsp
Go to Secunia Online Software Inspector then run it to see what other applications are vulnerable:
http://secunia.com/vulnerability_scanning/online
-
Yes, I used the removal tool. Will proceed with your suggests. Thanks
-
Your HOSTS file is still modified. Try fixing this entries on HJT after you uninstall Norton. To fix an entry, launch HJT > click Do a system scan only > Put a check beside these items:
O1 - Hosts: 64.86.17.56 google.ae
O1 - Hosts: 64.86.17.56 google.as
O1 - Hosts: 64.86.17.56 google.at
O1 - Hosts: 64.86.17.56 google.az
O1 - Hosts: 64.86.17.56 google.ba
O1 - Hosts: 64.86.17.56 google.be
O1 - Hosts: 64.86.17.56 google.bg
O1 - Hosts: 64.86.17.56 google.bs
O1 - Hosts: 64.86.17.56 google.ca
O1 - Hosts: 64.86.17.56 google.cd
O1 - Hosts: 64.86.17.56 google.com.gh
O1 - Hosts: 64.86.17.56 google.com.hk
O1 - Hosts: 64.86.17.56 google.com.jm
O1 - Hosts: 64.86.17.56 google.com.mx
O1 - Hosts: 64.86.17.56 google.com.my
O1 - Hosts: 64.86.17.56 google.com.na
O1 - Hosts: 64.86.17.56 google.com.nf
O1 - Hosts: 64.86.17.56 google.com.ng
O1 - Hosts: 64.86.17.56 google.ch
O1 - Hosts: 64.86.17.56 google.com.np
O1 - Hosts: 64.86.17.56 google.com.pr
O1 - Hosts: 64.86.17.56 google.com.qa
O1 - Hosts: 64.86.17.56 google.com.sg
O1 - Hosts: 64.86.17.56 google.com.tj
O1 - Hosts: 64.86.17.56 google.com.tw
O1 - Hosts: 64.86.17.56 google.dj
O1 - Hosts: 64.86.17.56 google.de
O1 - Hosts: 64.86.17.56 google.dk
O1 - Hosts: 64.86.17.56 google.dm
O1 - Hosts: 64.86.17.56 google.ee
O1 - Hosts: 64.86.17.56 google.fi
O1 - Hosts: 64.86.17.56 google.fm
O1 - Hosts: 64.86.17.56 google.fr
O1 - Hosts: 64.86.17.56 google.ge
O1 - Hosts: 64.86.17.56 google.gg
O1 - Hosts: 64.86.17.56 google.gm
O1 - Hosts: 64.86.17.56 google.gr
O1 - Hosts: 64.86.17.56 google.ht
O1 - Hosts: 64.86.17.56 google.ie
O1 - Hosts: 64.86.17.56 google.im
O1 - Hosts: 64.86.17.56 google.in
O1 - Hosts: 64.86.17.56 google.it
O1 - Hosts: 64.86.17.56 google.ki
O1 - Hosts: 64.86.17.56 google.la
O1 - Hosts: 64.86.17.56 google.li
O1 - Hosts: 64.86.17.56 google.lv
O1 - Hosts: 64.86.17.56 google.ma
O1 - Hosts: 64.86.17.56 google.ms
O1 - Hosts: 64.86.17.56 google.mu
O1 - Hosts: 64.86.17.56 google.nr
O1 - Hosts: 64.86.17.56 google.nu
O1 - Hosts: 64.86.17.56 google.pl
O1 - Hosts: 64.86.17.56 google.pn
O1 - Hosts: 64.86.17.56 google.pt
O1 - Hosts: 64.86.17.56 google.ro
O1 - Hosts: 64.86.17.56 google.ru
O1 - Hosts: 64.86.17.56 google.rw
O1 - Hosts: 64.86.17.56 google.sc
O1 - Hosts: 64.86.17.56 google.se
O1 - Hosts: 64.86.17.56 google.sh
O1 - Hosts: 64.86.17.56 google.si
O1 - Hosts: 64.86.17.56 google.sm
O1 - Hosts: 64.86.17.56 google.sn
O1 - Hosts: 64.86.17.56 google.st
O1 - Hosts: 64.86.17.56 google.tl
O1 - Hosts: 64.86.17.56 google.tm
O1 - Hosts: 64.86.17.56 google.tt
O1 - Hosts: 64.86.17.56 google.us
O1 - Hosts: 64.86.17.56 google.vu
O1 - Hosts: 64.86.17.56 google.ws
O1 - Hosts: 64.86.17.56 google.co.ck
O1 - Hosts: 64.86.17.56 google.co.id
O1 - Hosts: 64.86.17.56 google.co.il
O1 - Hosts: 64.86.17.56 google.co.in
O1 - Hosts: 64.86.17.56 google.co.kr
O1 - Hosts: 64.86.17.56 google.co.ls
O1 - Hosts: 64.86.17.56 google.co.ma
O1 - Hosts: 64.86.17.56 google.co.nz
O1 - Hosts: 64.86.17.56 google.co.tz
O1 - Hosts: 64.86.17.56 google.co.ug
O1 - Hosts: 64.86.17.56 google.co.uk
O1 - Hosts: 64.86.17.56 google.co.za
O1 - Hosts: 64.86.17.56 google.co.zm
O1 - Hosts: 64.86.17.56 google.com
O1 - Hosts: 64.86.17.56 google.com.af
O1 - Hosts: 64.86.17.56 google.com.ag
O1 - Hosts: 64.86.17.56 google.com.ar
O1 - Hosts: 64.86.17.56 google.com.au
O1 - Hosts: 64.86.17.56 google.com.bn
> Click Fix checked.
-
L arc, Thanks again. HJT sends back "For some unknown reason your system denied write access to the hosts files. HTJ suggests to run Notepad: C:\windows\system32\drivers\etc\hosts Then delete hosts and save hosts with quotes (note sure where on delete and quotes) . HTJ also suggest to delete all 01 hosts files. Your advice again, please.
-
L arc, I have tried but can't delete those hosts files. I believe they are the offending files. Please help. Thanks again.
-
@ dlane123
Are you using Vista/Windows 7?
I see that you now have more than 20 posts which will permit you to update your profile to include signature information if you like.
Go to PROFILE then Modify Profile then Forum Profile Information then Signature: and put information about your system if you like just like my sigature.
In order to modify the HOSTS file in Vista/Windows 7 you need Administrator rights.
-
Yokenny, will address Signature. I have Windows XP home. How do I get administrator rights on my home computer? Is there any way for me to delete those hosts files that I suspect are blocking my access to google? Thanks
-
Use HostsMan and substitute your hosts file by a new clean one.
http://www.abelhadigital.com/
-
To check it, click Start > Run > type in: control userpasswords2
A dialog box will appear, try to locate your username and see what is beside it.
-
Log on as an administrator
http://www.microsoft.com/windowsxp/using/setup/tips/advanced/adminaccount.mspx
-
try fixit from microsoft - a tool by microsoft to fix hosts file : http://go.microsoft.com/?linkid=9668866
you may have to have administrator rights. give it a try in limited user account and see whether it works.
nmb
-
Success. Finally, my blocking or redirect of Google problem was solved, unfortunately I am not completely sure how. Here is a summary of the action I took at the suggestions of many kind and helpful experts. I write so others that might have the problem can hopefully fix.
1. I ran Cleanmgr at run.
2. At L'arc suggestion, I forced an Avast scan and detected no infected files.
3. At L'arc suggestion, I downloaded and ran Malwarebytes (MBAM). Results, no infected files.
4. At L'arc suggestion, I ran Hijack This (HJT). HJT found (and as identified by L'arc) that there were a number of blocking hosts related to Google. Those hosts were in c:\windows\system32\drivers\etc\hosts. HJT could not fix those faulty hosts because I think they were write protected?. Anyway, I tried to manually delete the bad hosts but couldn't.
5. At Tech suggestion, I downloaded Hostman at http://www.abelhadigital.com/. I was unsure that this program helped me even though I could see the bad hosts but was unsure how to delete them. The appeared to detect the bad hosts but they came back. (RAN OUT OF ROOM MORE ON NEXT POST)
-
Success! 2 Deleted bad hosts blocking Google website 2 <continued>
6. At L'arc suggestion, I hit Start-Run <Control Passwords2> Located username and found nothing beside it. I do have administer capability.
7. At NMB suggestion. I ran Microsoft's fix it tool. http://go.microsoft.com/? linkid=9668866. This was the last action I took and after a require reboot the problem and the offending hosts were gone. I am not 100% sure this was the corrective action
I am not sure how I got into this situation. I do run Avast continuously. I am careful with contacts and don't run untrusted .exe programs. Hopefully, after these actions, my computer is healthier and more robust.
Finally, I have to give out a shout out to DavidR, Yokenny, L'arc, Tech, NMB, others. I really appreciate your help. Hopefully, I can pass it forward. Thanks Again, Dave Lane
-
You can install a good HOSTS file with HostsMan and I choose to use hpHosts plus MVPS HOSTS files.
Use HostsServer as a browser proxy to speed up browser sessions and it can be set to auto start with Windows then Start Server then set Enable log and Log referrer in Preferences to see HOSTS file's effectiveness.