Author Topic: HNS_DNS_HIJACK Alert  (Read 5638 times)

0 Members and 1 Guest are viewing this topic.

Offline cdmusser

  • Newbie
  • *
  • Posts: 6
HNS_DNS_HIJACK Alert
« on: November 13, 2019, 01:17:33 PM »
Hi Everyone.
I am getting a HNS_DNS_HIJACK Alert from Avast.

I tried scanning with Malwarebytes and it comes up clean. But my free version MWB doesn't seem to allow download of scan log. Is there another way? To seek help?

I want to check if I really do have a problem.
I use TunnelBear VPN and have used Hotspot shield and Hide.me in the past.
Could these be triggering it? I just want to be sure.

Any help is much appreciated

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: HNS_DNS_HIJACK Alert
« Reply #1 on: November 13, 2019, 02:26:28 PM »
Follow the instructions here >> https://forum.avast.com/index.php?topic=194892.0
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: HNS_DNS_HIJACK Alert
« Reply #2 on: November 13, 2019, 03:56:28 PM »
Hi Everyone.
I am getting a HNS_DNS_HIJACK Alert from Avast.

I tried scanning with Malwarebytes and it comes up clean. But my free version MWB doesn't seem to allow download of scan log. Is there another way? To seek help?

I want to check if I really do have a problem.
I use TunnelBear VPN and have used Hotspot shield and Hide.me in the past.
Could these be triggering it? I just want to be sure.

Any help is much appreciated

I was on autopilot mode when I read this (I still sort of am).

Can you post a screenie (screenshot) of the Avast! detection for me? It's entirely possible that you've connected to DNS server belonging to Tunnelbear/Hotspot or Hide Me
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

Offline cdmusser

  • Newbie
  • *
  • Posts: 6
Re: HNS_DNS_HIJACK Alert
« Reply #3 on: November 14, 2019, 10:43:10 AM »
HI.
Thanks for trying.

Screenshot file limit is 1024kb... >:(
and avast is not letting me attach 831KB pic. >:( >:(

Cheers


Offline cdmusser

  • Newbie
  • *
  • Posts: 6
Re: HNS_DNS_HIJACK Alert
« Reply #4 on: November 14, 2019, 10:46:15 AM »
heres another

Offline cdmusser

  • Newbie
  • *
  • Posts: 6
Re: HNS_DNS_HIJACK Alert
« Reply #5 on: November 14, 2019, 10:47:50 AM »
And here is the last one.
Its  a long alert.

Does this help? Need anything else?

Cheers again

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37506
  • Not a avast user
Re: HNS_DNS_HIJACK Alert
« Reply #6 on: November 14, 2019, 11:26:27 AM »
Are you using free or payed avast

If payed, does message go away if you turn off avast real site?

Real site faq.  https://support.avast.com/en-ww/article/Antivirus-Real-Site-FAQ



Offline cdmusser

  • Newbie
  • *
  • Posts: 6
Re: HNS_DNS_HIJACK Alert
« Reply #7 on: November 14, 2019, 11:58:19 AM »
Hey.
I'm on Mac.
The alert first popped up with Avast Free Security. I am using trial Avast Premium Security (Different from Avast AntiVirus?) and it still pops up.

thanks for asking and help


Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: HNS_DNS_HIJACK Alert
« Reply #8 on: November 14, 2019, 06:18:34 PM »
Hey.
I'm on Mac.
The alert first popped up with Avast Free Security. I am using trial Avast Premium Security (Different from Avast AntiVirus?) and it still pops up.

thanks for asking and help

Trial Security is the Antivirus. Can you post a screenshot of your DNS Settings on your Mac and Router?

Mac >> http://kb.mit.edu/confluence/display/istcontrib/How+to+check+DNS+settings+on+Mac+OS+X+10.7
Router >> https://www.tp-link.com/us/support/faq/1710/
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

Offline cdmusser

  • Newbie
  • *
  • Posts: 6
Re: HNS_DNS_HIJACK Alert
« Reply #9 on: November 14, 2019, 11:47:34 PM »
Hey.
I was being proactice and and changed them to GoogleDNS like like.
I even rebooted the router after.
Still getting the alert
wtf :D

thanks for helping

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: HNS_DNS_HIJACK Alert
« Reply #10 on: November 15, 2019, 12:41:12 AM »
Hey.
I was being proactice and and changed them to GoogleDNS like like.
I even rebooted the router after.
Still getting the alert
wtf :D

thanks for helping

Google's DNS Servers shouldn't be causing any alerts. I suspect it's Avast! being an annoyance, but let me grab Sass Drake, see if he has any suggestions. I don't know enough about Mac's to give solid advice (we're a mostly Windows forum around here :P, and I deal primarily in Windows and Linux.)

Mac Forum, just in case >> https://forum.avast.com/index.php?board=5.0

I know on the Free version of Avast! the alerts can be annoying "Your IP is visible! Correct it now <insert buy button here> for $XX.XX"
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: HNS_DNS_HIJACK Alert
« Reply #11 on: November 15, 2019, 06:16:58 AM »
To cdmusser and Michael 9alan1998),

On a side line:
Read why TunnelBear is a questionable service:
https://restoreprivacy.com/tunnelbear/
It is McAfee's and has certain notable shortcomings.

Just wanted to let you know,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 820
Re: HNS_DNS_HIJACK Alert
« Reply #12 on: November 15, 2019, 05:34:06 PM »
Looks like Avast false alarm to me.

Offline Ivanych

  • Пенсионер.
  • Massive Poster
  • ****
  • Posts: 3517
  • СССР-Москва,ГДР-Ютербог,Россия-Ульяновск.
Re: HNS_DNS_HIJACK Alert
« Reply #13 on: May 01, 2023, 06:56:56 PM »
У меня стоит роутер-маршрутизатор TP-Link AC1200 EC220-G5
Кабель от роутера идёт к ноутбуку ASUS.
Кабель от роутера идёт к игровой консоли PS 3.
В роутере прописаны DNS 1.1.1.2 и 1.0.0.2
В ноутбуке прописаны DNS 1.1.1.2 и 1.0.0.2
В игровой консоли PS 3 прописаны DNS 1.1.1.2 и 1.0.0.2
При запуске в программе Avast Premium Security функции Защита сети происходит проверка сети.
И выдаётся результат : смотрите скрин !
Результат поражает ! В роутере защита нормальная,в игровой консоли защита нормальная.
А в ноутбуке есть Подмена DNS !!! Раз анализ показывает в роутере и в консоли защита нормальная,
то почему в ноутбуке Подмена DNS ? Ведь везде стоит DNS один и тот же.Объясните мне пожалуйста.
=================================================================
I have a router-router TP-Link AC1200 EC220-G5
The cable from the router goes to the ASUS laptop.
The cable from the router goes to the PS 3 game console.
DNS 1.1.1.2 and 1.0.0.2 are registered in the router, DNS 1.1.1.2 and 1.0.0.2
are registered in the laptop, DNS 1.1.1.2 and 1.0.0.2
are registered In the PS 3 game console, DNS 1.1.1.2 and 1.0.0.2
are registered When the Network Protection function is launched in the Avast Premium Security program.
And the result is given : see the screen !
The result is amazing ! In the router, the protection is normal, in the game console, the protection is normal.
And there is DNS Substitution in the laptop !!! If the analysis shows normal protection in the router and in the console,
then why is DNS Substitution in the laptop? After all, DNS is the same everywhere.Please explain to me.
================================================================
Менял DNS на DNS от Google,результат такой же ! Объясните пожалуйста это явление.
I changed DNS to DNS from Google, the result is the same! Please explain this phenomenon.
Я частичку своей жизни оставил в Ютербоге Германии !

Offline Ivanych

  • Пенсионер.
  • Massive Poster
  • ****
  • Posts: 3517
  • СССР-Москва,ГДР-Ютербог,Россия-Ульяновск.
Re: HNS_DNS_HIJACK Alert
« Reply #14 on: May 04, 2023, 10:27:56 AM »
Что-то никто сюда не заглядывает вообще.
А жаль !
Я частичку своей жизни оставил в Ютербоге Германии !