Blocked 78.110.175.21 and bogus google links

[zone12]

antivirus 2009 is a rouge get rouge remover from the maware's bytes site that should handle it

[bahog]

seems a little too easy once you get the right file haha

It does seem a little bit easy, but two days on and the Google re-directions and the Avast warning haven't returned. I'm happy.

bahog

[rebies]

Phil, you are not the only one this "miracle fix" is not working for.

This poped up on my system about 2 hours ago and I deleted the file, but to no avail.  Actually I tried backing up and deleting the file under C:\Windows\System32\Drivers as well, but it would just pop back in.  (184k)   YES, I read and deleted the other one in System32\ as well, that did not work.  The file is 184k everywhere I see it, such as in C:\Windows\Driver Cache\amd64\driver.cab, C:\Windows\Driver Cache\amd64\sp2.cab, C:\Windows\ServicePackFiles\amd64\sp2.cab.

AVG Antivirus - nothing
Malwarebytes - nothing

I'm running Windows XP Professional x64 Edition, so I tried cleaning the file out of the C:\Windows\SysWOW64 directory as well.  Nope, no luck.

The only way I got anywhere, when I delete the file in under C:\Windows\System32\Drivers and time it right, I can go to Google and get CSS and HTML errors.  So something here is controlling it for sure.  Using a web sniffer program I can definately see the IP addresses in question people are talkign about.  7.7.7.0, etc.

[daryl]

Hi all

I am getting the Blocked 78.110.175.21 warnings but only when I go to a particular (bone fide) website. I am assuming that it is site that is infected rather than me. I have seen the scummy antivirus 2009 (XP and all the other variants) on loads of other machines, and the redirects.

Increasingly though I am seeing the same scumbags hacking the htaccess files in the root of the sites so that google searches for those sites are redirected to antivirus 2009 reseller sites.

Well done avast for picking it up

[DavidR]

Well unless that legit site has been hacked, that might merely be a coincidence, but at least avast is blocking as you say.

What is the site URL ?
Change the http to hXXp or put a [break] inside the URL so it isn't active exposing anyone to possible risk, e.g. hXXp://suspect[break]site.com.