MY safe zone browser hijacked! goes to fake google

[DraKuL]

Ok good. Also I would like to report a couple of more things, when this happened for the second time, as I mentioned earlier the browser didnt open automatically, but there was a browser icon on the taskbar, I have uploaded a picture  http://www.sendspace.com/file/sj1e5g << this is the link, check the bottom left, notice the taskbar.

Also I tried to switch back from SZ and got a BSOD!!! (don't know if they are related though)

The other thing, I cant access internet on my Chrome browser AND on IE! Using FF4 after the bsod.. both chrome and IE9 gives an error  about proxy..

IE9 error: I diagnosed the problems and it says,
 Problems found: The configured proxy server is not responding

Chrome also give out a similar error message but its also the same problem.. about the proxy.. but the thing is I DID NOT configure a proxy!! Could this be related to the SZ problem?  

[Gopher John]

Yesterday was Microsoft Patch Tuesday.  Those experiencing problems may have updated and restarted their machines.  One patch was for a DNS vulnerability.  Just a guess, as I'm using Avast Free which has no SafeZone browser.

Microsoft Security Bulletin MS11-030 - Critical
Vulnerability in DNS Resolution Could Allow Remote Code Execution (2509553)
http://www.microsoft.com/technet/security/Bulletin/MS11-030.mspx

The patch is for all versions of Windows.

[DraKuL]

I resolved the IE / Chrome issue, there were proxy settings added but the fields were blank.. 

[Zyndstoff (aka Steven Gail)]

Yesterday was Microsoft Patch Tuesday.  Those experiencing problems may have updated and restarted their machines.  One patch was for a DNS vulnerability.  Just a guess, as I'm using Avast Free which has no SafeZone browser.

Microsoft Security Bulletin MS11-030 - Critical
Vulnerability in DNS Resolution Could Allow Remote Code Execution (2509553)
http://www.microsoft.com/technet/security/Bulletin/MS11-030.mspx

The patch is for all versions of Windows.

Damn! You are right... yesterday was MS patchday.
That might well be the reason.

[DraKuL]

Yesterday was Microsoft Patch Tuesday.  Those experiencing problems may have updated and restarted their machines.  One patch was for a DNS vulnerability.  Just a guess, as I'm using Avast Free which has no SafeZone browser.

Microsoft Security Bulletin MS11-030 - Critical
Vulnerability in DNS Resolution Could Allow Remote Code Execution (2509553)
http://www.microsoft.com/technet/security/Bulletin/MS11-030.mspx

The patch is for all versions of Windows.

Damn! You are right... yesterday was MS patchday.
That might well be the reason.

But how could this lead to SZ redirecting to fake sites? 

[dagrev]

But how could this lead to SZ redirecting to fake sites? 
[/quote]

And not affect non SZ connections?

[disPlay]

Yesterday was Microsoft Patch Tuesday.  Those experiencing problems may have updated and restarted their machines.  One patch was for a DNS vulnerability.  Just a guess, as I'm using Avast Free which has no SafeZone browser.

Microsoft Security Bulletin MS11-030 - Critical
Vulnerability in DNS Resolution Could Allow Remote Code Execution (2509553)
http://www.microsoft.com/technet/security/Bulletin/MS11-030.mspx

The patch is for all versions of Windows.

Damn! You are right... yesterday was MS patchday.
That might well be the reason.

But how could this lead to SZ redirecting to fake sites? 

Good Question.
We will have to wait for the avast team to explore the issue.

[Asyn]

But how could this lead to SZ redirecting to fake sites? 

Sorry, we have no idea either, as we didn't get any (useable) feedback now.

[Hermite15]

But how could this lead to SZ redirecting to fake sites?  


And not affect non SZ connections?

exactly... this said, Chrome/Chromium uses all IE/Windows network settings (as opposed to Firefox), but again, just the SZ browser being affected, I seriously doubt MS updates has anything to do with that.

[DraKuL]

hmm so the bsod and the change in proxy settings were not related to this? could the bsod have caused the proxy settings change? I got the bsod right when I switched off SZ.. but do you guys reckon that it might be a random bsod?

Edit: the browsers(outside the SZ) were working fine till I got the bsod.. So I'm guessing it triggered the change in proxy settings.

[pk]

DraKuL, please follow these steps:

1. Disable avast self protection
2. If SafeZone was actived (i.e. you used it after reboot), switch to SafeZone and use Turn Off button (=> it'll terminate all running processes in SafeZone)
3. Download http://public.avast.com/~kurtin/x7.zip (14Mb)
4. Backup (= delete from original location) \Program Files\AVAST Software\Avast\sfzone\SafeZoneBrowser.exe (+ SafeZoneBrowser.dll, dnshttp.dll)
5. Unpack x7.zip into \sfzone folder
6. Switch to SafeZone, was it fixed or not?

Thanks.

[Hermite15]

hmm so the bsod and the change in proxy settings were not related to this? could the bsod have caused the proxy settings change? I got the bsod right when I switched off SZ.. but do you guys reckon that it might be a random bsod?

blue screens are related to drivers... no idea why you had one... not sure if Avast loads drivers for virtualization.

[pk]

DraKuL, you can send me the latest minidump (\Windows\Minidump folder) to my email, I'll see if it was already fixed or not.

blue screens are related to drivers... no idea why you had one... not sure if Avast loads drivers for virtualization.

aswSnx.sys

[Asyn]

DraKuL, please follow these steps:

1. Disable avast self protection
2. If SafeZone was actived (i.e. you used it after reboot), switch to SafeZone and use Turn Off button (=> it'll terminate all running processes in SafeZone)
3. Download http://public.avast.com/~kurtin/x7.zip (14Mb)
4. Backup (= delete from original location) \Program Files\AVAST Software\Avast\sfzone\SafeZoneBrowser.exe (+ SafeZoneBrowser.dll, dnshttp.dll)
5. Unpack x7.zip into \sfzone folder
6. Switch to SafeZone, was it fixed or not?

pk, I hope you have a shorter/easier fix at hand...!!
Not every user is able to do this.

[DraKuL]

DraKuL, please follow these steps:

5. Unpack x7.zip into \sfzone folder

Windows wont let me delete/overwrite SZ folder.. Folder/File access denied.. Tried running windows explorer as admin still wont let me overwrite the files..