DNSchanger.in help please!!!

superblackeagle · Mar 29, 2007

Hi guys! I'm totaly new to this forum and I found it by scraching the net for some ways to fix a problem I have with a virus!!! The thing is I found out I had something weird going on when lately, as I' m using yahoo, google or any search engine with internet explorer, I end up beeing rederected to some porn seach engines or stuff like that?

Anyway I was wondering if someone could help me with that cause I don't realy feel like a format process!

So I'm using Avast, Spybot,Adaware and AVG anti-spyware. I also ran hijackthis and that's what came up!

Please help!

DelJo63 · Mar 29, 2007

superblackeagle said:
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8709EEC-3D6F-4F46-A489-D402D886E4B6}: NameServer = 85.255.116.92,85.255.112.68
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.92 85.255.112.68
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.92 85.255.112.68
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.92 85.255.112.68

these addresses resolve to xxx-xbox.dedi.inhoster.com

Unless this is your ISP, you need to delete these

apparently your IE home page is http://fr.yahoo.com/
so keep the first one here
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com/

but delete these
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.rd.yahoo.com/customize/ie/...arch.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com

howard_hopkinso · Mar 29, 2007

Hello and welcome to Techspot.

Your system has been hijacked.

Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

If after reading the above, you wish to clean your system, do the following.

Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish.
The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

Then, go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT, AVG Antispyware and Combofix logs as attachments into this thread, only after doing the above. Also, please attach the C:\fixwareout\report.txt.

Also, let me know the results of the AVG Antirootkit scan.

Regards Howard :wave: :wave:

This thread is for the use of superblackeagle only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

DNSchanger.in help please!!!

superblackeagle

DelJo63

howard_hopkinso

Posts: 21,238 +17

Similar threads

Latest posts