Cannot connect to security related sites. Please help.

Discussion in 'other security issues & news' started by tzic, Sep 14, 2003.

Thread Status:
Not open for further replies.
  1. tzic

    tzic Registered Member

    Joined:
    Sep 14, 2003
    Posts:
    12
    I am trying to connect to www.norton.com and I get messagebox that asks for username and

    a password in order to connect to ftp.symantec.org I also try to connect to

    www.mcafee.com and I get another messagebox that asks for username and paswword in order

    to connect to mcafee.com. The same thing happens when I try to connect to www.sarc.com

    (Norton) or www.helpvirus.com or any other virus related site. Does anyone have any

    suggestions? It is beginning to drive me crazy....

    I can visit any other page on the internet.... My system is winXP

    regards,
    tzic
    www.tzic.com
     
  2. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hi Tzic welcome to the forum!
    sounds sad; please have a look in this thread as it looks the same issue! Hope it helps! http://www.wilderssecurity.com/showthread.php?t=13664
    Please tell us if this solves your problem!
     
  3. tzic

    tzic Registered Member

    Joined:
    Sep 14, 2003
    Posts:
    12
    Thank you Jooske, following the threads instructions I managed to solve the problem..!

    tzic
     
  4. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Ahhhh i'm so glad you did! And thanks for telling us!
    Congratulations! Now make sure you have a clean restore point from here (make it manually) if ever needed for anything; you mighyt like to give it a descriptive name indicating this is a clean safe restore point to use.
     
  5. tzic

    tzic Registered Member

    Joined:
    Sep 14, 2003
    Posts:
    12
    I dont know how to create a restore point... :-( Can you take a look at http://www.wilderssecurity.com/showthread.php?t=13664;start=15 at my last reply where I list the contents of thr host file and tell me what you think?
     
  6. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hi, i hope somebody can walk you through doing so on an XP system, i see one for win ME which might not be much different i hope here with images; once you're in that system restore area you have the option to create manually a new restore point.


    I looked at that quotelf which seems rather abused; googled for that name and i see more examples like your host file with the same kinds of additions and the whole lot which Pieter described.
    What surprises me, there is a HOSTS file and i thought what you showed (as well as the other people) would have been a manipulated Hosts.Sam file and if a sam file would be a sample and not to run why does it run or was this an addition to the original HOSTS file?

    I hope the quotelf stocks info itself was not infected and causing this, or in combination with some vulnerability or infection either from a website or via email nasties.
    Did the properties of that manipulated HOSTS file say a last modification date?
     
  7. tzic

    tzic Registered Member

    Joined:
    Sep 14, 2003
    Posts:
    12
    the file was:

    -created: Thursday, August 23, 2001, 2:00:00 PM

    -Modified: Monday, June 23, 2003, 12:16:13 AM (on my birthday..?)

    -Accessed: Today, September 15, 2003, 3:36:20 AM

    What should I do now? Actually there is no "host" file because I renamed it to host.bak Should I create or download another one?
     
  8. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    If you like you could create a new HOSTS file; not sure what you like to put in it; there are a few sites about it with updates for thousands of sites we don't want to know about. The HOSTS file is discussed in the forum too occasionally.


    A very belated happy birthday!

    Is there a possibility to do in Windows a search/find for files modified or created on that same date?
    It could have been an infected "happy birthday" e-card for instance. So look for emails from that date and a day before and in all the system. In the "find" you can sort them on date/hour so look for that time of modification and around.

    I remember there were articles of compromised hosts around 15 june, and the JS/Fortnight was doing such things too, adding a hosts file to the windows directory with bunches of redirections (mostly p0rn sites)
     
  9. tzic

    tzic Registered Member

    Joined:
    Sep 14, 2003
    Posts:
    12
    thank you Jooske, everything works fine.. :)

    tziC
     
Loading...
Thread Status:
Not open for further replies.