Hijack This Log - Page 2

Question

kaninelupus 275 Practically a Posting Shark

15 Years Ago

As I put in my last post, you are looking in the etc folder, not the drivers folder.
c:\windows\system32\drivers\etc\hosts
Open it with notepad and copy the contents. Paste the results back here.

Just curious Crunchie - if the Hosts file was reset as instructed early on in the troubleshooting, are we looking at an issue there?? Looking over the HJT logs, am not seeing anything that would have re-added any redirects etc.

crunchie 990 Most Valuable Poster

15 Years Ago

Not sure it was carried out, that's why I want to take a look. There should be no reason why those sites should be re-directed, but it needs to be eliminated.

caveman, try the following too.

Download Delete Domains from here and run it. It will delete all entries from the trusted and restricted zone.

You will have to register to download it.

crunchie 990 Most Valuable Poster

15 Years Ago

Did you right click on deletedomains and select insta;;? It doesn't look like it :).

==

This is what the Hosts file contents should look like;

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host 

127.0.0.1 localhost

crunchie 990 Most Valuable Poster

15 Years Ago

Hmmm. Might not be compatible with Vista.

Can you post your traceroute results into a new thread in this forum; http://www.daniweb.com/forums/forum150.html as you will get ppl who know what they are looking at there :). Give you a better chance of getting your pc running right :)

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

caveman20 0 Light Poster · Answer 1 · 2009-07-28T08:55:42+00:00

Sorry I missed that Nortons Link! I have used it now though.

Here are the results from that DNS report.

Traceroute to 205.171.163.54Hop T1 T2 T3 Best Graph IP Hostname Dist TTL Ctry Time
1 3 1 * 0.8 ms 70.86.70.33 AS21844THEPLANET-AS 21.46.5646.static.theplanet.com. 255 US Unix: 2:43:12.346
2 1 1 * 0.8 ms [+0ms] 70.87.254.29 AS21844THEPLANET-AS po104.dsr02.dllstx5.theplanet.com. 0 miles [+0] 254 US Unix: 2:43:41.697
3 1 0 * 0.8 ms [+0ms] 70.85.127.109 AS21844THEPLANET-AS po52.dsr02.dllstx3.theplanet.com. 0 miles [+0] 250 US Unix: 2:43:41.722
4 0 0 * 0.8 ms [+0ms] 70.87.253.17 AS21844THEPLANET-AS et3-2.ibr03.dllstx3.theplanet.com. 0 miles [+0] 61 US [Router did not respond]
5 1 * * 1.0 ms [+0ms] 157.238.225.5 AS2914NTT-COMMUNICATIONS-2914 xe-2-4.r01.dllstx09.us.bb.gin.ntt.net. 0 miles [+0] 251 US Unix: 2:43:41.790
6 2 * * 1.3 ms [+0ms] 129.250.4.173 AS2914NTT-COMMUNICATIONS-2914 xe-1-2.r02.dllstx09.us.bb.gin.ntt.net. 0 miles [+0] 250 US Unix: 2:43:41.898
7 * * * 1.3 ms [+0ms] [Unknown] [Unknown - Firewall did not respond] 0 miles [+0]
8 1 1 * 1.3 ms [+0ms] 129.250.8.98 AS2914NTT-COMMUNICATIONS-2914 unknown.ntt.net -1 miles [+0] 0 miles [+0] 248 US Unix: 2:43:42.214
9 * * * 27 ms [+26ms] [Unknown] [Unknown - Firewall did not respond] -1 miles [+0] 0 miles [+0]
10 * * * 27 ms [+0ms] [Unknown] [Unknown - Firewall did not respond] -1 miles [+0] 0 miles [+0]
11 * * * 27 ms [+0ms] [Unknown] [Unknown - Firewall did not respond] -1 miles [+0] 0 miles [+0]
12 38 27 * 27 ms [+0ms] 205.171.5.89 AS209ASN-QWEST cdr2-core-01.inet.qwest.net. -1 miles [+0] 0 miles [+0] 243 US Unix: 2:43:42.481
13 30 * * 30 ms [+2ms] 205.171.163.54 AS209ASN-QWEST [Reached Destination]cdr2-edge-02.inet.qwest.net. -1 miles [+0] 53 US Unix: 2:43:42.531
14
15

Analysis:Number of hops: 13
Last hop responding to ICMP: 13, UDP: 12, TCP: 0.
The destination appears to block unwanted UDP packets.
There appears to be a firewall at 70.86.70.33 (hop 1) that blocks unwanted TCP packets.
Legend:
ECN was not used on the TCP packets. To use ECN, click here.
T1/T2/T3 are the round-trip times in milliseconds (1/1000ths of a second).
T1 uses a proper ICMP-based tracert (Microsoft style). T2 uses a UDP-based traceroute (Unix-style). T3 uses a TCP-based traceroute (port 80).
Since many ISPs now block ICMP and/or packets to unknown ports, T3 (rarely used by traceroute programs) typically shows the best results.
Best times may be theoretical (if it takes 80ms to hop 10, and 50ms to hop 11, we say the best time for hop 10 is 50ms).

I am not sure what I am looking for in my folder c:\windows\system32\drivers

kaninelupus 275 Practically a Posting Shark · Answer 2 · 2009-07-28T10:09:51+00:00

Easier than trying to explain, have a look at this tutorial.

Only difference I would advise is once Hosts file is located, open Notepad as Admin and drag-drop file into Notepad... this will allow saving changes in a sys-protected file

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 3 · 2009-07-28T10:31:38+00:00

I am not sure what I am looking for in my folder c:\windows\system32\drivers

As I put in my last post, you are looking in the etc folder, not the drivers folder.

c:\windows\system32\drivers\etc\hosts

Open it with notepad and copy the contents. Paste the results back here.

As far as the traceroute result stands, I am not certain exactly of it's findings. There does look to be a problem there though.
Hopefully someone with some experience in that field will take a look and respond.

caveman20 0 Light Poster · Answer 4 · 2009-07-28T16:30:30+00:00

here is the results from notepad for c:\windows\system32\drivers\etc\hosts

127.0.0.1 localhost

here are my results from delete domains.

; DelDomains.inf
; Created by: Mike Burgess Microsoft MVP
; http://mvps.org/winhelp2002/
;
; Warning: Deletes all entries in the Restricted & Trusted Zone list
;
; To execute this file: in Explorer - right-click (this file)
; Select Install from the Menu.

[version]
signature="$CHICAGO$"

[DefaultInstall]
DelReg=DelTemps
AddReg=AddTemps

[DelTemps]
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"

; Recreate the keys to avoid a restart

[AddTemps]
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"

caveman20 0 Light Poster · Answer 5 · 2009-07-28T17:50:06+00:00

In regards to the hosts file I opened it up in wordpad/notepad and that one line in my previous post is all that is in there.

When I right click on the delete domains I and select install I get the error Installation Failed???

caveman20 0 Light Poster · Answer 6 · 2009-08-05T16:59:12+00:00

Hi Crunchie and anyone else who is on here.

My computer seems to be getting worse and I was hoping we could go through some other options. I still cant get on those 2 websites and even through Internet Cloak or Hidden Cloak it doesnt accept my passwords although they work on other computers.

Sorry to get off track but now my computer seems to be running slower. can we please do a few checks to look for viruses or anything like that please?

Thanks