virus, or something

November 30, 2006

I’ve got a virus, or something. Any co.uk site I go to redirects me to a junk site. I’ve run a Norton virus scan and cleared my cache, neither of which has helped. I switched off some things in msconfig, which also didn’t help.

I’m running search-and-destroy spyware software right now, but does anybody have any ideas on what bug I might be suffering from here? Help me, Livejournal, you’re my only hope!

33 thoughts on “virus, or something”

  1. Once Sypbot Search and Destroy is done, go get Ad-Aware from http://www.lavasoftusa.com/ too and run that. S&D and AA seem to find different things sometimes.

    But it sounds very much like you have spyware/adware vs. a virus.

    It is possible though less likely that either the master DNS for the co.uk is messed up or that the DNS cache of your local ISP is contaminated. If you have another computer, try using to see if it can correctly resolve a co.uk name. If so, then the problem’s localized to your computer likely spy/adware.

  2. It’s me; Ted’s computer is reaching co.uk sites just fine. Thanks; I’ll grab AA when I’m done running S&D.

  3. Since it’s just your computer, (and not your ISP), try a different browser (IE or Firefox). That might be a clue.

    One thing to check is if your browser is going through a proxy to 127.0.0.1 or localhost. If that’s the case, then probably some spyware running on your box is grabbing all the .uk traffic and redirecting it. I’ve seen this sort of thing before.

    Can you go to a command window and do a ping or a traceroute to the UK hosts? That might turn up a clue. Try using the IP address that a ping returns instead, and see if that works.

    Good luck! These things can be hard.

  5. Have you tried the MS Malicious Software Removal tool? Dunno if that might help. Also, take a gander in your HOSTS file and see if there’s soemthing funky in there.

    Good luck!

  7. I tried another browser earlier and it’s happening with it, too. How do I check the proxy?

  10. OK, Ted’s OK, you’re not, it’s probably your machine rather than the ISP DNS server (or the DNS server suffered temporarily, and was OK again before Ted asked it).

    If your machine is a Windows box, try typing ipconfig /flushdns at the command line.

    Our work DNS server got poisoned a week or two back, and I was ending up in thw wrong place when going to google.com or google.co.uk. (google.ie was fine.)

    Only by going to the DNS server, flushing its cache and then flushing my machines own cache did the effect go away (a colleague also experienced it, and had to do the same thing).

    Maybe, we’ll see more of this in months to come, because I’d never experienced it before, and now you’ve had it too.

  11. You’re mistaking us for people who continue to give a shit about the inner workings of computers. :)

  12. It is, and I did, but it doesn’t seem to have helped. I haven’t rebooted yet, though…

  13. Depends on what browser you are using. Though if I remember right you are usign Firefox.

    In Firefox bring up the options dialog (Tools Menu, Options). Go to the General Tab. Click the COnnection Settings Button. The radio buttons will tell you if you are using a proxy. If ‘Direct Connection to Internet’ is selected, there is no proxy involved.

  15. In that case.. if anyone suggests using the program Hijack This… please don’t. Great tool, but if you don’t know what you are doing with it, major badness can occur.

  16. I was happily browsing listmania! lists on Amazon, and I stumbled upon quite a few that had Urban Shaman on them, Including one enthusiastically called “14 BEST IN PARANORMAL ROMANCE!!!!!!!” or something like that.

    Just thought it might make you feel nice. The lister does qualify that your book was not technically a paranormal romance per se, but that it had elements of both genres, and was so good OMG that it had to make the list.

  19. jupk.com seems to be the underlying thing. the actual domain remains a co.uk one in my nav bar, and the name on the page varies.

  21. If all else fails, there’s AVG anti-virus. The latest free version has always been good at finding the virus for me. Sometimes it can’t fix it for me, but it’ll give me a name of the virus I can look up with another computer and find step by step instructions for manual removal.

    I hope you get it sorted out soon. :(

  23. Right.. it most likely took over the place of your dns. If Ted can run Hijack This on your PC, have him take out any nameserver references.

  26. Oops, quick glance had me mistaking wolfsilveroak’s comment about husband, to be a post from mizkit.. negate that thought then.

  27. What you’re describing is dns cache poisoning, which is nicely obnoxious; I dealt with it at a babyasp a few years back.

    Kit seems to be describing a more localized issue; her hosts file may have been redirected. This is just a guess, and I could be wrong. :)

  28. Could be, could be. Certainly, flushing the cache should fix it if it had been poisoning, and it didn’t.

    Without access to the machine, it’s difficult for eaither of us to be sure.

  29. rotten luck. try MajorGeeks‘ support forum under help & technical info >> malware removal. I use it from time to time. It’s a solid process thats fairly well laid out, but for those who aren’t on speaking terms with the bits n bytes of computers i’d suggest they lean on the experience of familiar gurus. I have used the forum and followed the process many times to help friends with an assortment of troubles (virus, malware, spyware, browser hijackers, etc). They have links to all the tools, AND they tell you how to use them in the most effective order. Hope it helps. Sorry your computer got sick cousin o’ mine. Best of luck.

  31. Possibly this weekend we can catch each other at Incar and you can walk me through trying to fix the hosts file. Thus far nothing else has worked, anyway.

  33. You are back from Costa Rica? Cause I had to listen to Erik whine.
    <3u! mean it!

Comments are closed.