# Some malware prevents me from accessing antivirus sites **URL:** \ **Category:** Factual Questions\ **Created:** [August 21, 2008, 4:59am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769 "2008-08-21T04:59:33Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [August 21, 2008, 4:59am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/1 "2008-08-21T04:59:33Z")
I recently got a number of malwares, which, I suspect dowloaded other malwares. Yesterday, one of them began blocking me access to antivirus sites, like for instance AVG. I just couldn’t access the pages. Superantispyware got me rid (apparently) of all those it could detect except one. This malware job seems to be to display adds on the sites I visit, for instance an add telling me I won something at the bottom of the straightdope pages (FTR, it’s Adware.vundo variant) I’m not sure how I’m going to get rid of this one, but I suspect it’s not the malware that blocked the access to antivirus pages in the first place. Still, I can’t access them. Instead of them being blocked, I’m now redirected to other pages and supposed search engines. Assuming that I’m right (that the malware I still have isn’t the cause), is it possible that the others, now presumably eliminated, malwares have modified some settings in my browsers or somewhere else that I could now change back? If so, where should I look for? ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [August 21, 2008, 5:44am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/2 "2008-08-21T05:44:10Z")
[QUOTE=clairobscur] Assuming that I’m right (that the malware I still have isn’t the cause), is it possible that the others, now presumably eliminated, malwares have modified some settings in my browsers or somewhere else that I could now change back? If so, where should I look for? [/QUOTE] Get your hands on malwarebytes anti malware and sdfix. SDFix rips vundo several new assholes, and the malware byte product seems to cover some of the gaps in the usual suspects like avg. > **[All-in-One Protection: Antivirus, VPN & Scam Guard | Best Antivirus](https://www.malwarebytes.com/)** > > Malwarebytes official site: all-in-one cybersecurity software for all your devices. We provide antivirus, anti-malware, VPN and scam detection for PCs, Macs and mobile devises. Powerful digital protection, always by your side. [http://www.bleepingcomputer.com/files/sdfix.php](http://www.bleepingcomputer.com/files/sdfix.php) ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [August 21, 2008, 6:22am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/3 "2008-08-21T06:22:20Z")
[QUOTE=drachillix] Get your hands on malwarebytes anti malware and sdfix. SDFix rips vundo several new assholes, and the malware byte product seems to cover some of the gaps in the usual suspects like avg. > **[All-in-One Protection: Antivirus, VPN & Scam Guard | Best Antivirus](https://www.malwarebytes.com/)** > > Malwarebytes official site: all-in-one cybersecurity software for all your devices. We provide antivirus, anti-malware, VPN and scam detection for PCs, Macs and mobile devises. Powerful digital protection, always by your side. [http://www.bleepingcomputer.com/files/sdfix.php](http://www.bleepingcomputer.com/files/sdfix.php) [/QUOTE] I can’t access to these pages, either. Actually, since I wrote my OP, I noticed that there are more webpages than I thought where I was denied access : anti-malware forums, computer security sites, sites where I should be able to download tools useful against malwares like the ones you linked to, symantec, hijackthis, fixs for vundo… ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [August 21, 2008, 6:24am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/4 "2008-08-21T06:24:44Z")
Just to add : I’m denied access with both IE and Firefox ---
**Author:** ![Hirka\_T\_Bawa](https://avatars.discourse-cdn.com/v4/letter/h/db5fbb/32.png) [@Hirka\_T\_Bawa](https://boards.straightdope.com/u/Hirka_T_Bawa)\ **Post date:** [August 21, 2008, 6:39am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/5 "2008-08-21T06:39:46Z")
Could the malware have changed your host file? You could try deleting the file, but I don’t know what happens when you do… I’m running Windows XP, and the file is located in C:\windows\system32\drivers\etc File name is “hosts.” (no extension) Because I don’t know what would happen if your delete it in its entirety, here is a copy of my file: > [@](#): > > # Copyright (c) 1993-1999 Microsoft Corp. > > # > > # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. > > # > > # This file contains the mappings of IP addresses to host names. Each > > # entry should be kept on an individual line. The IP address should > > # be placed in the first column followed by the corresponding host name. > > # The IP address and the host name should be separated by at least one > > # space. > > # > > # Additionally, comments (such as these) may be inserted on individual > > # lines or following the machine name denoted by a ‘#’ symbol. > > # > > # For example: > > # > > # 102.54.94.97 [rhino.acme.com](http://rhino.acme.com) # source server > > # 38.25.63.10 [x.acme.com](http://x.acme.com) # x client host > > 127.0.0.1 localhost ---
**Author:** ![crowmanyclouds](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/crowmanyclouds/32/19884_2.png) [@crowmanyclouds](https://boards.straightdope.com/u/crowmanyclouds)\ **Post date:** [August 21, 2008, 6:47am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/6 "2008-08-21T06:47:02Z")
Sounds like changes were made in your [HOSTS file](http://en.wikipedia.org/wiki/Hosts_file) (lots of links to visit at the bottom). Ya might want to start with the [Security Now! podcast page](http://www.grc.com/sn/notes-045.htm) on the HOSTS file (link goes to the notes page, the actual podcast is [here](http://www.grc.com/securitynow.htm#45)) for the basics on the HOSTS file. Some anti-malware programs monitor and/or prevent changes to the HOSTS file ([Spybot S&D](http://www.safer-networking.org/en/index.html), [Spyware Blaster](https://www.javacoolsoftware.com/sbdownload.html), etc), some of the start-up monitors do too ([WinPatrol](http://www.winpatrol.com/) does for sure) and there are custom HOSTS files like [_Mike’s Ad Blocking Hosts file_](http://www.everythingisnt.com/hosts.html) among [others](http://en.wikipedia.org/wiki/Hosts_file#Custom_hosts_files) which block ads and malicious sites. CMC +fnord! Reading your last bunch of posts to this thread I’d try seeing if you can even get into the file (Windows NT/2000/XP/2003/Vista: %SystemRoot%\system32\drivers\etc\ is the default location, which may be changed. The actual directory is determined by the Registry key \HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath. Windows 95/98/Me: %WinDir%) some malware locks the file and if you can’t access it then you can be pretty certain that’s what happened. ---
**Author:** ![Washoe](https://avatars.discourse-cdn.com/v4/letter/w/ecae2f/32.png) [@Washoe](https://boards.straightdope.com/u/Washoe)\ **Post date:** [August 21, 2008, 7:03am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/7 "2008-08-21T07:03:34Z")
[QUOTE=drachillix] Get your hands on malwarebytes anti malware and sdfix. SDFix rips vundo several new assholes, and the malware byte product seems to cover some of the gaps in the usual suspects like avg. [/quote] I’m going to try both of these tomorrow. I’ve resigned myself to believing that’s there’s nothing that will kill vundo. It’s like Chucky—you can burn it, stab it, shoot it, pour sulfuric acid _and_ several different experimental fluorine compounds on it, and even force it to watch a Britney Spears video in an unending loop for several days straight, _and it will not die_. If these really work, I will build a four-inch statue of you in earthquake paste and affix it to the top of my processor. ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [August 21, 2008, 7:03am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/8 "2008-08-21T07:03:46Z")
[QUOTE=drachillix] Get your hands on malwarebytes anti malware and sdfix. SDFix rips vundo several new assholes, and the malware byte product seems to cover some of the gaps in the usual suspects like avg. > **[All-in-One Protection: Antivirus, VPN & Scam Guard | Best Antivirus](https://www.malwarebytes.com/)** > > Malwarebytes official site: all-in-one cybersecurity software for all your devices. We provide antivirus, anti-malware, VPN and scam detection for PCs, Macs and mobile devises. Powerful digital protection, always by your side. [http://www.bleepingcomputer.com/files/sdfix.php](http://www.bleepingcomputer.com/files/sdfix.php) [/QUOTE] OK. I could download malwarebytes from a french website (and was also able to access AVGFrance, by the way) Malwarebytes found a dozen more malwares, including apparently the one that prevented me from accessing malware related sites. That’s the first time I see a malware that tries to prevent you from healing malwares. I assume it includes a list of the main sites the victim is likely to try to access and blocks them, but probably (and fortunately) only sites in English are included. Fuckers! :mad: :mad: This problem at least is dealt with. I’m still stuck with the adds provided by vundo, though. This one wasn’t healed (I remember having a hard time getting rid of an older version of it a couple years ago). I’ll try sdfix next and look for other anti-vundo tools, now that I regained control of my browsers. Thanks a lot. 🙂 ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [August 21, 2008, 7:14am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/9 "2008-08-21T07:14:21Z")
\*\* Hirka T’Bawa \*\* and \*\* crowmanyclouds \*\* Thanks too for the infos. I’ll look into that and try to build a better defence. Didn’t someone in the “what will impress you in 2048” thread predicted that malwares and anti-malwares are likely to soon become sentient? I suspect he’s right. ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [August 21, 2008, 8:04am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/10 "2008-08-21T08:04:34Z")
While I’m at it : is there any drawback associated with temporarily disabling the system restore? ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [August 21, 2008, 8:08am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/11 "2008-08-21T08:08:05Z")
[QUOTE=Washoe] If these really work, I will build a four-inch statue of you in earthquake paste and affix it to the top of my processor. [/QUOTE] You might want to gather the raw materials for the statue, because after running both programs, Superantispyware doesn’t find Vundo anymore on my machine (even though I’m still not fully convinced… I’m paranoid like that). I hope it will work for you. ---
**Author:** ![Cicero](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cicero/32/3594_2.png) [@Cicero](https://boards.straightdope.com/u/Cicero)\ **Post date:** [August 21, 2008, 8:46am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/12 "2008-08-21T08:46:26Z")
Clairobscur, just out of interest- were you running any anti virus protection to start with? I’d be interested if that was penetrated. ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [August 21, 2008, 9:06am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/13 "2008-08-21T09:06:51Z")
[QUOTE=Cicero] Clairobscur, just out of interest- were you running any anti virus protection to start with? I’d be interested if that was penetrated. [/QUOTE] Not really. My hard drive died recently and after having it replaced , the only program I reinstalled was AVG. ---
**Author:** ![Washoe](https://avatars.discourse-cdn.com/v4/letter/w/ecae2f/32.png) [@Washoe](https://boards.straightdope.com/u/Washoe)\ **Post date:** [August 21, 2008, 9:29am UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/14 "2008-08-21T09:29:33Z")
[QUOTE=clairobscur] You might want to gather the raw materials for the statue, because after running both programs, Superantispyware doesn’t find Vundo anymore on my machine (even though I’m still not fully convinced… I’m paranoid like that). I hope it will work for you. [/QUOTE] \*Sweeeeet… \*SuperAntiSpyware always _finds_ vundo and quarantines it, but it invariably rears its ugly head next time you boot—so you have to run it every time you start up. If SDFix can really kill the little varmint, it’ll be like the second coming. ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [August 21, 2008, 2:37pm UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/15 "2008-08-21T14:37:39Z")
[QUOTE=Cicero] Clairobscur, just out of interest- were you running any anti virus protection to start with? I’d be interested if that was penetrated. [/QUOTE] There has been ALOT of virus activity lately that has taken time for the AV companies to respond to. Our virus cleanup work in my shop lately has nearly doubled. ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [August 21, 2008, 4:30pm UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/16 "2008-08-21T16:30:58Z")
[QUOTE=Washoe] \*Sweeeeet… \*SuperAntiSpyware always _finds_ vundo and quarantines it, but it invariably rears its ugly head next time you boot—so you have to run it every time you start up. If SDFix can really kill the little varmint, it’ll be like the second coming. [/QUOTE] It did not rise its ugly head this time. At least superantispyware doesn’t find it any more, and I don’t have unwanted adds anymore, either. What is weird, however, is that after using Malewarebytes, Vundo was still present (or at least, I still had adds). I then ran SDFix, that didn’t find anything. Nevertheless, after having run it, Vundo wasn’t anywhere to be found. So, I’m not sure what exactly removed it (assuming it has actually been removed, a thing I’m still sceptical about, even though I’ve no reason to be apart from a past experience where killing it had involved much more than simply running an anti-virus) ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [August 21, 2008, 5:14pm UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/17 "2008-08-21T17:14:06Z")
[QUOTE=clairobscur] What is weird, however, is that after using Malewarebytes, Vundo was still present (or at least, I still had adds). [/QUOTE] What is the nature of these ads? Are they warning pop-ups, browser windows, or just icons on your desk top? ---
**Author:** ![Wakinyan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wakinyan/32/352_2.png) [@Wakinyan](https://boards.straightdope.com/u/Wakinyan)\ **Post date:** [August 21, 2008, 5:27pm UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/18 "2008-08-21T17:27:09Z")
You might have a [rootkit](http://en.wikipedia.org/wiki/Rootkit) if you’re computer is behaving strangely but no one detects any malware. That can be a tough nut. I’ve used [Rootkit Revealer](http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx) myself, but it can be difficult to sort out false positives and so on. ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [August 21, 2008, 5:40pm UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/19 "2008-08-21T17:40:13Z")
[QUOTE=Fear Itself] What is the nature of these ads? Are they warning pop-ups, browser windows, or just icons on your desk top? [/QUOTE] They were browser windows, assuming I’m not mistaken about the meaning of this word : they appeared on web pages on spots where you’d expect to see adds (for instance, on the SDMB at the bottom of the page, replacing the regular google adds) but belonged to the illegitimate adds category like “get a green card to live in the USA”, “you’re the 100 000th visitor on this site”, “gorgeous woman living in your neighbourhood left you a message”, etc… ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [August 21, 2008, 6:42pm UTC](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769/20 "2008-08-21T18:42:20Z")
[QUOTE=Wakinyan] You might have a [rootkit](http://en.wikipedia.org/wiki/Rootkit) if you’re computer is behaving strangely but no one detects any malware. That can be a tough nut. I’ve used [Rootkit Revealer](http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx) myself, but it can be difficult to sort out false positives and so on. [/QUOTE] Thanks. I ran it. After a quick check, every discrepancy seems legitimate, even though I’m going to double check it. [Next page](https://boards.straightdope.com/t/some-malware-prevents-me-from-accessing-antivirus-sites/460769.md?page=2)