[Resolved] Apparent Trojan Infection

When you run hostfix do you see this? Make Writable? in the upper left corner.

Nope, it's apparently already set to writeable. The option is "Make ReadOnly?". Clicking it grays out the hosts stuff and brings up the "Make Writeable?" Option. After clicking it again and then clicking the Restore MS hosts button, the error still persists.

Make Sure Internet Explorer is NOT open when trying this) Launch HijackThis, click the 'Open'Misc Tools'Section -> 'Open hosts file manager'. Delete every line (select each line and click 'Delete line(s)') except the very first top lines beginning with # and: 127.0.0.1 localhost Once finished, click the 'Open in Notepad' button. It should look like this: QUOTE # Copyright © 1993-1999 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a '#' symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host 127.0.0.1 localhost If it doesn't, or it was already like it, then please tell us

The following is what was there. The only difference is that my log does not have the "127.0.0.1 localhost" bit:

# copyright © 1993-1999 microsoft corp.
# this is a sample hosts file used by microsoft tcp/ip for windows.
# this file contains the mappings of ip addresses to host names. each
# entry should be kept on an individual line. the ip address should
# be placed in the first column followed by the corresponding host name.
# the ip address and the host name should be separated by at least one
# space.
# additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
# for example:
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# Start of entries inserted by Spybot - Search & Destroy
# This list is Copyright 2000-2008 Safer Networking Limited
# End of entries inserted by Spybot - Search & Destroy

# Start of entries inserted by Spybot - Search & Destroy

SpyBot is controlling them then.
Spybot's Tools > Hosts file facility.

Sounds to me SpyBot and Spysweeper are conflicting

Alright, so is there a recommended way to tell one to bug off? I loaded up Spybot, went into advanced mode and looked at the hosts file option in tools, but it's all empty. It's got options to add or remove the hosts list, or back up to any of many various dates going back as far as February 15th.

Uninstall SpyBot then run the hosterfix. Or uninstall Spysweeper

Alright. I've uninstalled Spybot (And restarted as per it's request). Hosterfix still gives me an error, but after enabling everything, I do not seem to be getting anymore alerts from SpySweeper. Assuming I don't get any in the next 10 minutes or so since they are so frequent, I'd say that pretty much solved the issue. Thank you very, very much for your time and effort. Also, my apologies on presenting this problem as something that it was apparently not as well. You help is/was very much appreciated.

Windows XP C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS You could open it with Notepad and edit it to look like this if you want to. # Copyright © 1993-1999 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a '#' symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host 127.0.0.1 localhost

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.