UNSOLVED
win32.hostblock
can anyone tell me how to get rid of this virus, win32.hostblock ?
it is preventing me from accessing www.amazon.com
when i try to put www.amazon.com into IE i get routed a Google search page
http://www.google.com/search?q=www.amazon.com
and then i get "page cannot be displayed"
I was told that this may be the reason.
thank you.
- not sure who suggested win32.hostblock to you.... that generally tends to block access to anti-virus and other security-related sites rather than a vendor like amazon.do you know about your HOSTS file? if so, open it, and see if it contains the line:127.0.0.1 www.amazon.comand if you find this line, DELETE it, save the file, reboot your system, and see what happens.if you don't know what a HOSTS file is, or where it's located, write back... be sure to let me know what operating system (98/ME, 2000, NT, XP) you're using, and i'll be able to describe things better.
Message Edited by ky331 on 09-29-2005 11:01 AM
- HOSTS file is okay... the problem wasn't there.(By the way, good work in following the directions :smileyhappy: )here's the next thing to try... in the process, i'll be asking you to post some results in another forum... at which point, another person will be taking over assisting you.Download the latest version of HJT(hijackthis) (version 1.99.1) from
http://majorgeeks.com/download3155.html
you must create a separate folder and place it there.... people commonly use C:\HJT. Note: Please do *NOT* use a TEMP (temporary) folder, *NOR* your DESKTOP, as HJT will be generating log files and backup files in the folder from which it is run... you risk accidentally losing these if you use a TEMP folder, and you will generate extreme clutter if you use your DESKTOP.
The file above comes as a compressed .ZIP file... you have to UNzip it (hopefully, you have an UNzip utility built into your Windows Explorer. If for any reason, you're unable to UNzip it, you can download the already-unzipped .EXE file from http://downloads.malwareremoval.com/HijackThis.exe )
After Unzipping, double click on HiJackThis.EXE
Click on Do a System Scan and Save a LogFile
This will automatically open NotePad
Copy the entire file from NotePad: EDIT/SelectAll, EDIT/Copy
Then go to the new forum dedicated for HiJack This logs (**NOT** back here), and PASTE the results there:
http://forums.us.dell.com/supportforums/board?board.id=si_hijack
Be sure to include a detailed description of any problems/errors/warnings you are encountering.
Hopefully, one of the HJT experts will get to it as quickly as possible.
WARNING: HiJack This is a VERY POWERFUL tool. Do *NOT* do anything else (in particular, do NOT use it to delete any entries) until you are advised to do so!! Improper use of this tool can severely damage your system.Supplemental note: The procedure as worded above has been carefully edited over time, so as to expedite the process of helping people. Nevertheless, it seems that many individuals try to be "creative", and make some variations. It really would be to your benefit if you follow these directions EXACTLY as stated... because certain changes on your part can result in slowing-down the help process.Specifically, the following are 3 very common BAD deviations which will cause delays:a) BAD: using an older/outdated version of HiJackThis...The experts only work with the current version. So if you make a post with an older version, you'll simply be advised to get the latest version, re-run it, and re-post your log.b) BAD: using a TEMP directory or your DESKTOP for HJT....Some experts may insist you move HJT before they'll begin working with you. Others will start the repair process, advising you to move HJT as one of the very first steps. Failure to do so can result in losing potentially critical information. So please, just use the suggested C:\HJT directory, rather than try to be creative.c) BAD: posting your log in the wrong forum...if you post your log back here, in the Virus/SpyWare forum, it will "sit idly", either until the forum moderator gets around to move it for you... or until you decide to repost your log... in the HiJackThis forum. - click on START, then RUN, and then, when asked what you want to open, type inC:\WINDOWS\SYSTEM32\DRIVERS\ETC(yes, include the letters E T C , exactly as indicated above)and press OKthis should open up windows explorer, to the specified directory. look in the list of directories and files, for HOSTS . Right-click on it, select OPEN WITH , highlight/select NOTEPAD and click OK . this should open and display your HOSTS file.Note: if for any reason, the file is too large, it will ask you if you want to use WORDPAD (instead of NOTEPAD).... that's fine.you may, or may not, see the line:127.0.0.1 www.amazon.comif you do, delete this line, save the file, and reboot.if you see other lines there, you may want to post a copy of your file here:EDIT Select ALLEDIT COPYand then PASTE the results back here.depending on what you find, we'll see what to do/try next.
- a question or two... i'm somewhat reluctant about how to proceed, as i really don't want to interfere with the HJT analysis.... but:1) have you examined your firewallS, to see if they're blocking access to the amazon site?2) i stress, firewall S (plural), as your log shows evidence of BOTHComputer Associate's eTrust EZ Firewall andZoneLab's TrueVector Internet Monitorponder the question, you can reply here if you find something... but it's probably in your best interest to wait for the HJT expert to get to your log in THAT forum.
- is zonelab an old firewall that you USED TO HAVE on that system? if so, it's possible that you only partially removed it.as i already indicated, i think it wisest to let you finish the job in the HiJackThis forum. if they can't find anything, then we can try to see what else... if anything... can be done here.
thunderwalker77
2 Posts
51
0
Posted October 26th, 2005 12:00
OK, dealing with my brother's dell. He got hit with the hostblock trojan last night. his antivirus (norton) and firewall (zone alarm) were shut down, other programs are shakey. Attempted to get norton to scan and couldn't. Each time the scan window came up, it then blipped out of existance. So he had zone alarm anti virus and installed that, ran scan and it came up with win32.host which it said it fixed the file. But problems still continue. I can't find backup took. run window, Hijack scan window and others come up but blip out of existance. msn messenger will not log onto passports. How do we fix this? Oh ( Dell dimension 2400,Win XP home- 80 G hd , 512 Ram)
sevilla1
16 Posts
466
0
Posted September 29th, 2005 13:00
here is what I found in my HOSTS file:
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost