View original (French)

Possible hosts file hijack

Solved
Mathieu -  
Hello,

I am on Windows 7, and for a few days now Windows Defender has been alerting me about the presence of a dangerous software: settingsmodifier:win32/possiblehostsfilehijack. I tried to remove it, but I get an error code 0x80070005. Access denied. The same goes if I want to quarantine it.

Avira, on the other hand, does not detect anything.

Does anyone have a solution to get rid of this? It worries me a bit... :(

Thank you in advance
Mathieu

PS: I searched on Google, but I'm not a computer whiz and all this seems a bit obscure to me :)

25 answers

  1. Mathieu
    So I had it but I no longer do... I don't know if I did the right thing, but I disabled Avira for a few minutes, just to try deleting the malicious file with Defender again. And it worked! I just reactivated Avira right now, everything seems to be working smoothly.
    Thank you for thinking hard for me, that's really nice of you!
    Have a good end of the day
    Talk to you later
    1. billmaxime Contributor
      Hello

      to learn more, you can do this

      download zhpdiag to your desktop (diagnostic tool)

      the link https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/

      the tutorial http://www.security-helpzone.com/forum/Thread-ZHPDiag-Generer-un-rapport

      users vista-w7-w8 run as administrator (right click)

      to start the scan click on the magnifying glass with the + (2nd button at the top left)

      the report will appear on your desktop and in C:\zhpdiag.txt

      post the report via this link https://www.cjoint.com/

      @+

      --
      the radiation level is higher at the employment center than at Chernobyl
      1. Mathieu
        Thank you for the quick response!

        Here is the link to the report, I hope I did everything right...
        http://cjoint.com/?3FDk3gXOmfy
        3. Mathieu
          Well, I have to admit that I had spread a bit everywhere :)
          I deleted them all mercilessly...
          1. billmaxime Contributor
            <re>

            Okay, uninstall this Java 7 Update 9 and download the latest version here

            https://www.java.com/fr/

            MFIE: Mozilla Firefox 21.0 (Default) is not up to date, update it

            https://support.mozilla.org/fr/kb/mettre-jour-firefox-derniere-version

            You have 2 versions of this OPIE: Opera v12.14/OPIE: Opera v12.15

            Uninstall Opera v12.14

            Then, do another zhpdiag by clicking on the magnifying glass with the + and post the report

            via this link https://www.cjoint.com/

            Thank you

            @+

            --
            The radiation level is higher at the employment office than at Chernobyl.</re>
            1. Mathieu
              Here is the link to the new report:
              http://cjoint.com/?3FDlZEUzSeT
              1. billmaxime Contributor
                re

                you uninstalled this version Opera v12.15 and you should have uninstalled this one

                Opera v12.14

                update Opera v12.14 on your PC

                I'll be back with the follow-up

                @+

                --
                the radiation level is higher at the employment center than at Chernobyl
                1. Mathieu
                  However, I have indeed uninstalled version 12.14 and, strangely, when I bring up the list of programs in "uninstall a program," there is no Opera appearing, nor is there any in the program files...
                  1. billmaxime Contributor
                    re

                    do this please

                    run zhpfix as administrator (right click)

                    copy all the bold text below

                    click on the 2nd button at the top left (paste from clipboard)

                    click on GO at the bottom of the page and confirm with yes to start data cleaning

                    the report will appear on your desktop and in C:\zhpfix.txt

                    post the report via this link https://www.cjoint.com/

                    text to copy


                    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
                    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified
                    O4 - HKCU\..\Run: [AdobeBridge] Orphan key
                    O4 - HKUS\S-1-5-21-2421505861-448997301-1305069401-1000\..\Run: [AdobeBridge] Orphan key
                    O4 - GS\Desktop: OneKey Recovery.lnk . (...) -- C:\Program Files (x86)\Lenovo\OneKey App\OneKey Recovery\OneKey Recovery.exe (.not file.)
                    [MD5.00000000000000000000000000000000] [APT] [{65F44CA4-4F62-4E84-BE7E-3B3D20B3EC86}] (...) -- C:\Program files\Bohemia Interactive\Take On Helicopters Demo\UnInstall.exe (.not file.) [0]
                    [MD5.B28C334C03CEE7C5E829C43AE75DAE5A] [SPRF][20/04/2013] (.Ask.com - AskIC Dynamic Link Library.) -- C:\Users\mathieu\AppData\Local\Temp\AskSLib.dll [248008]

                    SysRestore
                    FirewallRAZ
                    EmptyCLSID
                    EmptyTemp
                    EmptyFlash

                    @+

                    --
                    the radiation level is higher at Pôle Emploi than at Chernobyl
                    1. Mathieu
                      Here is the report:
                      http://cjoint.com/?3FDmx2sesFx

                      I need to go for lunch, I'll be back shortly. If you have a little more time to give me (when you can), that would be great... thanks again!
                      1. billmaxime Contributor
                        re

                        enjoy your meal

                        let me know if you still have your initial issue

                        thank you

                        @+

                        --
                        the radiation levels are higher at the unemployment office than in Chernobyl
                        1. Mathieu
                          Unfortunately, Windows Defender is still detecting a potentially dangerous file possiblehostsfilehijack...
                          1. billmaxime Contributor
                            re

                            ok, let me know if you have any updates before your issue

                            thank you

                            @+

                            --
                            the radiation level is higher at the employment agency than in Chernobyl
                            1. Mathieu
                              No software updates, there have been Windows updates, but before coming to post here, I did a system restore to an earlier date, with no changes.

                              I had installed some small music software before the restore, they disappeared with the restore, yet the problem persists.
                              1. billmaxime Contributor
                                re

                                do this please

                                download MBAM to your desktop

                                the link https://www.malwarebytes.com/ (choose the free version)

                                the tutorial https://www.donnemoilinfo.com/tuto/Malwarebytes-Anti-Malware/

                                run it as administrator (right-click)
                                update it (3rd button)

                                do a full scan (all disks)

                                the scan may take about 2 hours (let it work)

                                if MBAM finds anything, delete the selection (see tutorial 2nd page)

                                post the report via copy/paste

                                the report will appear on your desktop and in MBAM report/log

                                @+

                                --
                                the radiation level is higher at the employment agency than at Chernobyl
                                2. billmaxime Contributor
                                  re

                                  ok, can you redo 1 zhpdiag by clicking on the magnifying glass with the + and post the report
                                  via this link https://www.cjoint.com/

                                  thanks

                                  @+

                                  --
                                  the radiation level is higher at the employment office than at Chernobyl
                                  2. billmaxime Contributor
                                    re

                                    Do you still have your issue with Bitdefender?

                                    @+

                                    --
                                    The radiation level is higher at Pôle Emploi than in Chernobyl.
                                    • 1
                                    • 2