3 replies
by joseph moore
Boy, MyDoom (aka novarg) and NetSky both? Tough luck!
Ok, one or both of those virii probably changed your HOSTS file. This is a trick viruses have been doing for a while. They add localhost entries to the HOSTS file, resolving the websites for antivirus companies to localhost.
Here's the deal. Windows comes with a HOSTS file (so does Unix; that is where Windows got the idea for it), and a HOSTS file resolves names to IP addresses. In Windows the local HOSTS file will override whatever your DNS servers (which also resolve names to IP addresses) say.
Now, what the virus did is it is resolving, for example, www.symantec.com to the IP address of 127.0.0.1, which is the "localhost" address. Localhost is YOU. This 127 address is special. It's reserved, and it points to the local computer. So, every computer resolved that address to themselves.
AND if you put in your HOSTS file to resolve a site to the localhost address, then you will NEVER get to the site, since your computer thinks YOU are the site!
Neat trick the viruses are doing, eh?
So, to clean this up, do this. Open My Computer and go to C:\Windows\System32\Drivers\etc folder and look for the file called HOSTS
Delete this file. Normal people don't really need the HOSTS file.
Then reboot your XP box, and you should be able to hit the antivirus sites.
And get some antivirus software! And update it every day! And stop opening e-mail attachments!
by inletgrovehs
As above, Spybot - Search and Destroy will also allow you to block the HOSTS file from being changed.
http://www.spybot.info/
If you get the following message:
CGI-limits reached, please try again later!
Keep hitting refresh, you'll get there eventually.
This discussion is closed to new replies.
Trending Windows Forum posts
Sort by Trending