IE 8 Weird

Printable View

May 4th, 2013, 08:38 AM
Zonie

IE 8 Weird

Background, Windows XP SP3, IE 8.0, all checks for virus, malware, spyware & etc. Clients PC is on a peer to peer network, no domain and no server. You can type in any address in the address bar with only 2 exceptions. If you try to type in google.com or bing.com it comes up with the error: http 403 forbidden. If you are in MSN or Yahoo and type in their search bar same results.

I have checked content advisor, security settings, reset, and restore advance settings and made sure all user settings were deleted to default. Still the same. Is this one of those wipe out and star over problems? :guns:
May 4th, 2013, 09:07 AM
xpuser357

Peer to Peer like they share there files? Whew If that is the case they could have a real booger and gave it to your customer. Sometimes I found the best for me Write zeros to the drive and reload:)
May 4th, 2013, 10:02 AM
SpywareDr

See if it can get to google.com through http://proxy.ghul.net.
May 4th, 2013, 10:36 AM
Zonie

Quote:

Originally Posted by xpuser357

Peer to Peer like they share there files? Whew If that is the case they could have a real booger and gave it to your customer. Sometimes I found the best for me Write zeros to the drive and reload:)

No shared files. PC is in doctors office and all of them have their widows firewall enabled, antivirus programs, and they only access an EHR program on the web. They will do searches through Google to find a specific doctor or health facility.
May 4th, 2013, 11:33 AM
slgrieb

Have you looked at the adapter settings to verify that DNS doesn't point to some rogue server? If you open a command prompt, can you ping either google.com or 173.194.46.21? My guess would be that the machine at some point has been infected with a DNSChanger variant, or one of those bogus search engines that will also redirect your DNS settings. Removal of the malware won't reset DNS settings for the adapter.
May 6th, 2013, 07:56 AM
Zonie

Quote:

Originally Posted by slgrieb

Have you looked at the adapter settings to verify that DNS doesn't point to some rogue server? If you open a command prompt, can you ping either google.com or 173.194.46.21? My guess would be that the machine at some point has been infected with a DNSChanger variant, or one of those bogus search engines that will also redirect your DNS settings. Removal of the malware won't reset DNS settings for the adapter.

Sorry took the day off. I can ping google and get reply. Had already checked settings as the pc is static IP. DNS 1 is gateway and DNS 2 is 4.2.2.2. Really weird.
May 6th, 2013, 09:30 AM
slgrieb

Quote:

Originally Posted by Zonie

Sorry took the day off. I can ping google and get reply. Had already checked settings as the pc is static IP. DNS 1 is gateway and DNS 2 is 4.2.2.2. Really weird.

I would expect that fixing those settings will solve the issue. All the same, if you haven't already run ComboFix on the machine, I'd do it. It never ceases to amaze me that it will detect and remove so much junk that no other software can find. I did a machine this weekend that both their Norton 360 and MBAM reported as clean, but ComboFix ran for over an hour, and generated a 4 page report of stuff it removed.
May 7th, 2013, 08:26 AM
Zonie

Know what you are saying, however those settings were already set. Had already run the combofix and the Emsisoft Emergency Kit in deep scan as well.
May 7th, 2013, 08:45 AM
SpywareDr

Can it get to google or bing via proxy.ghul.net?

Have you run MBAR (Malwarebytes Anti-Rootkit) on it yet?
May 7th, 2013, 12:27 PM
Niclo Iste

Sounds to me like the hosts file is corrupt/damaged. Have you tried repairing it or editing it?
May 8th, 2013, 08:15 AM
Zonie

Quote:

Originally Posted by Niclo Iste

Sounds to me like the hosts file is corrupt/damaged. Have you tried repairing it or editing it?

Had not thought about the host file. I will see if can get remote access today and check that. The office is about 30 miles away and sometimes hard for me to get out here.
May 8th, 2013, 11:30 AM
slgrieb

Quote:

Originally Posted by Zonie

Know what you are saying, however those settings were already set. Had already run the combofix and the Emsisoft Emergency Kit in deep scan as well.

The DNS setup still looks screwy. The gateway certainly isn't going to function as a DNS server, and the 4.2.2.2 address points to Level 3 Communications in Boulder Colorado, which seems like a bit of a stretch for your ISP.
May 8th, 2013, 11:44 AM
Zonie

Well at this point, everything is mute. I installed Firefox and got the same error, 403 Forbidden. :flames: So now I am going to wipe this and reinstall. :grin: I bet it will work then.
May 8th, 2013, 03:15 PM
slgrieb

Yeah, I bet this will work:) At some point, we all have to cut our losses and get back to basics.
May 16th, 2013, 10:16 PM
nunob

http://www.tummy.com/articles/famous-dns-server/