Malware attack; Cannot view, delete, edit hacked Hosts File

[jhill]

Hello Tech Gurus,

I hope one of you can help me. I have a problem with one of my computers at the office I am having trouble solving. I will outline the problem and what I have attempted so far. Hopefully one of you can point out a solution or something new to try.

Problem:

Computer at work cannot connect to google, yahoo, or bing search engines.

What I Have Done:

I have identified the problem as a corrupt (hacked) hosts file. If I enter the command C:\WINDOWS\system32\drivers\etc\hosts I can access the hosts file and open it in wordpad.

Note that without actually typing in the file path the hosts file cannot be accessed. It is not visible in windows explorer even after changing the folder options to “show hidden files and folders” However, as mentioned by typing in the file path location, I can view the hosts file in wordpad.

Once open I can see almost 2 pages worth of entries of various google, yahoo and bing sites re-routing the browser to an unknown location explaining the problem. I know what the problem is, but I can't fix it. I have tried deleting the hijacked entries in wordpad, but cannot re-save the file as I get an authorization error.

As the file is not visible in windows explorer I cannot remove the “read-only” format. I have tried to overwrite the file, with a pure hosts file taken from a different computer; again I get an authorization failure. I have tried running the following codes to regain administrator rights

cacls C:\WINDOWS\system32\drivers\etc\hosts /E /G Administrators:F
cacls C:\WINDOWS\system32\drivers\etc\hosts /E /G admin:F (admin is the username)

Both codes produced authorization failure errors. I do have full administrator credentials with this login.

I have run Malwarebytes and SuperAnti Spyware and have removed several errors; however all of the above problems still remain.

I have run HijackThis, and am informed that the Hijack this does not have “write” access to the hosts file and although it finds the hijacked lines in the hosts file, it cannot remove them. Hence all the above problems remain.

I have tried booting the computer in Safe Mode to gain access over the hosts file, but even in Safe Mode the file is not visible in windows explorer and unchangeable and is exactly the same as the above issues in Normal Mode.

I have tried deleting the entire etc folder, but cannot due to authorization failure.

What else can I try? Any other ideas out there to fix this problem?

 

[braydonbond]

The only thing I can suggest is backing up important files on a disk or a flash drive, then doing a revert back to a restore point (if you have one). There could be another solution out there, but this is the only one I can think of. Sorry I can't be of more help.

 

[DBB2010]

Use a live environment such as Hiren's [http://www.hirensbootcd.org/download/] or try to kill unnecessary services and programs from startup [run>msconfig]. You might be able to see the file with Explorer++ [www.explorerplusplus.com] or kill infectious processes with Process Explorer [http://technet.microsoft.com/en-us/sysinternals/bb896653]. If all else fails, There's GMER and Combofix. If the system is running XP, you can try my walkthrough at RemedyComputing.com. Good luck!

 

[knowlengr]

Depending on the cause, this option might work.

If you have Malwarebytes, after performing the safe mode cleansing tasks suggested previously in this thread, make a copy of the hosts file and fix it -- or get a new one (your system will work with a no-op hosts file that has only 127.0.0.1 in it). Then use the "File Assassin" feature of Malwarebytes to kill (delete) the rascal. That can be performed from inside full Windows, since you should have removed the causes by then. Restore a good hosts file (no file extension, especially no .txt).

Mark