"~BD~" wrote in message
news:OnH4lmASJHA.5348@TK2MSFTNGP02.phx.gbl...
>
> Hello again Øyvind - How are things going?
>
> Have you had to wield your mighty sword yet?
>
> Dave
>
> --
>
>
Maybe this will help
(A post by Bill Castner of Aumha.net
http://www.aumha.net/viewtopic.php?f=30&t=36886 )
********************************************
There is a widespread DNS Hijacker going around that requires unusual
measures to resolve. By posting this in a single and editable location, it I
hope is a convenience to both me, and the Forum.
How Do You Know If You Have This Malware Infection?
While the adware it will popup is aggressively more so than typical adware
infections, the DNS redirection is easy to test.
Try the following in your Browser address bar:
download.microsoft.com
If you end up anywhere other than the official Microsoft Download Center,
keep reading. For all others, you may have something else.
So Now What?
1. Create a "tookit". Download the following to your Desktop and not any
other location or Folder:
GMER:
http://www.gmer.net/index.php
Malwarebytes Anti-Malware -- MBAM (if you have this installed, Uninstall it
and download it again):
http://www.malwarebytes.org/mbam.php
PrevX CSI:
http://www.prevx.com/freescan.asp
2. Run MBAM. If it wants to reboot when finished, do so.
3. Run Prevx CSI. If it wants to reboot when finished do so.
4. Make sure you know the setup information for your router. You want to
access the router configuration pages, and write down any information
necessary to authenticate with your ISP. Please write this down, if you do
not have a record elsewhere of this information. When in doubt, call your
ISP and ask what is needed in the authentication fields of the router.
4. Shut down your computer, and any other computer connected to your router.
5. On the back of the router, there should be a small hole or button
labelled RESET. Using a bent paper clip or similar item, hold that in
continuously for twenty seconds. Unplug the router. Wait sixty seconds. Now
holding again the reset button, plug it back in. Continue holding the reset
button for twenty seconds. Unplug the router again.
6. With the router unplugged, start your computer. Run MBAM again.
7. Run Prevx CSI again.
8. Connect again to the router. The turn the router back on. When it
stabilizes, reboot your workstation and try to aceess the internet. If you
have any issues, access the Router configuration page and re-enter your
authentication information.
9. Reboot the workstation and do a final test.
Special Note and Reading List:
Several folks have asked why they have to RESET the router. And how on earth
could malware effect the router in the first place? There are, that I have
seen in the last week, in wide distribution, at least four malware
infections, one rootkit-based, that at present do exactly this; and have
since the last week in October. As to how this can be done, please read this
short Article:
http://www.geekstogo.com/2008/04/08/hav ... read-this/
Does this mean you throw out your router and replace it? No. You do at least
the RESET operation I described above. If you are exceedling cautious about
the matter, visit your router manufacturer's website and download the newest
firmware release for your router. Then reflash the router firmware. Since
there are literally thousands of router models out there, I cannot advise
you about how to reflash your router firmware. The manufacturer's website
should have utilities and instructions for doing so. I cannot answser any
specific questions as to how to do this. In most cases, I consider a reflash
of the firmware unnecessary.
E=6o2@=]4@> [r4o7t]