Windows Update directs to MSN

[BionicJohn]

(I hope I'm posting in the correct place, as I'm assuming the problem is some kind of virus.)

The first symptom was clicking on "Windows Update" in IE7 and the MSN home page appeared. I thought I'd clicked somewhere else in error, but no.

I've run Avast, but so far nothing's been found, though it's possible it took earlier action quietly without me noticing.

Digging around with Google for some pointers, it turns out my DNS Server Address has somehow been hijacked, so directing Windows Update to MSN. My ISP is using 217.14.176.138

but the TCP/IP Properties of local connection have the address as 85.255.112.16, set manually.

Switching to "Obtain DNS Server Address Automatically" was the obvious solution, but after OK'ing out, it reverts back to 85.255.112.16.

Something is clearly preventing the change or changing it back immediately.

I've tried to reset every thing - rebooting the router, releasing and renewing with IPConfig, rebooting the PC - but have run out of ideas.

Would a HJT log help?

Cheers, John.

Liverpool: Capital of Culture 2008
Anfield: Capital of Football since 1892
Iechyd da! John
Glannau Mersi, Lloegr.

 

[BionicJohn]

OK, it's sorted.

A cleaner called "Malwarebytes' Anti-Malware 1.30" found and removed the offending items, which were:

Registry Keys Infected:
HKEY_CLASSES_ROOT\homeview (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System (Rootkit.DNSChanger.H) -> Data: kdvcf.exe -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Mozilla Firefox\components\iamfamous.dll (Trojan.Agent) -> Quarantined and deleted successfully.

All seems fine now. Many thanks.

Liverpool: Capital of Culture 2008
Anfield: Capital of Football since 1892
Iechyd da! John
Glannau Mersi, Lloegr.

 

[2ffat]

Glad you got it fixed. There is another forum that can provide help, too, forum760.


James P. Cottingham
-----------------------------------------
[sup]I'm number 1,229!
I'm number 1,229![/sup]