|
Posted by Jim on September 24, 2007, 10:30 pm
If you were Registered and logged in, you could reply and use other advanced thread options
>
> Hello.
> Since a while, when I look up words in the online dictionary, Merriam-
> Webster I encounter a problem, presumably due to certain ads on the
> page:
> http://www.m-w.com
> Sometimes IE suddenly navigates away from the page unexpectedly and
> jumps to the bottom right corner of the screen pointed at a different
> url with a notification popping up, as can be seen in the following
> screenshot:
> http://www.ibbu.nl/~nsprakel/drivecleaner_x.jpg
>
> So the notification from IE pops up with a msg in Dutch and the choice
> to accept or cancel installing drivecleaner,
> http://www.ibbu.nl/~nsprakel/drivecleaner_note.jpg
> as well as a small browser window in the bottom right corner pointed
> at their site.
> When I cancel or close the notification, I end up at the site visible
> in the next screenshot:
> http://www.ibbu.nl/~nsprakel/drivecleaner_url.jpg
>
> Or at a similar site, visible in this screenshot:
> http://www.ibbu.nl/~nsprakel/errorsafe.jpg
>
> So, I thought, maybe I can use the hosts file:
> C:\WINDOWS\system32\drivers\etc\hosts
>
> to redirect urls like that with the line
>
> "127.0.0.1 nl.errorsafe.com"
>
> added to that hosts text file.
>
> But it seems something recovers the original hosts file and eliminates
> the line that was added manually. Does anyone know if this is done by
> BitDefender, AVG or by the Windows XP Pro (SP2) system itself and
> whether and how I can modify these settings?
> Or perhaps a better way to get rid of this annoying behavior of
> unwanted websites that spontaneously come up when I look up words at
> www.m-w.com?
>
> Thx in advance for any feedback, Niek
>
None of the above will do that. Instead, it is the malware that is sending
you to all of those strange places.
Since it is well known what the contents of the HOSTS file must be, malware
can just download its own copy.
I would try setting the file as read only.
Jim
|