Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Possible host hijacker! OTL log posted.


  • Please log in to reply

#16
Jim45

Jim45

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 234 posts

Did you create a new profile? Perhaps the old one was messed up.

No, I didn't do a thing. I know that earlier I called Newegg because a promotion code wasn't working that should have been, and they said they were having problems with their site, but that wouldn't explain why IE would display the page fine, and you said it displayed fine for you with Firefox. I may just reinstall Firefox a little later, just because. I still have yet to see the NoScript option in the menu, so it makes me feel like maybe it has a glitch or two.
  • 0

Advertisements


#17
Jim45

Jim45

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 234 posts
Well, I uninstalled Firefox, and reinstalled it. Told it to save my settings and whatnot, I'm assuming that wasn't a bad thing, as far as starting with a fresh install. I did have it set to run faster, using this tweak that is all over the internet, and still do. http://www.foreverge...firefox_faster/
  • 0

#18
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,796 posts
  • MVP
I don't have that on mine perhaps that is causing your strange screens. I do use AdBlock Plus
http://adblockplus.org/en/
and Speedyfox and things load fast enough for me without tweaking. I have a pretty slow connection - it is DSL but it is not very "broadband." just a step above dial-up.

I tried noscript but I usually just visit the same websites all the time so it's more trouble than it is worth for me.

Ron
  • 0

#19
Jim45

Jim45

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 234 posts
Yeah, I have a 3mbps connection, so even though it's called HSI, it really isn't, compared to most. I'll see how pages load the next few days after reinstalling FF, then maybe I'll try that SpeedyFox.



Just out of curiosity, I ran OTL again, just to see if that Symantec driver was FINALLY gone, and it appears it is, but what do these two items on the log mean?

O1 HOSTS File: ([2011/11/21 17:47:45 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost

Edited by Jim45, 23 November 2011 - 04:27 PM.

  • 0

#20
Jim45

Jim45

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 234 posts
I'm still getting weird stuff with Firefox. Here's a perfect example with these 2 screenshots. They are both from the exact same Ebay page. The one that looks right is Internet Explorer, the other Firefox. Does that give you any more of a clue what is going on?

Here's the link to the page, if that helps. http://www.ebay.com/...=item19c3ed1687

Attached Thumbnails

  • ebay.jpg
  • ebay2.jpg

Edited by Jim45, 23 November 2011 - 08:36 PM.

  • 0

#21
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,796 posts
  • MVP
O1 HOSTS File: ([2011/11/21 17:47:45 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost

Windows creates a file called C:\Windows\System32\drivers\etc\hosts. This is a lookup table which gives the ip address for certain common destinations. The default entry in the hosts file is:
127.0.0.1 localhost

and that is all that we are seeing in the OTL file. If a destination is found in the hosts file then the system will not ask the DNS for the address but will use the one in the hosts file. So some malware will put bogus entries in the hosts file which point to a fake google.com site for example. If you let Spybot S&D "immunize" your system what it does is put several thousand entries for various known malware sites in the hosts file all pointing to 127.0.0.1 (the internal loopback address). The idea is that this will prevent you from going to the bad sites. Unfortunately this worked better in XP and earlier. In Vista and Win 7 it results in much slower performance.

I would take all of the tweaks out of Firefox and restart Firefox in Safe mode and see if that makes a difference. Maybe clear your cookies too.
  • 0

#22
Jim45

Jim45

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 234 posts
With the tweaks taken out, and in safe mode, it looks like the first screenshot. The font is slightly bigger and bold.See what I mean? Funny though.......I checked it several times, and it looked like that with add-ons enabled as well. One time it looked like the screenshot a couple posts back, with the smaller font. I just don't get it. Would it do any good to start completely over, and out my add-ons back and whatnot? The second screenshot is my add-ons, just for the heck of it.

Attached Thumbnails

  • ebay.jpg
  • add-ons.jpg

  • 0

#23
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,796 posts
  • MVP
Something wrong in your install or profile I guess so I would export the profile. Uninstall Firefox completely and also remove the profile. Make sure that

C:\Documents and Settings\Jim Lundquist\Application Data\Mozilla
and
C:\Program Files\Mozilla Firefox

have been removed. I would also look for Mozilla folders in C:\Documents and Settings\Jim Lundquist\Local Settings\ and remove any.

Then download a fresh install. Do not import your old profile or add any add-ons until after you try it
  • 0

#24
Jim45

Jim45

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 234 posts
I don't understand what my "profile" is. I'm just going to completely uninstall everything and treat it as If I'm using Firefox for the first time.
  • 0

#25
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,796 posts
  • MVP
http://kb.mozillazin.../Profile_backup
  • 0

Advertisements


#26
Jim45

Jim45

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 234 posts
Well, completely uninstalled Firefox, and all the folders you mentioned. Did a fresh install,and with no add-ons and no tweaks and went to the Ebay page I've been referencing. That same part of the page I took a screenshot of before looks the same, as you can see. It has the larger font and whatnot, but is not displaying right. I just don't get it.

Attached Thumbnails

  • ebay.jpg

  • 0

#27
Jim45

Jim45

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 234 posts
This is weird.......I downloaded Chrome, just for the heck of it, and that same page looks the same with Chrome, so now I really don't get it.

Edited by Jim45, 24 November 2011 - 03:36 AM.

  • 0

#28
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,796 posts
  • MVP
what page is this? It's possible that it only works with IE.
  • 0

#29
Jim45

Jim45

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 234 posts
It's part of the same page I posted about a few posts back....that Ebay ad.
http://www.ebay.com/...=item19c3ed1687

Does it look right when you view it with Firefox? It's the item description and shipping info, not the entire page, it's weird.

Edited by Jim45, 24 November 2011 - 11:22 AM.

  • 0

#30
RKinner

RKinner

    Malware Expert

  • Expert
  • 19,796 posts
  • MVP
Nope it's hosed at the bottom just like your screenshot.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP