Some help with redirects, a pop-up, & a corrupted hosts file?

[ken545]

First try this

Disable the TeaTimer, leave it disabled, do not turn it back on until we're done or it will prevent fixes from taking[/b]

• Run Spybot-S&D in Advanced Mode.
• If it is not already set to do this Go to the Mode menu select "Advanced Mode"
• On the left hand side, Click on Tools
• Then click on the Resident Icon in the List
• Uncheck "Resident TeaTimer" and OK any prompts.
• Restart your computer.<--You need to do this for it to take effect

Please do not proceed until the TeaTimer is disabled



The reopen Spybot Search and Destroy and up at the top left go to Modes and make sure to check Advance Mode. Then to Tools > IE Tweeks and if the Lock the Hosts file is checked...uncheck it


Then run HostsXpert

Download the HostsXpert 4.3 - Hosts File Manager.

• Unzip HostsXpert 4.2.0.0 - Hosts File Manager to a convenient folder such as C:\HostsXpert
• Click HostsXpert.exe to Run HostsXpert - Hosts File Manager from its new home
• Click "Make Hosts Writable?" in the upper left corner.
• Click Restore Microsoft's Hosts file and then click OK.
• Click the X to exit the program.
• Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

[Dragonzord]

TeaTimer has already been disabled somehow, the box was/is not checked, the SDHelper one is, however. Should I proceed with the rest of the steps?

"4/16/2012 4:08:48 PM Allowed (based on user decision) value "SpybotSD TeaTimer" (new data: "") deleted in System Startup user entry!"

This is actually the last note in the log. I don't remember ever disabling TeaTimer in the past, nor removing it from the startup processes.

[ken545]

OK, go ahead and give HostXpert a shot

[Dragonzord]

Some trouble here...

The "Hosts file read-only" lock re-checks itself if I move to another part of the menu or close Spybot.

Leaving it on the same screen with it unchecked while I run HostXpert seems to have no effect either as it gives me a couple of warnings:

"Your HOSTS file is marked as a "system file" and can NOT be manipulated. Press OK to remove the system file attribute, Cancel to Quit.

***HostXpert will NOT reset these attributes.***"

If I hit OK:

"Your HOSTS file is marked as a "Hidden file" and can NOT be manipulated. Press OK to remove the hidden file attribute, CANCEL to Quit.

***HostsXpert will NOT reset these attributes.***"

I hit OK again to move on.
"Make Writeable?" is in red with a locked padlock.
Clicking it doesn't appear to do anything.

So then clicking "Restore MS Hosts File" understandably gives the window:

"ERROR: Cannot create file C:\Windows\system32\DRIVERS\ETC\hosts"

[ken545]

Open OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :processes
  killallprocesses
  
  :OTL
  
  
  :Services
  
  :Reg
  
  :Files
  C:\Windows\SysNative\drivers\etc\hosts
  ipconfig /flushdns /c
  
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [start explorer]
  [Reboot]

• Then click the Run Fix button at the top. <--Not run Scan
• Let the program run unhindered, reboot when it is done
• Then post the results of the log it produces

[Dragonzord]

It gets hung up at [resethosts] with an error window:

"ERROR: Cannot create file C:\Windows\system32\DRIVERS\ETC\hosts"

In OTL it says ""Resetting HOSTS file. DO NOT INTERRUPT..." at the bottom.

[ken545]

Lets try this

Open OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :processes
  killallprocesses
  
  :OTL
  Hosts: 188.119.151.113 www.google-analytics.com.
  Hosts: 188.119.151.113 ad-emea.doubleclick.net.
  Hosts: 188.119.151.113 www.statcounter.com.
  Hosts: 69.72.252.254 www.google-analytics.com.
  Hosts: 69.72.252.254 ad-emea.doubleclick.net.
  
  
  :Services
  
  :Reg
  
  :Files
  C:\windows\system32\drivers\etc\hosts 
  ipconfig /flushdns /c
  
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [start explorer]
  [Reboot]

• Then click the Run Fix button at the top. <--Not run Scan
• Let the program run unhindered, reboot when it is done
• Then post the results of the log it produces

[Dragonzord]

Same error.

After I closed OTL and ran it again, it did give me a log though.
I don't think it helps, but here it is anyways:

Files\Folders moved on Reboot...
File move failed. C:\windows\system32\drivers\etc\hosts scheduled to be moved on reboot.

PendingFileRenameOperations files...
[2012/01/20 14:50:14 | 000,001,401 | RHS- | M] () C:\windows\system32\drivers\etc\hosts : MD5=AD6BCD6E15D11F9C8199DF8E53876AEB

Registry entries deleted on Reboot...

[ken545]

Reboot and then try running HostsXpert

[Dragonzord]

Same warnings and error as before.