Windows Update redirects to msn

[PA Bear [MS MVP]]

As posted in another reply to one of your posts, Ed, I would *strongly*
encourage you to post a HijackThis log in an appropriate forum for review by
an expert. MBAM on its own may not have gotten the machine entirely cleaned
up!
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Ed wrote:
> Thanks windowsuser! That saved me from formatting and restoring which
> would
> have taken forever being I run a dual boot!
> I got this virus from downloading free winrar from download.com.
> It was the "completetala....heheheh" virus. Ypurself and malewarebytes
> helped me to rid of this.
> Bless you!
> Ed
>
> "WindowsUser1957" wrote:
>
>> I had the same problem. After spending a couple of hours with microsoft
>> support scanning, creating a new user (that had IE6) the solution was to
>> go
>> to:
>> Control Panel/
>> Nework connections/
>> Locan Area Connection/
>> Properties/
>> select Internet Protocol (TCP/IP)/
>> Properties/
>> Select "Obtain DNS server address automatically" (I had "Use the
>> following
>> DNS server addressess checked with server addressess entered)
>> That fixed the problem. Support told me that the setting was set/changed
>> by
>> my ISP but i'm not sure if that is true. It may have been some adware
>> that
>> changed it. In a scan I found an Adware. file in my registry and deleted
>> it. There were so many things we tried before finally changing the DNS
>> server setting that I am not sure if changing the DNS setting was the
>> only
>> thing that corrected the problem but that is where I would start. We had
>> uninstalled IE7 (couldn't uninstall through Add/Remove software however)
>> and created a new administrative user that defaulted to IE6. I have since
>> reinstalled IE7 and everything is working fine
>>
>>
>> "Sub Zero" wrote:
>>
>>> Hi ,
>>> I am getting the same problem,
>>> have you got the solution for this problem ,
>>> If u got the solution plz reply to me
>>>
>>>
>>> "Ana" wrote:
>>>
>>>> Hi,
>>>>
>>>> I have a problem with Windows Updates. I get automatically redirected
>>>> to
>>>> msn.com. I also cannot download pretty much anything else from
>>>> microsoft.
>>>> I found some sites saying it could be a virus called Vundo but I don't
>>>> have any popups or registry key entries typically associated with that
>>>> virus. I ran AVG, Symantec, trendMicro and Microsoft's own online scan.
>>>> None of them picked up any viruses or spyware.
>>>> Someone else suggested that it may be a problem with one of the windows
>>>> updates I installed previously (they weren't specific on which one
>>>> though). I currently have Service Pack 3.
>>>>
>>>> Any suggestions. Thanks.

[Tony Spada]

Go to the property of connection and refresh in automatic the TCP IP, then go
in msservices.msc and set in automatic automatic update.
Enjoy!

"Ana" wrote:

> Hi,
>
> I have a problem with Windows Updates. I get automatically redirected to
> msn.com. I also cannot download pretty much anything else from microsoft.
> I found some sites saying it could be a virus called Vundo but I don't have
> any popups or registry key entries typically associated with that virus. I
> ran AVG, Symantec, trendMicro and Microsoft's own online scan. None of them
> picked up any viruses or spyware.
> Someone else suggested that it may be a problem with one of the windows
> updates I installed previously (they weren't specific on which one though). I
> currently have Service Pack 3.
>
> Any suggestions. Thanks.
>

[BigJohnD]

You also certainly have a DNSChanger Trojan. IAMFAMOUS.DLL appeared a little
over a week ago does exactly what you describe.

For removal use: Malwarebytes' Anti-Malware 1.30 from
http://www.malwarebytes.org/

"jombo" wrote:

> Had the same problem with also google only displaying 10 pages.Cured it by
> resetting the modem(hidden switch on the back) and uninstalling my talktalk
> assist and go software.You will loose your internet connection and you will
> have to go through your initial connection procedure with your isp.With
> talktalk you just use the supplied cd.I tried about 5 spyware programs to
> cure the problem first but no joy.I think spyware messed up my modem internal
> settings.
>
> "CanyonMan" wrote:
>
> > I have found that a virus has changed the obtain the DNS service
> > automatically in the network TCI/IP properties to some other server..Change
> > it back and all is well.
> > --
> > CanyonMan Services
> > Centralia Wa
> >
> >
> > "Ana" wrote:
> >
> > > Hi,
> > >
> > > I have a problem with Windows Updates. I get automatically redirected to
> > > msn.com. I also cannot download pretty much anything else from microsoft.
> > > I found some sites saying it could be a virus called Vundo but I don't have
> > > any popups or registry key entries typically associated with that virus. I
> > > ran AVG, Symantec, trendMicro and Microsoft's own online scan. None of them
> > > picked up any viruses or spyware.
> > > Someone else suggested that it may be a problem with one of the windows
> > > updates I installed previously (they weren't specific on which one though). I
> > > currently have Service Pack 3.
> > >
> > > Any suggestions. Thanks.
> > >

[drdavedj]

For the past three days I have been researching and applying possible fixes to get rid of the problem and make it go away but it proves to be a persistence one. Every time I try to access Windows Update it will redirect me to www.msn.com. In addition, a lot of the anti-spyware/adware I tried to install would not update so I have to do them manually. This included ad-aware, which I asked a friend over messenger to download the most current definition so I can update it manually (I could access the lavasoft website alright, but when I try to download the latest definitions, it redirect me to a different page). I did try to restore my computer to the original manufactured version but it did not solve the problem. I also use Malwarebytes' Anti-Malware, which I must have done over 20 runs >.< Anways, sometimes it comes up clean and sometimes it comes back with the following again:

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.114.35 85.255.112.79 1.2.3.4 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7399b5d5-4309-474a-8d48-ce0fb03498e5}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.114.35 85.255.112.79 1.2.3.4 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.114.35 85.255.112.79 1.2.3.4 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7399b5d5-4309-474a-8d48-ce0fb03498e5}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.114.35 85.255.112.79 1.2.3.4 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.114.35 85.255.112.79 1.2.3.4 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{7399b5d5-4309-474a-8d48-ce0fb03498e5}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.114.35 85.255.112.79 1.2.3.4 -> No action taken.

Finally I resolved the issue. It wasn't my computer at fault but the router. I became suspicious when every single computers in the house exhibit the same behavior. So to test it out, I use one computer to hard-wire to the internet without the router and I was able to access the windows update page without any problems. Whatever someone did to my router, I have to revert it back to the original manufactured version and afterward, everything ran smooth again. All of my virus software, anti-spyware/adware software are able to update without any problems now.

[PA Bear [MS MVP]]

DNS.Changer infections will infect every machine on the network and affect
the router. If you don't get every machine clean *and* either reset or
reinstall the router, every machine will be infected again with a matter of
seconds.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

drdavedj wrote:
> For the past three days I have been researching and applying possible
> fixes to get rid of the problem and make it go away but it proves to be
> a persistence one. Every time I try to access Windows Update it will
> redirect me to www.msn.com. In addition, a lot of the
> anti-spyware/adware I tried to install would not update so I have to do
> them manually. This included ad-aware, which I asked a friend over
> messenger to download the most current definition so I can update it
> manually (I could access the lavasoft website alright, but when I try to
> download the latest definitions, it redirect me to a different page). I
> did try to restore my computer to the original manufactured version but
> it did not solve the problem. I also use Malwarebytes' Anti-Malware,
> which I must have done over 20 runs >.< Anways, sometimes it comes up
> clean and sometimes it comes back with the following again:
>
> Registry Data Items Infected:
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer
> (Trojan.DNSChanger) -> Data: 85.255.114.35 85.255.112.79 1.2.3.4 -> No
> action taken.
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7399b5d5-4309-474a-8d48-ce0fb03498e5}\DhcpNameServer
> (Trojan.DNSChanger) -> Data: 85.255.114.35 85.255.112.79 1.2.3.4 -> No
> action taken.
> HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DhcpNameServer
> (Trojan.DNSChanger) -> Data: 85.255.114.35 85.255.112.79 1.2.3.4 -> No
> action taken.
> HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7399b5d5-4309-474a-8d48-ce0fb03498e5}\DhcpNameServer
> (Trojan.DNSChanger) -> Data: 85.255.114.35 85.255.112.79 1.2.3.4 -> No
> action taken.
> HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\DhcpNameServer
> (Trojan.DNSChanger) -> Data: 85.255.114.35 85.255.112.79 1.2.3.4 -> No
> action taken.
> HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{7399b5d5-4309-474a-8d48-ce0fb03498e5}\DhcpNameServer
> (Trojan.DNSChanger) -> Data: 85.255.114.35 85.255.112.79 1.2.3.4 -> No
> action taken.
>
> Finally I resolved the issue. It wasn't my computer at fault but the
> router. I became suspicious when every single computers in the house
> exhibit the same behavior. So to test it out, I use one computer to
> hard-wire to the internet without the router and I was able to access
> the windows update page without any problems. Whatever someone did to my
> router, I have to revert it back to the original manufactured version
> and afterward, everything ran smooth again. All of my virus software,
> anti-spyware/adware software are able to update without any problems
> now.