Virus help!

[Tezcatlipoca]

Why is there a misguided misconception that Firefox is a secure browser.

 

The problem here is interpetation of the staistics. On the one hand, you have X many issues that get reported, Y number of Firefox users and Z number of IE users. The vast majority of these issues affect all broswers, regardless of type. As Firefox becomes the dominant browser, naturally the number of people encountering issues when they happen to be surfing with FF increases. They'd encounter those issues just the same with IE, or any other browser, but because Y is now increasing over Z, it gives the impression that Y is more susceptile to X.

 

The second issue here is that where browser-specific issues are concerned, Firefox has and will continue to be subject to an increasing number of malicious programs being written to try and exploit it, purely because it's a more popular browser, so the coder's target audience is getting larger. If I want to write some malicious Javascript code I'm not going to waste my time writing it to hijack Chrome. If Chrome accounted for a vast part of the browser market, however, I would.

 

Overall, Firefox is a more secure browser for three chief reasons:

 

1) Firefox doesn't use ActiveX controls, which have traditionally provided potential hackers / vriuses are direct line into your PC, since IE's ActiveX support allows code from the web to directly affect Windows.

 

2) Firefox is open source, which doesn't protect against problems in itself, but does mean that problems / bugs that do get discovered are shared by the community and fixed far quicker than those reported to Microsoft.

 

3) Firefox is hugely configurable, part of which allows it to respond fluidly to threats, unlike IE which is static from a code perspective. Firefox already has a vast range of plugins that seemlessly combat website issues (such as popups, ads, scripts, etc.). I've run some browser tests specifically designed to take advantage of common exploits and hacks but without containing a malicious payload, I find that my copy of FireFox blocks them flawlessly. The same tests with IE6, IE7 and IE8 all allow through some exploits, most of which are later picked up by my other defenses (AV, FireWall, Registry guard, etc.) but they do get progressively better at defending themselves. The point here isn't to jump up and down and say "Look how insecure IE is", rather to point out that many of those vulnerabilities might have also affected FireFox, if it hadn't been so easy to simply and quickly add free plugins to the browser to take care of them. Something you can't do with IE.

 

That said, conniff is spot on about Security Essentials. It's free, and is excellent at intercepting a wide range of threats.

 

I attempted to download updates earlier, only to get error messages and being unable to download. So, I think its time I called it a day and give it to the experts to sort. Thanks to everyone for all the suggestions and advice, but I'm giving up before I fubar it completely lol. The advice you all gave at the beginning of the thread sorted that problem.

 

It's far from FUBARed, Kregrs. If you're willing, could you please try the following diagnostic tests and let us know the results (these tests are utterly safe, and won't change anything on your PC; they'll simply allow us to diagnose where the problem is):

 

1) Go to Start, then click Run. Enter cmd in the box, and hit Ok.

2) In the black prompt window, please type the following:

a) ipconfig /all (hit enter). Please make a note of the two lines that says DNS Servers.

b) ping bbc.co.uk (hit enter). You should get 4 lines returned that say something like Reply from 212.58.224.138. If you number is different, please make a note of it.

c) ping 212.58.224.138 (hit enter). As above, you should get 4 reply lines. Please let us know if you don't.

d) nslookup bbc.co.uk (hit enter). You'll get 2 main bits of data back. The top is the referring server, or the place your computer is going to get the location of the BBC. This number should match one of the DNS Server numbers from from step a). Please make a note of it.

The lower set of data is the IP of the site you're asking about (in this case, the BBC). It should match the number you got back from step b).

In this tep, pelase also make a note of the two Server: names that appear above the IPs.

 

If you could kindly post these numbers (the DNS servers from step A, the IP from step B, the IP from step C, and the two sets of IP's and names from step D) I or others will be able to confirm if the issue is with your network card, its settings, or the DNS settings.

Edited December 14, 2009 by Tezcatlipoca

[Tezcatlipoca]

Answers above, 1st step could only find 1 dns server, although there was also Default Gateway and DHCP server with the same number. And IP address of 192.168.0.101

 

Anyway, whats the verdict?

 

Thanks for your help, as usual with this forum the help and advice is awesome and always someone willing to help.

 

Right, the good news is that there's nothing wrong with your network card, its drivers, your connecting router cable (if cable it be), the router itself, or its connection to the outside world. In short, your hardware is just fine.

 

By way of explaination, the internet runs - in part - on a system known as DNS, or Directed Name Servers. This turns memorable information, such as the name BBC.co.uk into computer IP address information, such as 212.58.224.138. Think of it like a giant phone book. You know the name of the person you want to call, look it up, and the book tells you the number. Pretty much the same thing with websites.

 

Now the DNS is served up from a number of sources, but principally it comes from your router, which gets it from your ISP (Internet Service Provider).

 

What I've got you to test here is firstly to see the DNS server responsible in your case for looking up website data (which was the test we did under A). In this case, the result was 192.168.0.1, which is your router.

 

We then tried to get the router to serve us up an external website address. We could have used any, but I wanted one that I could be sure was up and contactable, so I got you to try the BBC. We told the computer to fire a ping request at the website to see both if the server responded, and, if so, which server it was.

In this case, you confirmed that you got a reply, and that the IP address matched the one I quoted. This confirms firstly that your hardware can contact websites, and secondly that the website replying was geuine, so you haven't been hijacked when trying to connect to the BBC.

 

In test C, we double checked our connection by firing a ping at the BBC's IP address, rather than it's name. Again, the fact it came back fine shows your PC shuld be able to surf to the BBC either by name or number absolutely fine.

 

Finally, I got you to do an nslookup request. This is basically a DNS check, and determines not only the IP of the site you're trying to get to, but also where the DNS record is coming from. In your case, your D-Link router served up the DNS record 212.58.224.138 for bbc.co.uk, which we confirmed as being correct earlier.

 

As far as the bbc.co.uk website (which we're using as our control group here) goes, your issue isn't the HOSTS file that locutus mentions. He's quite correct in what he says; HOSTS is a local override that allows you to redirect, or block altogether, website DNS requests. However, if the file had been hijacked to prevent bbc.co.uk, then the tests we ran would have shown it.

 

Soooo...where does all this leave us? Well, it confirms that there is no hardware issue that will prevent you from opening up a browser and surfing to the bbc.co.uk website, and that your HOSTS file isn't preventing access to the bbc.co.uk site.

 

Now the next test. Please try to surf to BBC - Homepage with your usual browser. One of two situations will result:

 

1) You can't surf to the bbc.co.uk website. The problem is therefore your browser, or something hijacking it. You can further confirm this by installing a copy of another browser, such as FireFox, and trying to surf to the same site. If it works, the problem is most definitely your copy of IE. There are a number of things that may be able to help here, but Spybot is one of the best in sniffing out, and removing, common junk that hijacks your internet connections. I'd advise you isntalla nd run this program anyway as part of your standard cleaning routine.

 

2) You can get to bbc.co.uk. Great, your PC is still capable of website navigation from a hardware and software perspective. If there are other websites still causing you a problem, please repeat steps B and D from my previous post, instead using the name of the site you can't get to instead of bbc.co.uk. Let us know the results.

Edited December 14, 2009 by Tezcatlipoca

[Tezcatlipoca]

The main problem I'm having is it wont let me download or install updates, say, for instance, I go the MIcrosoft site, it'll say its checking what updates are needed ( or words to that effect ), then it comes up with an error, says it cant check, and thats as far as I get.

 

Ah, sorry I was under the impression that you were unable to surf to certain websites at all, hence my asking you to perform those initial checks.

Still, it's not done any harm to perform those checks and confirm that things should be running fine.

 

Regarding the updates, you could just turn on the automatic updates service built in to windows (under Control Panel), which will grab the updates. If you don't want to switch this on, and have a copy of any non-IE browser installed, you can use the WindizUpdate website to get updates directly from Microsoft without having to use their website. This site is completely safe, and all the updates are genuine M$ updates.

This site was started and is maintained by a group of people who were upset that M$ updates via the web are only accessible to those surfing in IE and those who are willing to install WGA software on their PC.

 

Personally, I'd try installing FireFox (it's free and won't touch your existing IE installation at all), and try updating with the above site.

 

If you prefer to stick with IE, then I would guess that something, either IE itself or another program you have running, is blocking certain scripts that M$ likes to run on its update website. If these scripts aren't allowed to run, it will cause the kind of issue you mention, with systems just timing out. You could try reinstalling IE, or upgrading to the latest version (assuming you haven't already done so).

Edited December 14, 2009 by Tezcatlipoca

[Tezcatlipoca]

Both pin1onu and locutus give good advice, but I'm not altogether convinced that this is a HOSTS file/DNS hijacking issue.

 

Of course, it might be quicker, kregrs, if you could just open the HOSTS file (located in the C:\Windows\system32\drivers\etc\ folder) in Notepad, then copy and paste the entire contents to this thread. We can tell you instantly if the file has been hijacked then.

 

Could you also kindly confirm if you actually have trouble surfing to any websites, or is the issue solely that the M$ update site times out for you when you try to start it up?

[Tezcatlipoca]

Host file was specifically mentioned in the definition I provided. I did toy with asking the OP to post but felt he might learn a bit from doing.

 

Sorry, not trying to steal your thunder at all, I just think it might be equally helpful for the OP to post the HOSTS file so we have a reference to explain what, if anything, has hijacked hir. Either way, we're both moving in the same direction, so the OP is in good hands!

 

I'm also of the suspicion that something, be it DNS or otherwise, is fouling up the OP's ability to update via M$'s own site, hence the alternative WindizUpdate suggestion. I'm wondering whether they can surf to other sites which are classically blocked by malware (I'm thinking Spybot, HijackThis, and a whole raft of AV sites).

[Tezcatlipoca]

Sorry again, I know I should start a thread but I've had/am having similar problems.

 

I just tried to install windizupdate with firefox and got this message:-

 

Firefox could not install the file at http://windizupdate.com/files/windizupdate.xpi because install script not found -204.

 

 

I presume that the link provided is for xp only? I run Shista.

 

That will be Vista buggering it up. Windizupdate offer a proper install executable as well, which does the same thing. Direct download link is here: http://windizupdate.com/files/windizupdate_setup.exe

[Tezcatlipoca]

Thanks Tez' date=' all done but no problems found. It's really weird, I am connected to the internet but there is a red X through the toolbar icon as if I am not???? When I put my cursor on it, it says "status unknown, access is denied"????[/quote']

 

Taking this to private message, so as not to hijack the thread.