Google redirection localhost.world

Maybe the fake certificates installed by this infection are the reason programs can't find it... but I am not sure :)
Just thinking

Have you deleted the following registry entries and also checked if they come back?

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutoProxyResultCache

They might come back if you did not delete the scheduled task (properly) that is set to run every x hours or days

FBtje said:

Have you deleted the following registry entries and also checked if they come back?

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutoProxyResultCache

They might come back if you did not delete the scheduled task (properly) that is set to run every x hours or days

How do I exactly do that and is this safe?

I'm unfamiliar with these things.

By the way thank you so far for the help and fast replies!

Put this in notepad and save it as regfix.txt. Close notepad.

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL

reg delete "HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL


reg delete "HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" /v EnableAutoProxyResultCache


pause

After this rename regfix.txt to regfix.bat.

Then open this file by rightclicking the file and then choose 'Run as administrator'. Confirm you want to open this file.

The screen, see below, pops up where you will have to confirm the deletion of every registry key. Type 'Y' and hit enter to delete the registry key. Repeat for the other keys.

FBtje said:

Put this in notepad and save it as regfix.txt. Close notepad.



After this rename regfix.txt to regfix.bat.

Then open this file by rightclicking the file and then choose 'Run as administrator'. Confirm you want to open this file.

The screen, see below, pops up where you will have to confirm the deletion of every registry key. Type 'Y' and hit enter to delete the registry key. Repeat for the other keys.

Renaming it to regfix.bat is not changing the file extension so I don't get the run as admin option.

I think you have showing file extensions disabled, so you renamed it to regfix.bat.txt. Make them visible by doing this:

Sorry, for Windows 10 see here:

http://www.file-extensions.org/artic...-in-windows-10

Thanks deleted each one.

Your welcome.. :)

You can keep the file and use it again in a couple of days or so to make sure the keys do not reappear. If the keys cannot be found, the script will tell you by this error:

ERROR: The system was unable to find the specified registry key or value.

Then you're all good.

Thanks a million!
The past 7-8 years (since win 7) I almost never had any kind of issue like this, I protect my pc very well, and managed to solve every issue if ever happened.
It's somewhat a shame that even with all these anti malware/virus programs I use, something can still come through.