Google redirection localhost.world

simrick said:

Seriously? and the certs as well?

Yep, and the same ini file. I deleted everything. Crazy how this went undetected

mixolyd said:

Nevermind my issue was not resolved. Thanks so much for posting this. Looks like I have the same task in my Task Scheduler.

No problem, I am glad I could help. If you need it I can write with greater detail what I did to remove it.

simrick said:

Wow. What AV do you use? @moraleja39 is using ESET.

Windows Defender. I did a full scan with ESET and Comodo also. That's crazy nothing picked this up.

moraleja39 said:

No problem, I am glad I could help. If you need it I can write with greater detail what I did to remove it.

That would be great. I deleted the task and ini file but not sure what registry changes to fix

Here are all the things I had to wipe:

• The scheduled task. Its name was "Adobe Acrobat Pro DC Update". You can open the task scheduler writing taskschd.msc on the start menu search bar and hitting enter.
• A file named "settings.ini" located on %APPDATA%\Adobe Acrobat Pro DC". Full path could be "C:\Users\[username]\AppData\Roaming\Adobe Acrobat Pro DC\settings.ini".
• In my case, two fake certificates. Open the certificate manager writing certmgr.msc on the start menu and hitting enter. The certificates are named "DO_NOT_TRUST_FiddlerRoot" and are under the folder "trusted root CAs" (or however it is in English)
• Registry changes used to force proxy usage. In my case, I totally deleted the following values:
  
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
  • HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutoProxyResultCache
  
  
• Just in case it is still enabled, disable the proxy. Go to control panel, internet settings, connections, LAN settings, and disable all checkboxes.

I also will attach the removed INI and certificate files, just in case they could be of use to anybody reading this, as they are not dangerous per se.

simrick said:

I am thinking this needs to be reported to the AVs.

Yeah, I think that too. Any idea on how to do that?