[VinConigs]

I recently had to remove a trojan Anti Virus 2009 infection from my computer along with many other infections that this bogus program allowed on my system. All is back to normal except for one odd thing: I can't access Google Mail! Here's what I've done so far:

1. Tried the other versions of GMail like html, https, and older versions.
2. Deleted all cookies, temp internet files and history.
3. Reset IE 7's security settings.
4. Turned off firewall and anti-virus program.
5. Installed both Chrome and Firefox and tried them.

Each time, I get a 'page cannot be displayed' type error message. System is a very ordinary Dell with 1GB RAM, Windows XP with all service packs installed. GMail worked fine before the infection.

I'm at a loss as to what to try next.

Any ideas would be appreciated.

[Cookiegal]

Have you checked the hosts file to see if entries were set there to block the site?

[VinConigs]

All of the hosts files I find are the ones put there by Microsoft. Is there a particular location that I should be looking for a hosts file that was potentially contaminated by a trojan? Is a potentially contaminated hosts file a system file? I have my computer to show hidden, but not system, files. Would clearing the DNS cache do any good? Would an repair in-place reinstall of Windows solve the problem? Thanks for your help.

An additional item: I can get to all the other Google features like Groups, Shopping, Books, Maps, etc., just not Mail. Also, I can get to other web mail providers, like Yahoo, with no problem. Any more ideas to try?

[Cookiegal]

Look in the following location for the hosts file:

C:\WINDOWS\system32\drivers\etc

It's in the etc folder and says simply Hosts with no file extension.

Right click on it and select to open it with Notepad and then copy and paste the contents here please.

[VinConigs]

Cokiegal,
You were absolutely right! The hosts file was very corrupted (see below) and was the root of the problem. Replacing it with a good, clean hosts file solved the problem. I can't thank you enough. For all to see, here's what I found when I opened the hosts file that was causing all the problems:

89.248.168.188 google.ae
74.125.45.100 secure-plus-payments.com
74.125.45.100 getantivirusplusnow.com
74.125.45.100 www.getantivirusplusnow.com
74.125.45.100 www.secure-plus-payments.com
89.248.168.188 google.at
89.248.168.188 google.az
89.248.168.188 google.ba
89.248.168.188 google.be
89.248.168.188 google.bg
89.248.168.188 google.bs
89.248.168.188 google.ca
89.248.168.188 google.cd
89.248.168.188 google.com.gh
89.248.168.188 google.com.hk
89.248.168.188 google.com.jm
89.248.168.188 google.com.mx
89.248.168.188 google.com.my
89.248.168.188 google.com.na
89.248.168.188 google.com.nf
89.248.168.188 google.com.ng
89.248.168.188 google.ch
89.248.168.188 google.com.np
89.248.168.188 google.com.pr
89.248.168.188 google.com.qa
89.248.168.188 google.com.sg
89.248.168.188 google.com.tj
89.248.168.188 google.com.tw
89.248.168.188 google.dj
89.248.168.188 google.de
89.248.168.188 google.dk
89.248.168.188 google.dm
89.248.168.188 google.ee
89.248.168.188 google.fi
89.248.168.188 google.fm
89.248.168.188 google.fr
89.248.168.188 google.ge
89.248.168.188 google.gg
89.248.168.188 google.gm
89.248.168.188 google.gr
89.248.168.188 google.ht
89.248.168.188 google.ie
89.248.168.188 google.im
89.248.168.188 google.in
89.248.168.188 google.it
89.248.168.188 google.ki
89.248.168.188 google.la
89.248.168.188 google.li
89.248.168.188 google.lv
89.248.168.188 google.ma
89.248.168.188 google.ms
89.248.168.188 google.mu
89.248.168.188 google.mw
89.248.168.188 google.nl
89.248.168.188 google.no
89.248.168.188 google.nr
89.248.168.188 google.nu
89.248.168.188 google.pl
89.248.168.188 google.pn
89.248.168.188 google.pt
89.248.168.188 google.ro
89.248.168.188 google.ru
89.248.168.188 google.rw
89.248.168.188 google.sc
89.248.168.188 google.se
89.248.168.188 google.sh
89.248.168.188 google.si
89.248.168.188 google.sm
89.248.168.188 google.sn
89.248.168.188 google.st
89.248.168.188 google.tl
89.248.168.188 google.tm
89.248.168.188 google.tt
89.248.168.188 google.us
89.248.168.188 google.vu
89.248.168.188 google.ws
89.248.168.188 google.co.ck
89.248.168.188 google.co.id
89.248.168.188 google.co.il
89.248.168.188 google.co.in
89.248.168.188 google.co.jp
89.248.168.188 google.co.kr
89.248.168.188 google.co.ls
89.248.168.188 google.co.ma
89.248.168.188 google.co.nz
89.248.168.188 google.co.tz
89.248.168.188 google.co.ug
89.248.168.188 google.co.uk
89.248.168.188 google.co.za
89.248.168.188 google.co.zm
89.248.168.188 google.com
89.248.168.188 google.com.af
89.248.168.188 google.com.ag
89.248.168.188 google.com.ar
89.248.168.188 google.com.au
89.248.168.188 google.com.bn
89.248.168.188 google.com.br
89.248.168.188 google.com.by
89.248.168.188 google.com.bz
89.248.168.188 google.com.cu
89.248.168.188 google.com.ec
89.248.168.188 google.com.fj
89.248.168.188 www.google.ae
89.248.168.188 www.google.as
89.248.168.188 www.google.at
89.248.168.188 www.google.az
89.248.168.188 www.google.ba
89.248.168.188 www.google.be
89.248.168.188 www.google.bg
89.248.168.188 www.google.bs
89.248.168.188 www.google.ca
89.248.168.188 www.google.cd
89.248.168.188 www.google.com.gh
89.248.168.188 www.google.com.hk
89.248.168.188 www.google.com.jm
89.248.168.188 www.google.com.mx
89.248.168.188 www.google.com.my
89.248.168.188 www.google.com.na
89.248.168.188 www.google.com.nf
89.248.168.188 www.google.com.ng
89.248.168.188 www.google.ch
89.248.168.188 www.google.com.np
89.248.168.188 www.google.com.pr
89.248.168.188 www.google.com.qa
89.248.168.188 www.google.com.sg
89.248.168.188 www.google.com.tj
89.248.168.188 www.google.com.tw
89.248.168.188 www.google.dj
89.248.168.188 www.google.de
89.248.168.188 www.google.dk
89.248.168.188 www.google.dm
89.248.168.188 www.google.ee
89.248.168.188 www.google.fi
89.248.168.188 www.google.fm
89.248.168.188 www.google.fr
89.248.168.188 www.google.ge
89.248.168.188 www.google.gg
89.248.168.188 www.google.gm
89.248.168.188 www.google.gr
89.248.168.188 www.google.ht
89.248.168.188 www.google.ie
89.248.168.188 www.google.im
89.248.168.188 www.google.in
89.248.168.188 www.google.it
89.248.168.188 www.google.ki
89.248.168.188 www.google.la
89.248.168.188 www.google.li
89.248.168.188 www.google.lv
89.248.168.188 www.google.ma
89.248.168.188 www.google.ms
89.248.168.188 www.google.mu
89.248.168.188 www.google.mw
89.248.168.188 www.google.nl
89.248.168.188 www.google.no
89.248.168.188 www.google.nr
89.248.168.188 www.google.nu
89.248.168.188 www.google.pl
89.248.168.188 www.google.pn
89.248.168.188 www.google.pt
89.248.168.188 www.google.ro
89.248.168.188 www.google.ru
89.248.168.188 www.google.rw
89.248.168.188 www.google.sc
89.248.168.188 www.google.se
89.248.168.188 www.google.sh
89.248.168.188 www.google.si
89.248.168.188 www.google.sm
89.248.168.188 www.google.sn
89.248.168.188 www.google.st
89.248.168.188 www.google.tl
89.248.168.188 www.google.tm
89.248.168.188 www.google.tt
89.248.168.188 www.google.us
89.248.168.188 www.google.vu
89.248.168.188 www.google.ws
89.248.168.188 www.google.co.ck
89.248.168.188 www.google.co.id
89.248.168.188 www.google.co.il
89.248.168.188 www.google.co.in
89.248.168.188 www.google.co.jp
89.248.168.188 www.google.co.kr
89.248.168.188 www.google.co.ls
89.248.168.188 www.google.co.ma
89.248.168.188 www.google.co.nz
89.248.168.188 www.google.co.tz
89.248.168.188 www.google.co.ug
89.248.168.188 www.google.co.uk
89.248.168.188 www.google.co.za
89.248.168.188 www.google.co.zm
89.248.168.188 www.google.com
89.248.168.188 www.google.com.af
89.248.168.188 www.google.com.ag
89.248.168.188 www.google.com.ar
89.248.168.188 www.google.com.au
89.248.168.188 www.google.com.bn
89.248.168.188 www.google.com.br
89.248.168.188 www.google.com.by
89.248.168.188 www.google.com.bz
89.248.168.188 www.google.com.cu
89.248.168.188 www.google.com.ec
89.248.168.188 www.google.com.fj
89.248.168.188 google.com
89.248.168.188 www.google.com
89.248.168.188 bing.com
89.248.168.188 www.bing.com
89.248.168.188 search.yahoo.com
89.248.168.188 www.search.yahoo.com
89.248.168.188 search.live.com
89.248.168.188 search.msn.com
89.248.168.188 googleads.g.doubleclick.net
89.248.168.188 www.googleads.g.doubleclick.net
89.248.168.188 pubads.g.doubleclick.net
89.248.168.188 www.pubads.g.doubleclick.net
89.248.168.188 partner.googleadservices.com
89.248.168.188 www.partner.googleadservices.com
89.248.168.188 www.partner.googleadservices.com
74.125.45.100 test1111.com
74.125.45.100 test1112.com
74.125.45.100 4-open-davinci.com
74.125.45.100 securitysoftwarepayments.com
74.125.45.100 privatesecuredpayments.com
74.125.45.100 secure.privatesecuredpayments.com
74.125.45.100 www.getavplusnow.com
74.125.45.100 www.securesoftwarebill.com

[Cookiegal]

Yes, that will do it. You're welcome.

Are you confident your system is totally clean?

What did you do to clean out the infection?

We could check further to make sure if you like.

[VinConigs]

This system was first contaminated by a teenager doing Limewire downloads -- no matter what I say ... well, you know the rest. During the process of cleaning up, I found copies of Cool Web Search, Vundo, a rootkit and a botnet program. I used Comodo Anti-virus, AVG Anti-virus and Malwarebytes at diffgerent times. Finally, I scanned with PC-Cillin and did an on-line scan from Kaspersky; both came out clean. During the process, I wiped out the restore points and then created a new one after all the infections were gone. I do think I'm clean -- and I've uninstalled Limewire - again.

[Cookiegal]

I do think there could still be some lingering infected files or registry entries and it would be a good idea to pursue it further so the infection doesn't respawn, as rootkits can do if not completely cleaned out.

HijackThis does not show many things but it can give us clues and I still like to use it as a starting point so please do the following:

Click here to download HJTsetup.exe.

• Save HJTsetup.exe to your desktop.
• Double click on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Hijack This.
• Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
• Put a check by Create a desktop icon then click Next again.
• Continue to follow the rest of the prompts from there.
• At the final dialogue box click Finish and it will launch Hijack This.
• Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
• Click Save to save the log file and then the log will open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

[RootbeaR]

Originally Posted by VinConigs

This system was first contaminated by a teenager doing Limewire downloads -- no matter what I say ... well, you know the rest.

That's what happens when people try to steal stuff.

Change their account type to limited so they can't install programs.

Until they get their own PC.

[perfume]

Dear RootbeaR,
Not a single entry in the HOSTS File which starts with 127! The File's been mauled. Quoting hewee, (my HOSTS File "GURU") ,after cookiegal sets things into place, the O.P.,may kindly download HostsMan to update the HOSTS File! Best wishes.