1 Reply Latest reply on Dec 28, 2007 3:48 AM by Jubo

    DNS Changer / "unwanted websites" or "page cannot be displayed" error

      This threat:
      http://vil.nai.com/vil/content/v_141842.htm

      Has been causing a bit of trouble lately as by changing the DNS settings it stops the client machine for successfully updating their AV Signatures. All that is required to resolve this is to manually reset your DNS server to the correct value. This will vary depending on your ISP.

      Many users will be able to resolve their issue with the simple command line:
      netsh int ip reset resetlog.txt

      However this will completely reset all IP settings. This is fine in most cases, however in certain environments custom IP settings are required.
        • 1. RE: DNS Changer / "unwanted websites" or "page cannot be displayed" error
          Jubo
          See also McAfee's FAQ: Some customers are redirected to a non-McAfee website or receive an error or blank page when attempting to download or update McAfee software


          Description

          If your system is infected with this Trojan, you may find that your Web browser and other applications which use the Internet are unable to access the intended site, and are instead redirected to unwanted websites or receive a page cannot be displayed error. These errors occur when you attempt to update or install McAfee consumer products or access McAfee websites. The affected McAfee consumer products include McAfee Total Protection, McAfee Internet Security Suite, and McAfee VirusScan Plus.

          If you are a new customer and are trying to install McAfee software, the unwanted site may be displayed within the McAfee Download Manager window.

          Existing customers may find that product updates fail, and will be unable to receive the latest Virus Definition (DAT) files.

          If you are unsure if you are infected, please follow the steps below to verify:

          1. Click on Start, Run, and type cmd.exe.
          2. In the command prompt window, type:

            ipconfig /all
          3. If your DNS Servers address displays 85.255.116.189 or 85.255.113.44 your computer has been infected and you should continue to the steps below.
          If your DNS Servers do not display 85.255.116.189 or 85.255.113.44, then your computer has not been affected by this Trojan, and you do not need to continue.
          Windows Vista computers

          1. Click Start, Search, type cmd.exe, and press ENTER.
          2. In the Search Results window, right-click cmd.exe and select Run As Administrator.
          3. In the command prompt window, type:

            ipconfig /all
          4. Press ENTER.
          5. If your DNS Servers address displays 85.255.116.189 or 85.255.113.44 your computer has been infected and you should continue to the steps below.
          If your DNS Servers do not display 85.255.116.189 or 85.255.113.44, then your computer has not been affected by this Trojan, and you do not need to continue.


          Solution

          IMPORTANT: You must follow all of the steps below to receive the DAT update which will clean this infection upon the execution of a scan.
          Step 1- Clear the IP Stack

          1. Click Start, Run, type cmd, and press ENTER.
          2. In the command prompt window, type:

            netsh int ip reset reset.log
          3. Press ENTER.
          4. Close the command prompt window.
          For Windows Vista computers:

          1. Click Start, Search, type cmd.exe, and press ENTER.
          2. In the Search Results window, right-click cmd.exe and select Run As Administrator.
          3. In the command prompt window, type:

            netsh int ip reset reset.log
          4. Press ENTER.
          5. Close the command prompt window.
          If you are unable to access the Internet or update your McAfee products after performing these steps, see Manually clearing the IP Stack under Additional Information.
          Step 2 - Update and scan your system

          1. Right-click the M icon in your taskbar.
          2. Select Updates.
          3. After the update completes, right-click the M icon in your taskbar and select Scan.
          Your McAfee consumer product will detect and remove the Trojan.