avast.com resolving as 127.0.0.1

Viruses and worms
1

I recently got handed a laptop that appeared to be infected.

So I did the usual, manually remove with HiJackThis, then install a pre-downloaded version of Avast!.

HiJackThis no longer shows anything bad, and manually looking I can’t find anything bad either.

However, whenever I try and visit avast.com or *.avast.com it fails.

Using ping I see avast.com resolves to “127.0.0.1”.

I see another user has also experienced this issue, but there’s no solution, just directions to off-site virus definition updates.

Does anyone know how to resolve this issue?

I’ve tried all the usual stuff, so I’m expecting an experienced response, someone who’s perhaps fixed this before, recently.

Thanks.

2

How is your hosts file? Is it infected?
C:\windows\system32\drivers\etc\hosts

HostMan could scan it…
http://www.abelhadigital.com/2008/07/hostsman-3157-released.html

3

hosts file is NOT, I repeat NOT infected, this is one of the first things I checked. HiJackThis even has a tool for looking at it.

I’ve even tried rebooting into safe mode with networking, and it still resolves to 127.0.0.1.

4

Which is your operational system and firewall?
Any other security program installed?

5

XP Pro, windows firewall, no other security software installed.

6

I downloaded the latest version of Avast to another machine, then installed that and did a boot-time scan.

I reckon it was tidserv/tdssmaxt.sys causing the problem

7

Open Network Connections right click Local Area Connection Properties then select Internet Protocol (TCP/IP) then select Properties and Obtain IP address automatically and obtain DNS server address automatically should be checked if you are using a router with DSL or cable connection.

Have you ran Malwarebytes MBAM?
http://www.malwarebytes.org/mbam.php