Computer in question can no longer access the www.almaart.com website. It worked fine, then the user went to several of the embedded links on that site. One of them loaded a tracking program that was a bar down the right side of the screen that gave information regarding all the sites visited during that session. After that point there is no access to the original alma art site When access is attempted the browser times out. All other websites work fine.
Steps taken:
- Flushed all IE cache, cookies and temp files
- Norton Antivirus 2009 scans – no problems found
- Tried IE, Chrome and Firefox all with same results
- Ping returns normal results to 66.96.143.165
- Review Hosts file – normal
- Registry key for Hosts – normal
- Scanned registry for almaart and corresponding ip address – not found
- Review of the DSNLog from ipconfig showed access attempted access to an Albanian site.
- HijackThis log reviewed – no anomalies seen
- Malwarebytes anti-malware run – no issues found
- SuperAntiSpyware found 1 registry issue and 9 cookies – all deleted
- During reboot, received an error “C:\Programs not found”, boot continued with out any problems and it has not reoccurred.
- Switched to OpenDNS – no change
- Still not able access to just that website.
- Used infected and another computer on the same network to capture the DNS access log that is included below. First flushed DNS cache, attempted an access, then captured the results that are attached:
- Captured the current results from HijackThis and included as and attachment
What is causing this phenomenon?