Utopia.net DNS hijack?

 Hello, all.

I was doing some repair on my wifi network, (couldn't load usatoday.com, or theatlantic.com via any wifi device in my home, but direct ethernet connections and also cellular G4s signal were able to load both sites easily, there are a bunch more, these are just two examples)

I noticed that in my system tray, my network status said "Currently connected to utopia.net" which is strange since I am a Comcast Xfinity customer, and presumably using their servers, (75.75.75.75)
I looked up "utopia.net" and saw several discussions about DNS hijacking, so as an experiment, set my DNS to google's public DNS servers, (8.8.8.8), restarted my computer, (wasn't sure if that was even needed) and still, my network connection comes up as "utopia.net"
I have used a VPN service to safeguard business information between myself and several clients financial, but have since uninstalled and deleted them from my computer,  seeking an answer to this strange "utopia.net" question. 

I saw was there was a discussion here a couple of years ago on the same subject and thought I'd see if anyone had any definitive information on what exactly "utopia.net" network is, and what to do about it. I'd prefer that if I am using Comcast Xfinity, that my network connection status say "Comcast Xfinity" 


Comcast techs, by phone, (no explanation needed) said that the original problem of not being able to load certain sites on my wifi network, maybe have been due to the DNS getting hijacked, or something to that effect. 

Any ideas or information on what this is and how to fix it?

Thanks!
RR

Stats:
Windows 7 Ultimate 64 -bit system

Dreaded arris TG862 standard Comcast wireless router
Processor AMD A8 7600 Radeon R10 10 compute cores 4C+6G
 

Edited by RandomRobert, 26 May 2017 - 12:52 PM.
Moved from Win 7 to Am I Infected - Hamluis.

Have you tried resetting your router and resecuring it? How to Login to the Arris TG862

Once you have held the reset button in, log into the router using the IP number and password provided in link above.

The above may or may not fix the problem. Suggest you use the programs below to clean, remove adware and remove malware.

Use CCleaner to remove Temporary files, program caches, cookies, logs, etc. Use the Default settings. No need to use the

Registry Cleaning Tool...risky. Pay close attention while installing and UNcheck offers of toolbars....especially Google.

After install, open CCleaner and run by clicking on the Run Cleaner button in the bottom right corner.

CCleaner - PC Optimization and Cleaning - Free Download

• download Malwarebytes to your desktop.
• Double-click mb3-setup-1878.1878-3.0.6.1469.exe and follow the prompts to install the program.
• Then click Finish.
• Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
• If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
• When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
• Restart your computer when prompted to do so.
• The Scan log is available throughout History ->Application logs. Please post it contents in your next reply.

Download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on adwcleaner.exe to run the tool.
• Click on Scan button.
• When the scan has finished click on Clean button.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the contents of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

• download Junkware Removal Tool to your desktop.
• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message

Download and run the FREE online scanner from Free Virus Scan | Online Virus Scan from ESET | ESET

• Place a checkmark in YES, I accept the Terms of Use, then click Start. Wait for ESET Online Scanner to load its components.
• Select Enable detection of potentially unwanted applications.
• Click Advanced Settings, then place a checkmark in the following:
  • Remove found threats
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• Click Start to begin scanning.
• ESET Online Scanner will start downloading signatures and scan. Please be patient, as this scan can take quite some time.
• When the scan is done, click List threats (only available if ESET Online Scanner found something).
• Click Export, then save the file to your desktop.
• Click Back, then Finish to exit ESET Online Scanner.

Thanks for the quick reply. 
I am currently running AVAST premium Spybot search and Destroy, and Malwarebytes

I reset and resecured my gateway  (a brand new one just replaced yesterday by comcast, same model)
I ran CCleaner
I ran Malwarebytes (It found bing entries that my premium AVAST apparently missed)
I am going to run ADW Cleaner, and Junkware Remioval 


I was also told that by adding the domain "utopia.net" to the hosts file found on C: drive it would block their DNS servers or something like that,  but I can't seem to open the hosts file, or save anything without creating a copy which is a .txt. file. the original "hosts" file properties just says "file" and when I try to open it asks me to associate it with a program. 

Is this true?
thanks!
Under seige,
RR

ADW cleaner logfile:
 

I suggest uninstalling Spybot S&D. It has lost favor among security pros for several years now and it interferes with other security programs.

It may be why you can't access the Host file.

Post the three lists mentioned below using CCleaner.

Open CCleaner and click on Tools. Choose Startups. On that page you will see a list of Windows Startups and at the top tabs for each browser and Scheduled Tasks.

At the bottom right of that page you will see a button when clicked will allow you to Copy and Paste the list of Windows Startups and Scheduled Tasks into your next

post. Please do that.

Open CCleaner and click on Tools. Choose Uninstall. On that page you will see a list of programs installed on your computer and at the bottom right of that page you

will see a button when clicked will allow you to Copy and Paste that list in your next post. Please do that.

I just uninstalled Spybot S&D and here are the three lists. 

Also: Question. I deleted spybot, but my hosts file still does not open to any specific program, unless I pick one, and then it saves it as a separate file from the actual hosts file. 
Is it true if I add utopia.net to the hosts file that it will block or bypass those dns servers?
thanks for all your help!

NOTE: "Everything.exe" is my search and index program from voidtiools, in case you were wondering.


_______________________ _______________________________________________________________________
1: CC startup list

Delete these Startups: Use CCleaner by clicking on each item and choosing Delete on the right.

Yes HKCU:Run GoogleChromeAutoLaunch_CBA6F2999873A3BB14AE5943DDD53554 Google Inc. "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5

Yes HKLM:Run QuickTime Task Apple Inc. "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

Disable these Startups: Use CCleaner by clicking on each item and choosing Disable on the right.

Yes HKCU:Run ISUSPM Flexera Software LLC. C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler

Yes Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

Followed all the above suggestions, deleted Leawo cleaner, (no reports it had anything to do with utopia, deleted it anyway same to try it) ran a boot time scan on avast, full scan on malwarebytes, released, renewed the config, flushed the DNS,  and started the computer, still says, "Currently connected to: Utopia.net"

The strange thing about this is that it seems to have been going for over 2 years at least, and nearly nobody knows anything about it. Weird.

http://www.dslreports.com/forum/r30150713-DNS-hijacking?search=utopia.net (2015) 
Question
 Can I remove the following without affecting my wireless network, and internet access? In our house we have an Xfinity Blast 250 account, an Arris tg1682g, a d-link 890LR, and a netgear AC3200, the latter two being in AP mode.
 

Edited by RandomRobert, 29 May 2017 - 02:36 AM.

This should help you decide whether to keep those Cisco items or uninstall them. Can I remove Cisco EAP-FAST Module, Cisco LEAP Module, and Cisco PEAP - Microsoft Community

Install date for those 3 items is the date for several items installed as you can see in the list of installed programs.

Your link to dsl reports is different from the one I posted. It had a solution of adding another router. Did you read that?

QUOTE: Only solution (I found) is to use another router behind this, and set this one up in bridged mode. Or leave in default mode (as perim. firewall), and avoid using the builtin DHCP, by manually configuring second router.

The next comment about the above QUOTE: Agree that its annoying that the Cisco device hands out this default domain suffix. If you can login to that box there should be a way under your DHCP settings to disable or change the default domain suffix option being passed out to the DHCP clients in your house.

Using nslookup is spotty at best I have a feeling that if you ran the exact same nslookup command with a trailing . at the end of your command, you would get the correct result i.e. C:> nslookup google.ca.

Also - in theory, the default domain suffix should not affect anything that you are doing via your web browser as most are smart enough to deal with this. However it could lead to some slowness because of additional DNS work being potentially required.

When it comes right down to it, what you are doing to solve the problem will work. Put the Cisco into bridged mode and use another device for wifi in your house. Honestly, you will end up having many fewer problems running this way - unless the 2nd device is also garbage Let the modem be a modem, and let a wifi device handle wifi. Good luck!

END QUOTE

EAP-FAST, LEAP, PEAP, I got rid of all three since I never use wireless with this computer. Flushed DNS cache, restarted same problem. I still get utopia.net
You were saying that I can use another router as a filter for this DNS hijack? when you say put the router BEHIND my Comcast router, you mean make a direct cable connection to the new router and then attach my Comcast router to that one, or the reverse?

I truly appreciate this help. Thank you!

I think it is harmless....utopia.net. I only provided info to help you decide. It has been a learning experience for me. At first I thought it

might be some adware or worse. Not anymore after doing research on the web.

Really? Then What is it exactly?

Thanks.
RR

Start a new topic in the Malware Removal forum. Someone there will be able to remove all of Utopia.net. They use tools not

allowed in this forum and know how to use them.

Please follow the instructions in the Malware Removal and Log Section Preparation Guide starting at Step 6.

• If you cannot complete a step, then skip it and continue with the next.
• In Step 6 there are instructions for downloading and running FRST which will create two logs.

When you have done that, post your logs in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here, for assistance by the Malware Response Team.

Start a new topic, give it a relevant title and post your log(s) along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. If you cannot produce any of the required logs...start the new topic anyway. Explain that you followed the Prep. Guide, were unable to create the logs, and describe what happened when you tried to create them. A member of the Malware Removal Team will walk you through, step by step, on how to clean your computer.

After doing this, please reply back in this thread with a link to the new topic so we can close this one.

DO NOT bump your new topic. Wait for a response from one of the Team Members.

Update: SOLVED
 

I opened my AVAST antivirus and internet security, and did a “Scan network for threats” , it found a vulnerability for Wannacry Double pulsar ransomeware/ malware virus,  and so I followed their instructions on how to remove it using an update patch. NOTE; I am not certain what if, any connection this has with my former problem.
Google this to find out the patch for your version of windows.
“March 2017 Security Only Quality Update for Windows”

Then I went to the  “settings” in the firewall section of avast, and saw a list of  network profiles, and among them, sure enough, was Utopia.net! I selected “Delete” from the right click drop down menu, not really knowing what would happen. And deleted utopia.net from the network profiles list.
Strangely, despite the fact that Avast said I was not connected to a network,  I was able to go to several pages easily.

Finally I restarted my computer and then when I logged back on,  POW, utopia.net was no longer listed as the network I was connected to. My network now says 
“Currently connected to hsd1.ca.comcast.net”

I don’t know how I would do that in other security programs, but I’d guess that deleting the network profile “utopia.net” is the key, since it was for me. Thanks for all your help!

In avast at least, the path is firewall-settings-network profiles, look for utopia.net and use the right hand menu to delete it and restart computer. 

RR
 

Edited by RandomRobert, 29 May 2017 - 07:56 PM.

Good...hopefully it is gone for good. I could never determine if your ISP was responsible for Utopia or not....mixed results.

As far as the patch goes...if you updated each month or accept updates automatically  then you have the March update that is referring to.