VIrus?

[metalmania31]

Hey guys on my brothers laptop (lenovo z560 win7home64) he was trying to get to a website the groceryoutlet.com and it would pull up as not available. Even though everyone else on our network could and his friends could at their homes and his phone. So after doing some basic cleaning of network temp files and such it still wasn't going to the site. So I checked the network settings on the wireless and the dns addresses were changed to 216.146.35.240 for both 1st and 2nd. I though that's odd. I changed them back to what I set them to and tried again. It wouldn't open the website so I checked back with the dns settings and again they were changed back to 216.146.35.240. I going to assume virus and I'm running system sweeper now. Has anyone encountered this type of virus?

 

[metalmania31]

Got done scanning and it's not detecting anything. What else can fix this short of complete clean install?

 

[metalmania31]

It looks like after some research it might have been some program called Sendori. After uninstalling it I regained controll of the DNS settings. Not sure how it was installed. I'll have to wait and see if any further issues from this come up.

I'm blocking the site Sendori on my router. What would the sytax be to universally block any instance of Sendori.com?

 

[Borg 386]

Might be a good idea to run a scan with Malwarebytes to see if that comes up with anything.

Malwarebytes : Free anti-malware, anti-virus and spyware removal download

 

[metalmania31]

I ran all the scanners I have installed on his system. I ran norton, malwarebytes, superantispyware, and system sweeper. All came up clean. I think for now it's considered legit program as they have a website and according to an article it's now owned by ask.com. I've promptly blocked the website and any iteration of the site on my router. As far I'm concerned though it's malware/virus. Anything that alters stuff without permission is bad.

 

[CanIHaz]

Try using hitman Pro and see if it detects anything.

 

[metalmania31]

Try using hitman Pro and see if it detects anything.

I'll try that right now.

Nope just couple tracking cookies. I'm confident I got rid of it. As the DNS is staying where I set it to.

 

[metalmania31]

But has anyone seen this Sendori thing?

 

[AllOnTheBus]

Don't know if you knew this and don't know whether you are interested either, but
by doing a whois lookup of the DNS server address you have listed above (216.146.35.240)
returns the web hosting company Dyynamic Network Services Inc.

You might find it interesting to know that this is the same website which at one time was
hosting Wikileaks until they started getting belted with Denial of service attacks and therefore
promptly let go Wikileaks so as not to jeopardise other client relations.

In relation to your question about the Sendori thing, no I have not witnessed it
or even heard of it for that matter before coming across your thread. CNet and Brothersoft
have it listed as an anti-malware application which is actually supposed to help speed
up (if you believe that) navigation to a desired website. Why or how this product is changing your DNS address if in fact that is the root of your problem in the first place is a mystery.

If the Sendori software is in fact legitimate (and remember that there are products out there claiming
they will help when in fact they are malicious themselves) and if you trust the opinion
of CNet and such sites then Sendori may have had a report from someone affected by the site
you were trying to access effectively blocking it until you manually allowed it into a trusted sites list.

Again, if the Sentori product is legit I would be looking for another root cause
of the changing DNS address problem even though as you say after uninstalling it is OK.

FYI - the most common places to check for Malware or Virus manually are:
1) Through Task Manager -> Processes and Dr. Google to research the processes that may be running/ listed
2) I also like to check the Run and Run Once registry entries in both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE
You can find what is in those entries by using the following path/s:
HKEY->[CURRENT_USER or LOCAL_MACHINE]->SOFTWARE->MICROSOFT->WINDOWS->CURRENT VERSION->LOOK FOR THE RUN AND RUN ONCE FILES HERE AND INVESTIGATE WHAT IS IN THERE

This is just my opinion and others will probably disagree. Apologies for not being able to pin the DNS addy changing on anything in particular but I hope this has been somewhat helpful.

Cheers

 

[metalmania31]

Don't know if you knew this and don't know whether you are interested either, but
by doing a whois lookup of the DNS server address you have listed above (216.146.35.240)
returns the web hosting company Dyynamic Network Services Inc.

You might find it interesting to know that this is the same website which at one time was
hosting Wikileaks until they started getting belted with Denial of service attacks and therefore
promptly let go Wikileaks so as not to jeopardise other client relations.

In relation to your question about the Sendori thing, no I have not witnessed it
or even heard of it for that matter before coming across your thread. CNet and Brothersoft
have it listed as an anti-malware application which is actually supposed to help speed
up (if you believe that) navigation to a desired website. Why or how this product is changing your DNS address if in fact that is the root of your problem in the first place is a mystery.

If the Sendori software is in fact legitimate (and remember that there are products out there claiming
they will help when in fact they are malicious themselves) and if you trust the opinion
of CNet and such sites then Sendori may have had a report from someone affected by the site
you were trying to access effectively blocking it until you manually allowed it into a trusted sites list.

Again, if the Sentori product is legit I would be looking for another root cause
of the changing DNS address problem even though as you say after uninstalling it is OK.

FYI - the most common places to check for Malware or Virus manually are:
1) Through Task Manager -> Processes and Dr. Google to research the processes that may be running/ listed
2) I also like to check the Run and Run Once registry entries in both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE
You can find what is in those entries by using the following path/s:
HKEY->[CURRENT_USER or LOCAL_MACHINE]->SOFTWARE->MICROSOFT->WINDOWS->CURRENT VERSION->LOOK FOR THE RUN AND RUN ONCE FILES HERE AND INVESIGATE WHAT IS IN THERE

This is just my opinion and others will probably disagree. Apologies for not being able to pin the DNS addy changing on anything in particular but I hope this has been somewhat helpful.

Cheers

Thanks for chiming in. I've blocked all instances of this so the links you privided are not reachable. I've read that it seemed legit, but I was able to find only one instance on a firefox forum where someone was calling it malware. My brother has not experienced any other issues and the DNS settings have remained what I set them to. Any software that installs itself without permission and prevents the user from changing network settings sounds like malware to me.
Here's some reviews backing up my experience. I think it's malware disguised. http://download.cnet.com/Sendori/3640-18510_4-11912980.html

 

[AllOnTheBus]

I haven't provided any links in my post so I'm unsure of what you mean there.

I followed your link to the Cnet review page and I see what you mean - a direct mention
of how it can automatically change your DNS settings and that can't be good that's for sure. I seriously don't know how Cnet and Brothersoft can give this a 3 and 4 star rating (or thereabouts from memory) respectively- ridiculous!

As for the installation of the "malware" if in fact that's what it is or will be labelled as, it can not have
installed by itself. By this I mean that the only way that software is going to end up on a machine
is a) If someone places it there (ie: attack either remotely or from a user with access) or b) If it has been inadvertently installed along with another piece of software (ie: I always use Ask Toolbar as an example of pesky software which unless unchecked installs with various other softwares).

I'm glad to see you have solved the problem in regards to your brothers laptop and it looks
like this thread may be useful for anyone who has also run into that piece of malware (yes - let's call it that now then and again that's only what yourself and I believe).

I did come across some other people having the same problem after having a bit more of a look around but it seemed that they were having trouble uninstalling it as they couldn't see it in programs and features. If you found it to be a little bit of a complicated process to get rid of, I'm sure that others would be quite pleased if you could explain the procedure you used to delete it.

Thanks in advance.

 

[metalmania31]

I haven't provided any links in my post so I'm unsure of what you mean there.

I followed your link to the Cnet review page and I see what you mean - a direct mention
of how it can automatically change your DNS settings and that can't be good that's for sure. I seriously don't know how Cnet and Brothersoft can give this a 3 and 4 star rating (or thereabouts from memory) respectively- ridiculous!

As for the installation of the "malware" if in fact that's what it is or will be labelled as, it can not have
installed by itself. By this I mean that the only way that software is going to end up on a machine
is a) If someone places it there (ie: attack either remotely or from a user with access) or b) If it has been inadvertently installed along with another piece of software (ie: I always use Ask Toolbar as an example of pesky software which unless unchecked installs with various other softwares).

I'm glad to see you have solved the problem in regards to your brothers laptop and it looks
like this thread may be useful for anyone who has also run into that piece of malware (yes - let's call it that now then and again that's only what yourself and I believe).

I did come across some other people having the same problem after having a bit more of a look around but it seemed that they were having trouble uninstalling it as they couldn't see it in programs and features. If you found it to be a little bit of a complicated process to get rid of, I'm sure that others would be quite pleased if you could explain the procedure you used to delete it.

Thanks in advance.

Well I was able to uninstall it from CCleaner. It was listed among the programs. I also noticed in the Norton firewall many instances of Sendori being allowed which I promptly removed. My brother didn't install it as he thought I installed when I was fixing his computer prior to this issue. I'm guessing some drive by install from a website. Yeah, I hope more people become aware if this program. Seems more harmful than good.

Funny you mention ask toolbar as that was one of the businesses mentioned in an article as having purchased sendori. So it's possible it installed with the ask toolbar, but I didn't see that tool bar on the laptop.

 

[AllOnTheBus]

Yep - gotta beware of the crapware you may be installing with any software.
It's very easy to become complacent and click next, next, next as quick as we can,
but I tend to try to take at least a few seconds to look at what I'm clicking next to as
sometimes the "extras" are quite the nuisance to get rid of.

Thanks for posting your method back, I'm sure that will assist someone in future as
a lot of people are accustomed to CCleaner and I'm sure most semi literate computer users know how to block a program through the use of their antivirus and/or the firewall they are using (one would like to think anyway!). I only hope that by deleting the software through CCleaner (does it appear as a program or a registry entry??) doesn't affect any other processes or services which it may attach itself to. So far so good for you though so that's good to hear.

 

[Borg 386]

Unfortunately, the problem of software makers inserting those little hidden presents is going to get worse. The makers of the software get money from the makers of other software by inserting/including it in the main program. They have to mnake a profit somehow....

Most legit companies will tell you right up front that extra software is included and give you the option to opt out. Unfortunately, as with a recent case, a maker included the software in the package without the option to opt out. When confronted, it turned out that the mention of including said extra program was clearly mentioned in the EULA. Towards the bottom of the agreement. Still legit, but somewhat underhanded.

I've found that MSE will sometimes detect these included item, but lists them as "Potentially Unwanted Programs/Software."

 

[AllOnTheBus]

Sounds about right Borg

If no-one wants to install the "crapware" then they find a way
of hiding it such as in the EULA as you mentioned.
Great!! Now I,m gonna have to read every EULA from start
to finish as well to make sure I don't get garbage I don't want.

Ahh well- as Ned Kelly said just before they hung him - "Such is life"
Might go add that to quote of the day

 

[Krankheiten]

my own battle with Sendori

I realize this is an older post but I had to chime in as it did in fact help solve an issue that started yesterday after a dumb mouse click.

Using raidcall yesterday I wanted to share a music clip to a few buddies of mine. I went to get a plug in to enable the audio sharing and stupidly clicked an add banner. Anyway, I thought I had got what I was looking for and seconds later chrome, firefox, and the VOIP program raidcall, stopped functioning.

I ran through Malwarebytes, and it pushed out a rootkit in 4 different locations. I disabled system restore, just in case it might try to hide there on reboot, and then restarted.

Still chrome, firefox and raidcall would not function.

I came across this post today that mentioned the Sendori. Then I took a look at when it was installed. Yesterday. I have since uninstalled Sendori and ran a few more scans. They come up clean and chrome, firefox and raidcall are now functioning.

 

[alikhan]

Sendori is a program which overwrites your DNS address so you need to reconfigure the DNS address or set it to find the dns.If you are using avast antivirus then you would have got the following message saying says "MALWARE BLOCKED" Object: EXE http//sendori.com/upgrade/sendori setup-2.0.4.exe/>SINSTDIR SP.exeSeverity: high
Threat: Win32:Malware-gen.

Following steps should help removing this malware .
First go to add remove programs and uninstall. If that doesn't work use your windows explorer and find the folder for Sendori then remove it from there, next click on start and in the type box or run if your regedit then hit F3 it will bring up a search for your registry and type sendori and hit enter if it finds any registry lines for Sendori then delete it and hit F3 to search again. Continue until all lines relating to Sendori have been removed. Searching your registry will insure you remove any trace of Sendori.

 

[eloew]

This Sendori virus was intalled on my window 7 computer when I installed DAEMON Tools Lite.

 

[burmeind]

I also just installed DAEMON Tools Lite onto my computer, and minutes later had this same issue. The DNS settings were constantly reset to the ip address listed in the original post. Googling the issue brought me here. I then used my start-bar search function to find Sendori, but I did not. Before considering making record of its name, I went into the task manager and manually shut down the executable which was labeled 'Sendori'. The issue has now disappeared. I am currently uninstalling it with CCleaner, and if the issue reappears, I will edit my post/reply again to let you all know.

 

[bigcitycat]

Express Install Recommended.