I have a Windows 2000 Professional pc with the Qhost
trojan virus. In order to make changes to the registry, I
need to make a copy of the registry. So, I am trying to
make a Emergency boot disk. I try to do this through the
backup Wizard (programs, accessories, system tools,
backup). Through this Backup wizard, I specify that I want
a backup copy of the system state. The wizard assumes you
want to copy to A: (which would entail tons of
diskettes). I have tried to browse to D (a cd), but it
doesnt think there is a cd in the drive, and it tells me I
don't have permission.

I want to know if it's possible to copy the backup files
to a CD using the wizard.?

Hi Diana,

The answer to the last question is NO.
The alternative is to make the backup on the HDD and burn it.

You are close to right about the ERD (emergency repair disk)
If is very small and goes right on a floppy. Just format the floppy with that machine.
Go to backup
choose ERD
Put the floppy in
OK
Takes so little time you should make one on a regular basis.
After you're through mark it , date it, and put it up for safe keeping.

For the backup
Go to backup
Choose full backup
check SystemState
OK
Let it do it's thing.

After it is through, you can burn it to CD.
Put in a safe place
I would use CD-RW if possible and start a program of regular 'full" backups

It will pay in the long run

Anything else just ask
good computing,
don
---------------------





"Diana" <(E-Mail Removed)> wrote in message
news:003501c3990d$37d0c800$(E-Mail Removed)...
I have a Windows 2000 Professional pc with the Qhost
trojan virus. In order to make changes to the registry, I
need to make a copy of the registry. So, I am trying to
make a Emergency boot disk. I try to do this through the
backup Wizard (programs, accessories, system tools,
backup). Through this Backup wizard, I specify that I want
a backup copy of the system state. The wizard assumes you
want to copy to A: (which would entail tons of
diskettes). I have tried to browse to D (a cd), but it
doesnt think there is a cd in the drive, and it tells me I
don't have permission.

I want to know if it's possible to copy the backup files
to a CD using the wizard.?

If = It
"dcdon" <(E-Mail Removed)> wrote in message
news:RaHlb.4017$(E-Mail Removed)...
Hi Diana,

The answer to the last question is NO.
The alternative is to make the backup on the HDD and burn it.

You are close to right about the ERD (emergency repair disk)
If is very small and goes right on a floppy. Just format the floppy with that machine.
Go to backup
choose ERD
Put the floppy in
OK
Takes so little time you should make one on a regular basis.
After you're through mark it , date it, and put it up for safe keeping.

For the backup
Go to backup
Choose full backup
check SystemState
OK
Let it do it's thing.

After it is through, you can burn it to CD.
Put in a safe place
I would use CD-RW if possible and start a program of regular 'full" backups

It will pay in the long run

Anything else just ask
good computing,
don
---------------------





"Diana" <(E-Mail Removed)> wrote in message
news:003501c3990d$37d0c800$(E-Mail Removed)...
I have a Windows 2000 Professional pc with the Qhost
trojan virus. In order to make changes to the registry, I
need to make a copy of the registry. So, I am trying to
make a Emergency boot disk. I try to do this through the
backup Wizard (programs, accessories, system tools,
backup). Through this Backup wizard, I specify that I want
a backup copy of the system state. The wizard assumes you
want to copy to A: (which would entail tons of
diskettes). I have tried to browse to D (a cd), but it
doesnt think there is a cd in the drive, and it tells me I
don't have permission.

I want to know if it's possible to copy the backup files
to a CD using the wizard.?

Hi Dianna - Don answered your direct question, but here is some additional
info that may help you with qHosts. Specifically, use the Brown University
Removal Tool.

You've apparently gotten infected with the QHosts trojan. Read here for
information:

http://www.sarc.com/avcenter/venc/da...an.qhosts.html
http://us.mcafee.com/virusInfo/defau...virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/...50/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates (McAfee), be sure to get the EXTRADAT.exe
update from the above page as well as your regular update).

3a. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com...oval.tool.html

3b. An alternative that by report works much better than the Symantec tool
is the Brown University Removal Tool, here:

http://software.brown.edu/dist/w-cleanqhosts.html THIS WOULD BE MY PRIMARY
RECOMMENDATION

If that still doesn't clean it up (and a number of people are reporting that
it did not with the Symantec tool), then follow the Manual Removal
instructions at the link in 3a. The following is courtesy of Mike Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis
(http://www.spywareinfo.com/~merijn/f...hijackthis.zip)
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid"


Just to follow up on this - there may be multiple different HOSTS files on
your machine with the trojan's settings some of which cannot not be removed
by the Removal Tools, and you'll need to do a search to find and just delete
them all, or clean them per the manual directions at the Symantec site.

4. You probably will then need to restore your HOSTS file if you plan to use
it for DNS speedup and/or ad blocking. Download the Hosts File Reader:

http://members.shaw.ca/techcd/VB_Pro...FileReader.exe

To create a new Default version of HOSTS, run the program, click the "Read
Hosts File" button, click the button labeled "Reset Defaults" and click
"Save Changes." Note that this is NOT a recreation of your original HOSTS
file, but a brand new "initialized" one. Now go to normal HOSTS file
location (Windows XP\2000 Location: - C:\WINDOWS\SYSTEM32\DRIVERS\ETC or
Windows 98\ME Location: - C:\WINDOWS) and rename the "hosts" file that it
created to "HOSTS" (no quotes, all caps, no extension). If you've been using
your HOSTS file for ad blocking (see
http://www.mvps.org/winhelp2002/hosts.htm Blocking Unwanted Ads with a Hosts
File), then you'll need to reset the new default you've created up for that
purpose. (Recommended, BTW - it also blocks a lot of "malware" as well as
offensive advertising.)

Perhaps this will help.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In news:003501c3990d$37d0c800$(E-Mail Removed),
Diana <(E-Mail Removed)> typed:
> I have a Windows 2000 Professional pc with the Qhost
> trojan virus. In order to make changes to the registry, I
> need to make a copy of the registry. So, I am trying to
> make a Emergency boot disk. I try to do this through the
> backup Wizard (programs, accessories, system tools,
> backup). Through this Backup wizard, I specify that I want
> a backup copy of the system state. The wizard assumes you
> want to copy to A: (which would entail tons of
> diskettes). I have tried to browse to D (a cd), but it
> doesnt think there is a cd in the drive, and it tells me I
> don't have permission.
>
> I want to know if it's possible to copy the backup files
> to a CD using the wizard.?

Thank you so much Don, I will follow your advice! Then
onward to registry edits thanks to qhost! Would you mind
hearing from me again if I run into problems?
>-----Original Message-----
>Hi Diana,
>
>The answer to the last question is NO.
>The alternative is to make the backup on the HDD and burn
it.
>
>You are close to right about the ERD (emergency repair
disk)
>If is very small and goes right on a floppy. Just format
the floppy with that machine.
>Go to backup
>choose ERD
>Put the floppy in
>OK
>Takes so little time you should make one on a regular
basis.
>After you're through mark it , date it, and put it up for
safe keeping.
>
>For the backup
>Go to backup
>Choose full backup
>check SystemState
>OK
>Let it do it's thing.
>
>After it is through, you can burn it to CD.
>Put in a safe place
>I would use CD-RW if possible and start a program of
regular 'full" backups
>
>It will pay in the long run
>
>Anything else just ask
>good computing,
>don
>---------------------
>
>
>
>
>
>"Diana" <(E-Mail Removed)> wrote in
message
>news:003501c3990d$37d0c800$(E-Mail Removed)...
>I have a Windows 2000 Professional pc with the Qhost
>trojan virus. In order to make changes to the registry, I
>need to make a copy of the registry. So, I am trying to
>make a Emergency boot disk. I try to do this through the
>backup Wizard (programs, accessories, system tools,
>backup). Through this Backup wizard, I specify that I want
>a backup copy of the system state. The wizard assumes you
>want to copy to A: (which would entail tons of
>diskettes). I have tried to browse to D (a cd), but it
>doesnt think there is a cd in the drive, and it tells me I
>don't have permission.
>
>I want to know if it's possible to copy the backup files
>to a CD using the wizard.?
>
>
>.
>

Not at all,
Glad to be of service

Best regards,
don
--------------




"Diana" <(E-Mail Removed)> wrote in message
news:05a101c39913$de4443f0$(E-Mail Removed)...
Thank you so much Don, I will follow your advice! Then
onward to registry edits thanks to qhost! Would you mind
hearing from me again if I run into problems?
>-----Original Message-----
>Hi Diana,
>
>The answer to the last question is NO.
>The alternative is to make the backup on the HDD and burn
it.
>
>You are close to right about the ERD (emergency repair
disk)
>If is very small and goes right on a floppy. Just format
the floppy with that machine.
>Go to backup
>choose ERD
>Put the floppy in
>OK
>Takes so little time you should make one on a regular
basis.
>After you're through mark it , date it, and put it up for
safe keeping.
>
>For the backup
>Go to backup
>Choose full backup
>check SystemState
>OK
>Let it do it's thing.
>
>After it is through, you can burn it to CD.
>Put in a safe place
>I would use CD-RW if possible and start a program of
regular 'full" backups
>
>It will pay in the long run
>
>Anything else just ask
>good computing,
>don
>---------------------
>
>
>
>
>
>"Diana" <(E-Mail Removed)> wrote in
message
>news:003501c3990d$37d0c800$(E-Mail Removed)...
>I have a Windows 2000 Professional pc with the Qhost
>trojan virus. In order to make changes to the registry, I
>need to make a copy of the registry. So, I am trying to
>make a Emergency boot disk. I try to do this through the
>backup Wizard (programs, accessories, system tools,
>backup). Through this Backup wizard, I specify that I want
>a backup copy of the system state. The wizard assumes you
>want to copy to A: (which would entail tons of
>diskettes). I have tried to browse to D (a cd), but it
>doesnt think there is a cd in the drive, and it tells me I
>don't have permission.
>
>I want to know if it's possible to copy the backup files
>to a CD using the wizard.?
>
>
>.
>

Thanks Jim

don
---------------



"Jim Byrd" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
Hi Dianna - Don answered your direct question, but here is some additional
info that may help you with qHosts. Specifically, use the Brown University
Removal Tool.

You've apparently gotten infected with the QHosts trojan. Read here for
information:

http://www.sarc.com/avcenter/venc/da...an.qhosts.html
http://us.mcafee.com/virusInfo/defau...virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/...50/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates (McAfee), be sure to get the EXTRADAT.exe
update from the above page as well as your regular update).

3a. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com...oval.tool.html

3b. An alternative that by report works much better than the Symantec tool
is the Brown University Removal Tool, here:

http://software.brown.edu/dist/w-cleanqhosts.html THIS WOULD BE MY PRIMARY
RECOMMENDATION

If that still doesn't clean it up (and a number of people are reporting that
it did not with the Symantec tool), then follow the Manual Removal
instructions at the link in 3a. The following is courtesy of Mike Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis
(http://www.spywareinfo.com/~merijn/f...hijackthis.zip)
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid"


Just to follow up on this - there may be multiple different HOSTS files on
your machine with the trojan's settings some of which cannot not be removed
by the Removal Tools, and you'll need to do a search to find and just delete
them all, or clean them per the manual directions at the Symantec site.

4. You probably will then need to restore your HOSTS file if you plan to use
it for DNS speedup and/or ad blocking. Download the Hosts File Reader:

http://members.shaw.ca/techcd/VB_Pro...FileReader.exe

To create a new Default version of HOSTS, run the program, click the "Read
Hosts File" button, click the button labeled "Reset Defaults" and click
"Save Changes." Note that this is NOT a recreation of your original HOSTS
file, but a brand new "initialized" one. Now go to normal HOSTS file
location (Windows XP\2000 Location: - C:\WINDOWS\SYSTEM32\DRIVERS\ETC or
Windows 98\ME Location: - C:\WINDOWS) and rename the "hosts" file that it
created to "HOSTS" (no quotes, all caps, no extension). If you've been using
your HOSTS file for ad blocking (see
http://www.mvps.org/winhelp2002/hosts.htm Blocking Unwanted Ads with a Hosts
File), then you'll need to reset the new default you've created up for that
purpose. (Recommended, BTW - it also blocks a lot of "malware" as well as
offensive advertising.)

Perhaps this will help.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In news:003501c3990d$37d0c800$(E-Mail Removed),
Diana <(E-Mail Removed)> typed:
> I have a Windows 2000 Professional pc with the Qhost
> trojan virus. In order to make changes to the registry, I
> need to make a copy of the registry. So, I am trying to
> make a Emergency boot disk. I try to do this through the
> backup Wizard (programs, accessories, system tools,
> backup). Through this Backup wizard, I specify that I want
> a backup copy of the system state. The wizard assumes you
> want to copy to A: (which would entail tons of
> diskettes). I have tried to browse to D (a cd), but it
> doesnt think there is a cd in the drive, and it tells me I
> don't have permission.
>
> I want to know if it's possible to copy the backup files
> to a CD using the wizard.?

YW, Don.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In news:CFIlb.4153$(E-Mail Removed),
dcdon <(E-Mail Removed)> typed:
> Thanks Jim
>
> don
> ---------------
>
>