cpanel site instead of google

J

Judi

When I try to access http://www.google.com I get a cpanel
page http://www.cpanel.net/

Info there states "If you were brought to this site
inadvertently because you were trying to use a search
engine, you may be infected with a virus that is
affecting Windows machines and forwarding them to a
server that was removed and replaced with a blank cPanel
server."

I went to symantec, downloaded the Trojanqhost removal
tool, disabled System restore, ran the tool as directed,
restarted. Reran the tool the second time as directed,
and restarted. I showed no infected files either time.
I turned System restore back on. I got the same cpanel
page when I entered google in my browser window.

Does anyone know what I should do now? How do I get
google back?

Thank you,
Judi
 
S

Shiva

Sounds more like a Hijacker. cpanel.net doesn't ahve that alert. You can
get a free hijacker checker at
http://www.webattack.com/download/dlhijackthis.shtml

Install and run that and it will let you know if you in fact have a
hijacker.

They usualy come with freebie internet junk like power bars, coupon
alerts, internet buddies and such. In some cases though, removing a
hijacker can botch your Winsock meaning that it can't resolve DNS. In
the UNlikely event this happens - here is the fix for that too.

Fix for win98 ME Winsock DNS problems:

As a test, try using a numerical address to access webs. For example,
instead of using http://www.microsoft.com, use http://207.46.134.189/
If you get their web site, your Winsock can't resolve Domain names. Just
reinstalling Winsock won't fix it. This fix is for Win98 or ME only:

Due to the nature and level of entering the Window System Registry this
is not something I suggest to inexperienced users, as modifications to
the Windows System Registry can make the computer unstable or in some
cases cause the computer to not boot correctly or at all.
This procedure should only be used in extreme situations where the
problem created by removing some Hijackers with Adaware, HijackThis,
SpyBot and others is that the Hijacker/s are removed, but the computer
is unable to resolve DNS.

In order to fix this, one needs to do the following steps. (anything
that is deleted is deleted because it is unstable and will be
reinstalled in the following process.) One should read the entire
process, and understand it before proceeding.

For Windows 95/98/ME

Close all programs and anti-virus software. This prevents anything from
writing to the Registry during the repair process.

Ready? Then let's go.

We'll clean out the damaged files first.

Insert the Windows 9x CD in to your CD ROM before beginning.

Click on "START" then go to "SETTINGS" and click on "CONTROL PANEL"

Once the CONTROL PANEL is open, double click on "NETWORK"
This will show you your network configuration with a list of all of the
installed components.
From this list you will need to remove some of these components.

Remove any references to "DIAL-UP ADAPTER"

Remove any references to "TCP/IP"
Once these references have been removed click on the "OK" button
Your computer will begin to copy some files and change some of its settings.
Then it will prompt you to restart. DO NOT RESTART THE COMPUTER AT THIS
TIME.


Now we edit the Registry...

Click on "START" and then click on "RUN"
In the "OPEN" field type in "REGEDIT" and click the "OK" button.
This will bring up the Windows System Registry.


Open HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services and you should
see the WinSock2 folder. Right click on the Winsock2 (not Winsock)
folder and select Delete.

Once you have done that you will need to click on the + sign beside
"VXD" and with your "RIGHT" mouse button click on the "WINSOCK2" folder
in the VXD folder and choose "DELETE" from the menu that pops up.


Once you have removed both Winsock2 Keys from your Windows System
Registry, close the Windows System Registry by clicking the "X" in the
TOP RIGHT hand corner of the Windows System Registry window.



Now restart the computer.

Once the computer has restarted, we'll restore things without the problem:

Click on "START" then go to "SETTINGS" and click on "CONTROL PANEL"

Once the CONTROL PANEL is open, double left click on "NETWORK"
This will show you your network configuration with a list of all of the
installed components.

Click on "ADD" then click on "PROTOCOL" then click on "ADD"
This will bring up a 2 paned window. On the LEFT hand side click on
"MICROSOFT" on the RIGHT hand side click on "TCP/IP"

Once "TCP/IP" is highlighted click the "OK" button. You will now see
that "CLIENT FOR MICROSOFT NETWORKS" and "TCP/IP" has been re-added to
your list of network components.
Underneath the "ADD" button you will see:

PRIMARY NETWORK LOGON

Make sure it is set to "WINDOWS LOGON" (You can change this later -
after the next re-start)


Click the "OK" button.
Your computer will begin to copy some files and change some of its settings.
Then it will prompt you to restart.
Restart your computer at this time.
Once you system has rebooted, you will be now be able to resolve DNS.

Remove the CD. You'dre done.
======================================================================
 
M

Mike Burgess

Judi,
In most cases the Symantec tool just doesn't work .....
Try this one instead:
http://software.brown.edu/dist/w-cleanqhosts.html
--
In most cases your HOSTS file is hijacked also ...
If you are infected with QHosts the trojan places it's HOSTS
file (hidden) in Windows\Help folder. Delete that one.

Once you have done the above, reboot and proceed:
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-08-03]
Please post replies to this Newsgroup, email address is invalid
 
F

futurastonemd

-----Original Message-----
Judi,
In most cases the Symantec tool just doesn't work .....
Try this one instead:
http://software.brown.edu/dist/w-cleanqhosts.html
--
In most cases your HOSTS file is hijacked also ...
If you are infected with QHosts the trojan places it's HOSTS
file (hidden) in Windows\Help folder. Delete that one.

Once you have done the above, reboot and proceed:
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
__________________________________________________________ __
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-08- 03]
Please post replies to this Newsgroup, email address is invalid
--

Judi said:
When I try to access http://www.google.com I get a cpanel
page http://www.cpanel.net/

Info there states "If you were brought to this site
inadvertently because you were trying to use a search
engine, you may be infected with a virus that is
affecting Windows machines and forwarding them to a
server that was removed and replaced with a blank cPanel
server."

I went to symantec, downloaded the Trojanqhost removal
tool, disabled System restore, ran the tool as directed,
restarted. Reran the tool the second time as directed,
and restarted. I showed no infected files either time.
I turned System restore back on. I got the same cpanel
page when I entered google in my browser window.

Does anyone know what I should do now? How do I get
google back?

Thank you,
Judi


.
 
J

Judi

This cleaning tool worked. Thank you, Mike. I have
google back. BTW- I have Windows XP, if this will help
others.

If it had not worked I would have proceded to the the
post and followed that advice. Thank you, too,
futurastonemd.

Judi
-----Original Message-----
Judi,
In most cases the Symantec tool just doesn't work .....
Try this one instead:
http://software.brown.edu/dist/w-cleanqhosts.html
--
In most cases your HOSTS file is hijacked also ...
If you are infected with QHosts the trojan places it's HOSTS
file (hidden) in Windows\Help folder. Delete that one.

Once you have done the above, reboot and proceed:
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
_________________________________________________________ ___
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-08- 03]
Please post replies to this Newsgroup, email address is invalid
--

Judi said:
When I try to access http://www.google.com I get a cpanel
page http://www.cpanel.net/

Info there states "If you were brought to this site
inadvertently because you were trying to use a search
engine, you may be infected with a virus that is
affecting Windows machines and forwarding them to a
server that was removed and replaced with a blank cPanel
server."

I went to symantec, downloaded the Trojanqhost removal
tool, disabled System restore, ran the tool as directed,
restarted. Reran the tool the second time as directed,
and restarted. I showed no infected files either time.
I turned System restore back on. I got the same cpanel
page when I entered google in my browser window.

Does anyone know what I should do now? How do I get
google back?

Thank you,
Judi


.
 
M

Mike Burgess

Judi,
You're welcome .... glad to see you have things resolved.
_____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-15-03]
Please post replies to this Newsgroup, email address is invalid
--

Judi said:
This cleaning tool worked. Thank you, Mike. I have
google back. BTW- I have Windows XP, if this will help
others.

If it had not worked I would have proceded to the the
post and followed that advice. Thank you, too,
futurastonemd.

Judi
-----Original Message-----
Judi,
In most cases the Symantec tool just doesn't work .....
Try this one instead:
http://software.brown.edu/dist/w-cleanqhosts.html
--
In most cases your HOSTS file is hijacked also ...
If you are infected with QHosts the trojan places it's HOSTS
file (hidden) in Windows\Help folder. Delete that one.

Once you have done the above, reboot and proceed:
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
_________________________________________________________ ___
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-08- 03]
Please post replies to this Newsgroup, email address is invalid
--

Judi said:
When I try to access http://www.google.com I get a cpanel
page http://www.cpanel.net/

Info there states "If you were brought to this site
inadvertently because you were trying to use a search
engine, you may be infected with a virus that is
affecting Windows machines and forwarding them to a
server that was removed and replaced with a blank cPanel
server."

I went to symantec, downloaded the Trojanqhost removal
tool, disabled System restore, ran the tool as directed,
restarted. Reran the tool the second time as directed,
and restarted. I showed no infected files either time.
I turned System restore back on. I got the same cpanel
page when I entered google in my browser window.

Does anyone know what I should do now? How do I get
google back?

Thank you,
Judi


.
 
J

JC

I had the qhost virus that forced me onto cpanel website
everytime i tried to use google, altavista, etc. The
program below is the only thing that worked! Thanks Brown
University!!

http://software.brown.edu/dist/w-cleanqhosts.html
http://software.brown.edu/dist/patch/clean/clean_qhosts.ex
e
-----Original Message-----
-----Original Message-----
Judi,
In most cases the Symantec tool just doesn't work .....
Try this one instead:
http://software.brown.edu/dist/w-cleanqhosts.html
--
In most cases your HOSTS file is hijacked also ...
If you are infected with QHosts the trojan places it's HOSTS
file (hidden) in Windows\Help folder. Delete that one.

Once you have done the above, reboot and proceed:
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
________________________________________________________
__
__
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers,
Trojans,
with a HOSTS file
08-
03]
Please post replies to this Newsgroup, email address is invalid
--

Judi said:
When I try to access http://www.google.com I get a cpanel
page http://www.cpanel.net/

Info there states "If you were brought to this site
inadvertently because you were trying to use a search
engine, you may be infected with a virus that is
affecting Windows machines and forwarding them to a
server that was removed and replaced with a blank cPanel
server."

I went to symantec, downloaded the Trojanqhost removal
tool, disabled System restore, ran the tool as directed,
restarted. Reran the tool the second time as directed,
and restarted. I showed no infected files either time.
I turned System restore back on. I got the same cpanel
page when I entered google in my browser window.

Does anyone know what I should do now? How do I get
google back?

Thank you,
Judi


.
.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top