Google site and yahoo search engine

[Debra]

Well, I can't have an access google.com site but have an
access yahoo.com however I can't use yahoo search engine
and google site at all..... Any help would be appreciated

 

[Rob Schneider]

Well, I can't have an access google.com site but have an
access yahoo.com however I can't use yahoo search engine
and google site at all..... Any help would be appreciated

What is the error message?

My hunch is you have one of those new computer viruses which stop access
to search sites. See the web site of your anti-virus software vendor.

 

[Ken Bessler]

Well, I can't have an access google.com site but have an
access yahoo.com however I can't use yahoo search engine
and google site at all..... Any help would be appreciated

You are probably infected with the Qhost Trojan. Do a
search for that name or pop over to:


You can also read up on it on the Yale site at:

http://its.med.yale.edu/security/alerts/qhost.html

ALWAYS run an antivirus program and either a software
firewall or hardware firewall or all you can run.....

I have the following security:

1) Norton Antivirus 2003, updated twice a week
2) Windows XP Firewall (ICF) enabled
3) Zone Alarm pro
4) Linksys BEFSR41 Router/Firewall
5) E-mail address on newsgroups munged
6) Windows update run twice a week
7) Several filters installed in Outlook Express

Note the first line of my post - your un munged hotmail
address was there untill I corrupted it. This prevents
the harvester bots from getting a valid e-mail address
for you and then subsequently flooding you with spam.

You've probably (if you post to the newsgroups often
with a valid return address) been getting a lot of emails
supposedly from Microsoft with attachements, right?

#1 rule - NEVER open an attachment unless you com-
municated with the sender beforehand and were expecting
an e-mail with a file attachment. People have been doing
this, thinking the e-mail was from MS. BAM!!! They are
now infected with the W32.Swen-a@mm virus, which
is a real bugger....

Hope that helped, good luck!

Ken
ARS KG0WX
kg0wx at yahoo dot com
kg0wx at comcast dot net

 

[Mike Brearley]

You have a virus. QHosts-1. Check the following link for more details.
http://vil.nai.com/vil/content/v_100719.htm

--
Posted 'as is'. If there are any spelling and/or grammar mistakes, they
were a direct result of my fingers and brain not being synchronized or my
lack of caffeine.

Mike Brearley

 

[Jim Byrd]

Hi Debra - You've apparently gotten infected with the QHosts trojan. Read
here for information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/828750/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates (McAfee), be sure to get the EXTRADAT.exe
update from the above page as well as your regular update).

3a. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.removal.tool.html

3b. An alternative that by report works much better than the Symantec tool
is the Brown University Removal Tool, here:

http://software.brown.edu/dist/w-cleanqhosts.html THIS WOULD BE MY PRIMARY
RECOMMENDATION

If that still doesn't clean it up (and a number of people are reporting that
it did not with the Symantec tool), then follow the Manual Removal
instructions at the link in 3a. The following is courtesy of Mike Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis
(http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip)
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid"


Just to follow up on this - there may be multiple different HOSTS files on
your machine with the trojan's settings some of which cannot not be removed
by the Removal Tools, and you'll need to do a search to find and just delete
them all, or clean them per the manual directions at the Symantec site.

4. You probably will then need to restore your HOSTS file if you plan to use
it for DNS speedup and/or ad blocking. Download the Hosts File Reader:

http://members.shaw.ca/techcd/VB_Projects/HostsFileReader.exe

To create a new Default version of HOSTS, run the program, click the "Read
Hosts File" button, click the button labeled "Reset Defaults" and click
"Save Changes." Note that this is NOT a recreation of your original HOSTS
file, but a brand new "initialized" one. Now go to normal HOSTS file
location (Windows XP\2000 Location: - C:\WINDOWS\SYSTEM32\DRIVERS\ETC or
Windows 98\ME Location: - C:\WINDOWS) and rename the "hosts" file that it
created to "HOSTS" (no quotes, all caps, no extension). If you've been using
your HOSTS file for ad blocking (see
http://www.mvps.org/winhelp2002/hosts.htm Blocking Unwanted Ads with a Hosts
File), then you'll need to reset the new default you've created up for that
purpose. (Recommended, BTW - it also blocks a lot of "malware" as well as
offensive advertising.)


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In