Search engines

[J Maclay]

IE 6.0 works fine for everything except searching. I can
access Yahoo, but cannot search in Yahoo. I cannot even
get to the Google web site. All other web sites are
accessible and appear to operate normally. when I try to
search, I get a page not found error.

 

[Jim Byrd]

Hi J. Maclay - You've apparently gotten infected with the QHosts trojan.
Read here for information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/828750/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates (McAfee), be sure to get the EXTRADAT.exe
update from the above page as well as your regular update).

3a. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.removal.tool.html

3b. An alternative that by report may work better than the Symantec tool is
the Brown University Removal Tool, here:

http://software.brown.edu/dist/w-cleanqhosts.html

If that still doesn't clean it up (and a number of people are reporting that
it did not with the Symantec tool), then follow the Manual Removal
instructions at the link in 3a. The following is courtesy of Mike Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis
(http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip)
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid"


Just to follow up on this - there may be multiple different HOSTS files on
your machine with the trojan's settings some of which cannot not be removed
by the Removal Tools, and you'll need to do a search to find and just delete
them all, or clean them per the manual directions at the Symantec site.

4. You probably will then need to restore your HOSTS file if you plan to use
it for DNS speedup and/or ad blocking. Download the Hosts File Reader:

http://members.shaw.ca/techcd/VB_Projects/HostsFileReader.exe

To create a new Default version of HOSTS, run the program, click the "Read
Hosts File" button, click the button labeled "Reset Defaults" and click
"Save Changes." Note that this is NOT a recreation of your original HOSTS
file, but a brand new "initialized" one. Now go to normal HOSTS file
location (Windows XP\2000 Location: - C:\WINDOWS\SYSTEM32\DRIVERS\ETC or
Windows 98\ME Location: - C:\WINDOWS) and rename the "hosts" file that it
created to "HOSTS" (no quotes, all caps, no extension). If you've been using
your HOSTS file for ad blocking (see
http://www.mvps.org/winhelp2002/hosts.htm Blocking Unwanted Ads with a Hosts
File), then you'll need to reset the new default you've created up for that
purpose. (Recommended, BTW - it also blocks a lot of "malware" as well as
offensive advertising.)



--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[M Hinricher]

Wow, I was just about to post the same error. It is
baffeling. Also, when i try to goto www.google.com it
says that there is no such webpage, yeah right. The only
search engines that work for me right now are Netscape
Search & AskCosmo.com. If you are anyone else have found
a remedy to this please post how to fix it. And if I find
a way then I'll reply with the answer.

 

[J Maclay]

I have gone to Norton and downloaded their Qhosts fix, but
it did not find the Qhost virus. I will try your other
sites and see if that will work.

Thanks

-----Original Message-----
Hi J. Maclay - You've apparently gotten infected with the QHosts trojan.
Read here for information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp? id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/828 750/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates (McAfee), be sure to get the EXTRADAT.exe
update from the above page as well as your regular update).

3a. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/tr ojan.qhosts.removal.tool.html

3b. An alternative that by report may work better than the Symantec tool is
the Brown University Removal Tool, here:

http://software.brown.edu/dist/w-cleanqhosts.html

If that still doesn't clean it up (and a number of people are reporting that
it did not with the Symantec tool), then follow the Manual Removal
instructions at the link in 3a. The following is courtesy of Mike Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis
(http://www.spywareinfo.com/~merijn/files/beta/hijackthis.z
ip)
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30- 03]
Please post replies to this Newsgroup, email address is invalid"


Just to follow up on this - there may be multiple different HOSTS files on
your machine with the trojan's settings some of which cannot not be removed
by the Removal Tools, and you'll need to do a search to find and just delete
them all, or clean them per the manual directions at the Symantec site.

4. You probably will then need to restore your HOSTS file if you plan to use
it for DNS speedup and/or ad blocking. Download the Hosts File Reader:

http://members.shaw.ca/techcd/VB_Projects/HostsFileReader. exe

To create a new Default version of HOSTS, run the program, click the "Read
Hosts File" button, click the button labeled "Reset Defaults" and click
"Save Changes." Note that this is NOT a recreation of your original HOSTS
file, but a brand new "initialized" one. Now go to normal HOSTS file
location (Windows XP\2000 Location: - C:\WINDOWS\SYSTEM32 \DRIVERS\ETC or
Windows 98\ME Location: - C:\WINDOWS) and rename the "hosts" file that it
created to "HOSTS" (no quotes, all caps, no extension). If you've been using
your HOSTS file for ad blocking (see
http://www.mvps.org/winhelp2002/hosts.htm Blocking Unwanted Ads with a Hosts
File), then you'll need to reset the new default you've created up for that
purpose. (Recommended, BTW - it also blocks a lot of "malware" as well as
offensive advertising.)



--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

IE 6.0 works fine for everything except searching. I can
access Yahoo, but cannot search in Yahoo. I cannot even
get to the Google web site. All other web sites are
accessible and appear to operate normally. when I try to
search, I get a page not found error.

.

 

[Ilene]

Hi Jim,

Thank you so much for taking the time to post such a
perfectly explained solution. I see there are several
posting with the same problem. My problem is slightly
different. I have no problem accessing Google or Yahoo.
What I am not able to do is perform a search from the
address bar. I have everything set so that I can search
from the address bar using Google and it used to work
fine, however, that is no longer the case.

When attempting to perform a search from the address bar
for "bugs" I type in bugs and this is the result in the
address bar: http:///? bugs . The web page display
shows: The page cannot be displayed.

Any thoughts on this?

If anyone can figure this out, I'm sure you can!

Thank you,

Ilene

-----Original Message-----
Hi J. Maclay - You've apparently gotten infected with the QHosts trojan.
Read here for information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp? id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/82 8750/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates (McAfee), be sure to get the EXTRADAT.exe
update from the above page as well as your regular update).

3a. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/t rojan.qhosts.removal.tool.html

3b. An alternative that by report may work better than the Symantec tool is
the Brown University Removal Tool, here:

http://software.brown.edu/dist/w-cleanqhosts.html

If that still doesn't clean it up (and a number of people are reporting that
it did not with the Symantec tool), then follow the Manual Removal
instructions at the link in 3a. The following is courtesy of Mike Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis
(http://www.spywareinfo.com/~merijn/files/beta/hijackthis.
zip)
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30- 03]
Please post replies to this Newsgroup, email address is invalid"


Just to follow up on this - there may be multiple different HOSTS files on
your machine with the trojan's settings some of which cannot not be removed
by the Removal Tools, and you'll need to do a search to find and just delete
them all, or clean them per the manual directions at the Symantec site.

4. You probably will then need to restore your HOSTS file if you plan to use
it for DNS speedup and/or ad blocking. Download the Hosts File Reader:

http://members.shaw.ca/techcd/VB_Projects/HostsFileReader ..exe

To create a new Default version of HOSTS, run the program, click the "Read
Hosts File" button, click the button labeled "Reset Defaults" and click
"Save Changes." Note that this is NOT a recreation of your original HOSTS
file, but a brand new "initialized" one. Now go to normal HOSTS file
location (Windows XP\2000 Location: - C:\WINDOWS\SYSTEM32 \DRIVERS\ETC or
Windows 98\ME Location: - C:\WINDOWS) and rename the "hosts" file that it
created to "HOSTS" (no quotes, all caps, no extension). If you've been using
your HOSTS file for ad blocking (see
http://www.mvps.org/winhelp2002/hosts.htm Blocking Unwanted Ads with a Hosts
File), then you'll need to reset the new default you've created up for that
purpose. (Recommended, BTW - it also blocks a lot of "malware" as well as
offensive advertising.)



--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

IE 6.0 works fine for everything except searching. I can
access Yahoo, but cannot search in Yahoo. I cannot even
get to the Google web site. All other web sites are
accessible and appear to operate normally. when I try to
search, I get a page not found error.

.

 

[M Hinricher]

Ok I found the fix. Its a trojan that we've been infected
with. The fix is loced here
<http://securityresponse.symantec.com/avcenter/venc/data/tr
ojan.qhosts.html>. It fixed the problem for me, hope it
does for you too.

 

[Jim Byrd]

Hi J. Maclay - Use the Brown Removal Tool - I'm getting consistenly good
reports about it - and then check for HOSTS files as in my original post.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

I have gone to Norton and downloaded their Qhosts fix, but
it did not find the Qhost virus. I will try your other
sites and see if that will work.

Thanks

-----Original Message-----
Hi J. Maclay - You've apparently gotten infected with the QHosts trojan.
Read here for information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp? id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that
this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/828
750/default.asp

2. Update and run a complete Anti-Virus software check of your system.
Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates (McAfee), be sure to get the
EXTRADAT.exe
update from the above page as well as your regular update).

3a. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/tr
ojan.qhosts.removal.tool.html

3b. An alternative that by report may work better than the Symantec tool
is
the Brown University Removal Tool, here:

http://software.brown.edu/dist/w-cleanqhosts.html

If that still doesn't clean it up (and a number of people are reporting
that
it did not with the Symantec tool), then follow the Manual Removal
instructions at the link in 3a. The following is courtesy of Mike
Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis
(http://www.spywareinfo.com/~merijn/files/beta/hijackthis.z
ip)
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS
file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30- 03]
Please post replies to this Newsgroup, email address is invalid"


Just to follow up on this - there may be multiple different HOSTS files
on
your machine with the trojan's settings some of which cannot not be
removed
by the Removal Tools, and you'll need to do a search to find and just
delete
them all, or clean them per the manual directions at the Symantec site.

4. You probably will then need to restore your HOSTS file if you plan to
use
it for DNS speedup and/or ad blocking. Download the Hosts File Reader:

http://members.shaw.ca/techcd/VB_Projects/HostsFileReader. exe

To create a new Default version of HOSTS, run the program, click the
"Read
Hosts File" button, click the button labeled "Reset Defaults" and click
"Save Changes." Note that this is NOT a recreation of your original HOSTS
file, but a brand new "initialized" one. Now go to normal HOSTS file
location (Windows XP\2000 Location: - C:\WINDOWS\SYSTEM32 \DRIVERS\ETC or
Windows 98\ME Location: - C:\WINDOWS) and rename the "hosts" file that it
created to "HOSTS" (no quotes, all caps, no extension). If you've been
using
your HOSTS file for ad blocking (see
http://www.mvps.org/winhelp2002/hosts.htm Blocking Unwanted Ads with a
Hosts
File), then you'll need to reset the new default you've created up for
that
purpose. (Recommended, BTW - it also blocks a lot of "malware" as well as
offensive advertising.)



--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

IE 6.0 works fine for everything except searching. I can
access Yahoo, but cannot search in Yahoo. I cannot even
get to the Google web site. All other web sites are
accessible and appear to operate normally. when I try to
search, I get a page not found error.

.

 

[Jim Byrd]

Hi Ilene - Download and run this file from Kelly's site:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

Hi Jim,

Thank you so much for taking the time to post such a
perfectly explained solution. I see there are several
posting with the same problem. My problem is slightly
different. I have no problem accessing Google or Yahoo.
What I am not able to do is perform a search from the
address bar. I have everything set so that I can search
from the address bar using Google and it used to work
fine, however, that is no longer the case.

When attempting to perform a search from the address bar
for "bugs" I type in bugs and this is the result in the
address bar: http:///? bugs . The web page display
shows: The page cannot be displayed.

Any thoughts on this?

If anyone can figure this out, I'm sure you can!

Thank you,

Ilene

-----Original Message-----
Hi J. Maclay - You've apparently gotten infected with the QHosts trojan.
Read here for information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp? id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that
this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/82
8750/default.asp

2. Update and run a complete Anti-Virus software check of your system.
Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates (McAfee), be sure to get the
EXTRADAT.exe
update from the above page as well as your regular update).

3a. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/t
rojan.qhosts.removal.tool.html

3b. An alternative that by report may work better than the Symantec tool
is
the Brown University Removal Tool, here:

http://software.brown.edu/dist/w-cleanqhosts.html

If that still doesn't clean it up (and a number of people are reporting
that
it did not with the Symantec tool), then follow the Manual Removal
instructions at the link in 3a. The following is courtesy of Mike
Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis
(http://www.spywareinfo.com/~merijn/files/beta/hijackthis.
zip)
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS
file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30- 03]
Please post replies to this Newsgroup, email address is invalid"


Just to follow up on this - there may be multiple different HOSTS files
on
your machine with the trojan's settings some of which cannot not be
removed
by the Removal Tools, and you'll need to do a search to find and just
delete
them all, or clean them per the manual directions at the Symantec site.

4. You probably will then need to restore your HOSTS file if you plan to
use
it for DNS speedup and/or ad blocking. Download the Hosts File Reader:

http://members.shaw.ca/techcd/VB_Projects/HostsFileReader .exe

To create a new Default version of HOSTS, run the program, click the
"Read
Hosts File" button, click the button labeled "Reset Defaults" and click
"Save Changes." Note that this is NOT a recreation of your original HOSTS
file, but a brand new "initialized" one. Now go to normal HOSTS file
location (Windows XP\2000 Location: - C:\WINDOWS\SYSTEM32 \DRIVERS\ETC or
Windows 98\ME Location: - C:\WINDOWS) and rename the "hosts" file that it
created to "HOSTS" (no quotes, all caps, no extension). If you've been
using
your HOSTS file for ad blocking (see
http://www.mvps.org/winhelp2002/hosts.htm Blocking Unwanted Ads with a
Hosts
File), then you'll need to reset the new default you've created up for
that
purpose. (Recommended, BTW - it also blocks a lot of "malware" as well as
offensive advertising.)



--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

IE 6.0 works fine for everything except searching. I can
access Yahoo, but cannot search in Yahoo. I cannot even
get to the Google web site. All other web sites are
accessible and appear to operate normally. when I try to
search, I get a page not found error.

.

 

[Ilene]

Hi Jim,

Thank you very much! That did the trick. I saved that
registry key just in case.

Ilene

-----Original Message-----
Hi Ilene - Download and run this file from Kelly's site:
http://www.kellys-korner- xp.com/regs_edits/RestoreSearch2.REG

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

Hi Jim,

Thank you so much for taking the time to post such a
perfectly explained solution. I see there are several
posting with the same problem. My problem is slightly
different. I have no problem accessing Google or Yahoo.
What I am not able to do is perform a search from the
address bar. I have everything set so that I can search
from the address bar using Google and it used to work
fine, however, that is no longer the case.

When attempting to perform a search from the address bar
for "bugs" I type in bugs and this is the result in the
address bar: http:///? bugs . The web page display
shows: The page cannot be displayed.

Any thoughts on this?

If anyone can figure this out, I'm sure you can!

Thank you,

Ilene

-----Original Message-----
Hi J. Maclay - You've apparently gotten infected with the QHosts trojan.
Read here for information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp? id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that
this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/82
8750/default.asp

2. Update and run a complete Anti-Virus software check of your system.
Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates (McAfee), be sure to get the
EXTRADAT.exe
update from the above page as well as your regular update).

3a. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/t
rojan.qhosts.removal.tool.html

3b. An alternative that by report may work better than the Symantec tool
is
the Brown University Removal Tool, here:

http://software.brown.edu/dist/w-cleanqhosts.html

If that still doesn't clean it up (and a number of people are reporting
that
it did not with the Symantec tool), then follow the Manual Removal
instructions at the link in 3a. The following is courtesy of Mike
Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis

(http://www.spywareinfo.com/~merijn/files/beta/hijackthis.
zip)

_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS
file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9- 30- 03]
Please post replies to this Newsgroup, email address is invalid"


Just to follow up on this - there may be multiple different HOSTS files
on
your machine with the trojan's settings some of which cannot not be
removed
by the Removal Tools, and you'll need to do a search to find and just
delete
them all, or clean them per the manual directions at the Symantec site.

4. You probably will then need to restore your HOSTS file if you plan to
use
it for DNS speedup and/or ad blocking. Download the Hosts File Reader:

http://members.shaw.ca/techcd/VB_Projects/HostsFileReader
..exe

.

 

[Jim Byrd]

YW, Ilene - Such a symptom is often indicative of some "malware" attack on
your machine. For safety's sake, you might also want to do the following:


If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.


Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. Update and run this regularly
to get rid of most "spyware/hijackware" on your machine.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After fixing things with SpyBot S&D, be sure to re-boot
and rerun SpyBot again and repeat this cycle until you get a clean "no red"
scan.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm


Next, courtesy of Mike Burgess:

--Recommended Minimum Security Settings--

Close all instances of IE and OE
Control Panel | Internet Options

Click on the "Security" tab
Highlight the "Internet" icon, click "Custom Level"

1) "Download signed ActiveX scripts" = Prompt
2) "Download unsigned ActiveX scripts = Disable
3) "Initialize and script ActiveX not marked as safe" = Disable
4) "Installation of Desktop items" = Prompt
5) "Launching programs and files in a IFRAME" = Prompt

Click on the "Content" tab
Click the "Publishers" button

Highlight and click "Remove" any unknowns, click Ok

Click on the "Advanced" tab
Uncheck: "Install on demand (other)", click Apply\Ok

Prevent your "HomePage" setting from being Hijacked
http://www.mvps.org/winhelp2002/ietips.htm
_____________________________
Mike Burgess
Information isn't free if you can't find it!
http://www.mvps.org/winhelp2002/



Then, from me:

You might want to consider installing the Browser Hijack Blaster,
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:
http://www.wilderssecurity.com/bhblaster.html (Prevents malware BHO's)
http://www.wilderssecurity.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it updated) The latest version as of this writing
will prevent installation or prevent the malware from running (554 parasites
as of this date) if it is already installed, and it provides information and
fixit-links for a variety of parasites.
http://www.wilderssecurity.net/spywareguard.html (Monitors for attempts
to install malware) All three Very Highly Recommended.

See if any of this helps

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

Hi Jim,

Thank you very much! That did the trick. I saved that
registry key just in case.

Ilene

..

 

[Pat]

It's part of the Trojan Qhost virus that the microsoft
patch did not correct.
I was able to download a patch from McAfee that corrects
the problem