Google and Yahoo loading/search failure

[rudi]

Can anyone help me solve the following:

I use Google as my search engine via Internet Explorer 6
but, the other day, it suddenly ceased functioning; ditto
Yahoo. I can still search using Altavista, but I don't
much care for it. Oddly, I can still use both Google and
Yahoo via my AOL (ISP?) programme. I assume my laptop has
contracted something unpleasant (well, it is autumn over
here...) when I downloaded a programme; perhaps Kazaa.

Please help - thanks.

P.s. Why don't I just search using Google in AOL mode?
Yes, why indeed. Habit, I suppose. (I'm very old...).

 

[Ramesh [MS-MVP]]

You've apparently gotten infected with the QHosts trojan. Read here for
information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/828750/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates, be sure to get the EXTRADAT.exe update
from the above page as well as your regular update).

3. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.remova
l.tool.html

If that still doesn't clean it up (and a number of people are reporting that
it did not), then follow the Manual Removal instructions there. The
following is courtesy of Mike Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis (link on Hosts page)

==Borrowed from Jim (MVP IE/OE)==

--
Regards,
Ramesh [MS-MVP]
AIM: SRamesh2k


~ Please reply to newsgroup ~


Can anyone help me solve the following:

I use Google as my search engine via Internet Explorer 6
but, the other day, it suddenly ceased functioning; ditto
Yahoo. I can still search using Altavista, but I don't
much care for it. Oddly, I can still use both Google and
Yahoo via my AOL (ISP?) programme. I assume my laptop has
contracted something unpleasant (well, it is autumn over
here...) when I downloaded a programme; perhaps Kazaa.

Please help - thanks.

P.s. Why don't I just search using Google in AOL mode?
Yes, why indeed. Habit, I suppose. (I'm very old...).

 

[rudi]

Hi Ramesh,

Thanks for your helpful advice.

I have an anti-virus software installed on my laptop,
called "eAnthology"; it didn't locate the Trojan virus.
Nor did SpyBot. I downloaded the Microsoft Patch q828750
but it won't run because an error message pops up telling
me I don't have Internet Explorer 6 installed, which is
not the case.

Regards,

Rudi

 

[Ramesh [MS-MVP]]

Hi Rudi,

I'm unable to duplicate the problem. You may try disabling the a/v and
firewall applications and try installing the hotfix. After installing,
re-enable the av and firewall software.

--
Regards,
Ramesh [MS-MVP]
AIM: SRamesh2k


~ Please reply to newsgroup ~


Hi Ramesh,

Thanks for your helpful advice.

I have an anti-virus software installed on my laptop,
called "eAnthology"; it didn't locate the Trojan virus.
Nor did SpyBot. I downloaded the Microsoft Patch q828750
but it won't run because an error message pops up telling
me I don't have Internet Explorer 6 installed, which is
not the case.

Regards,

Rudi

 

[H Leboeuf]

Even the Symantec removal tool is not 100% proof.

Get this one.
http://www.brown.edu/Facilities/CIS/Software_Services/virus/index.html

Qhosts virus/trojan, aka delude.

http://www.f-secure.com/v-descs/delude.shtml

NAME: Delude
ALIAS: Trojan.BAT.Startpage.a
Delude is a trojan that is available on a web page. The web page contains a
code that uses a vulnerability in the Internet Explorer (MS03-032) to
execute.
More information about the vulnerability, including a fix, is available from
Microsoft at:
http://www.microsoft.com/security/security_bulletins/ms03-032.asp
VARIANT: Delude.A
The HTA code available on a web page downloads a file "partyboy.exe" from an
ftp site and runs it. This file is is packed with UPX. It is a batch file
which was compiled to executable binary (".exe") using a BatToExe tool.
When executed, it changes the Internet Explorer start page to find-now.info.
It prevents access to the most major search engines such as Google, Yahoo,
Lycos, MSN and AltaVista. To do this it replaces the following file:

More:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.removal.tool.html
http://vil.nai.com/vil/content/v_100719.htm
http://www.sophos.com/virusinfo/analyses/trojqhosts1.html

An other removal tool that has been used with success.
http://www.brown.edu/Facilities/CIS/Software_Services/virus/index.html

 

[Pat]

It's part of the Trojan Qhost virus that the microsoft
patch did not correct.
I was able to download a patch from McAfee that corrects
the problem

 

[Mike Burgess]

Ramesh,
A couple of thoughts here ........

I have an anti-virus software installed on my laptop, called "eAnthology"

eAnthology = eAcceleration Corp (known parasite) it's a bogus AV!

Uninstall then run HijackThis
Visit Windows Update
Then install AVG 6.0
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 10-10-03]
Please post replies to this Newsgroup, email address is invalid
--

Hi Rudi,

I'm unable to duplicate the problem. You may try disabling the a/v and
firewall applications and try installing the hotfix. After installing,
re-enable the av and firewall software.

--
Regards,
Ramesh [MS-MVP]
AIM: SRamesh2k


~ Please reply to newsgroup ~


Hi Ramesh,

Thanks for your helpful advice.

I have an anti-virus software installed on my laptop,
called "eAnthology"; it didn't locate the Trojan virus.
Nor did SpyBot. I downloaded the Microsoft Patch q828750
but it won't run because an error message pops up telling
me I don't have Internet Explorer 6 installed, which is
not the case.

Regards,

Rudi

 

[Ramesh [MS-MVP]]

Thanks Mike.

I just wanted to share a thing related to AVG. I have seen an instance wehre
AVG didn't detect the EICAR test string only in my system. AVG says that
this issue is known only with specific configurations.

--
Regards,
Ramesh [MS-MVP]
AIM: SRamesh2k


~ Please reply to newsgroup ~


Ramesh,
A couple of thoughts here ........

I have an anti-virus software installed on my laptop, called "eAnthology"

eAnthology = eAcceleration Corp (known parasite) it's a bogus AV!

Uninstall then run HijackThis
Visit Windows Update
Then install AVG 6.0
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 10-10-03]
Please post replies to this Newsgroup, email address is invalid
--

Hi Rudi,

I'm unable to duplicate the problem. You may try disabling the a/v and
firewall applications and try installing the hotfix. After installing,
re-enable the av and firewall software.

--
Regards,
Ramesh [MS-MVP]
AIM: SRamesh2k


~ Please reply to newsgroup ~


Hi Ramesh,

Thanks for your helpful advice.

I have an anti-virus software installed on my laptop,
called "eAnthology"; it didn't locate the Trojan virus.
Nor did SpyBot. I downloaded the Microsoft Patch q828750
but it won't run because an error message pops up telling
me I don't have Internet Explorer 6 installed, which is
not the case.

Regards,

Rudi