host file help

[Evan]

howdy, y'all.

my 'hosts' file has been hijacked. when i try to manually edit it, windows
cannot create the file because it is read-only. i remove the read-only
atribute, but it keeps changing back (to read-only.) i tried deleting the
file (so i could manually create it), but it
recreates itself. ad-aware found nothing. spybot recognizes the hijacked
host file and fixes (deletes) it but it keeps changing back.

okay, after a bit of further messing around, it seems that my host file
being in this condition isn't really affecting me in any way i can discern.
now i'm just pissed that i can't change it.

is this auto-protection part of xp sp1 or do i have some undetectable
spyware? any ideas appreciated.

tia,

evan

xp sp1, ie6 sp2.

p.s. in case you're wondering what's been hijacked in my 'hosts' file, there
is an additional line reading: '213.159.117.235 auto.search.msn.com', which
is an unwanted redirect.

 

[BobC]

howdy, y'all.

my 'hosts' file has been hijacked. when i try to manually edit it, windows
cannot create the file because it is read-only. i remove the read-only
atribute, but it keeps changing back (to read-only.) i tried deleting the
file (so i could manually create it), but it
recreates itself. ad-aware found nothing. spybot recognizes the hijacked
host file and fixes (deletes) it but it keeps changing back.

okay, after a bit of further messing around, it seems that my host file
being in this condition isn't really affecting me in any way i can discern.
now i'm just pissed that i can't change it.

is this auto-protection part of xp sp1 or do i have some undetectable
spyware? any ideas appreciated.

tia,

evan

xp sp1, ie6 sp2.

p.s. in case you're wondering what's been hijacked in my 'hosts' file, there
is an additional line reading: '213.159.117.235 auto.search.msn.com', which
is an unwanted redirect.

If spybot search and destroy or adaware does not fix your problem it may be
that you are infected with the qhosts virus.
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html

 

[Evan]

thx for the reply bob. unfortunately (i guess 'fortunately' is more
accurate!), i have no trace of qhost on my system. gotta be something else.
thx though, and keep the ideas coming!