"...hosts file has been hacked..."

[Jeff]

My mother's internet Explorer 6.0 (under windows XP seems
to have been compromized - When she tries to log onto
google, she gets a page that reads: (see below)

My question is, are these instructions legit?

Here they are:

<snip>
If you see this page your hosts file has been hacked.
Please use the instructions below to clean your machine.

You cannot reach the site you wree trying to reach without
following this procedure! - Please follow the steps
provided in the document and make sure to download all
patches for your computer from the Windows Update Site
which can be found here:
http://windowsupdate.microsoft.com

1. Start regedit,
find
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
,
delete starting of svchost.exe file,
reboot your computer,
delete file svchost.exe in windows directory.

2. Reboot windows and start in
SAFE MODE (F8 key on keyboard before windows starting),
delete file winlogon.exe in directory: C:\Documents and
Settings\All Users\Start Menu\Programs\Startup

3. Clear your 'hosts" file
</snip>

Followed by various instructions for editing the hosts file
so that it only says 355.17.28.99(*) localhost.

(*) I changed the number out of a paranoin need for security.

 

[Sparker9]

Most likely caused by this:

Trojan.Qhosts
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html

 

[Mike Burgess]

Jeff,
How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-15-03]
Please post replies to this Newsgroup, email address is invalid