IE 6 and Google

[Meiwillirees]

I'm having trouble viewing the google search engine.
Anyone else having a problem with this or AskJeeves? Help!

 

[Ramesh [MS-MVP]]

Hi,

If many of the search engines won't work, your system might be affected by
the recent Qhosts Trojan. This Trojan Horse that will modify the TCP/IP
settings to point to a different DNS server. Blocks many search engines.

Trojan.Qhosts Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.remova
l.tool.html

http://www.symantec.com/avcenter/venc/data/pf/trojan.qhosts.html

==
Open the HOSTS file and delete all mappings except:
127.0.0.1 localhost

The file is located at
"C:\windows\system32\drivers\etc" (named "HOSTS")
for 9x/Me, C:\Windows

Backup the current HOSTS file first.

==
Reset TCP/IP - Windows XP.

Click Start | Run | Cmd
type "netsh int ip reset changes.txt"

==
To prevent this from happening:

Install hotfix 828750 which fixes the vulnerability:
http://www.microsoft.com/windows/ie/downloads/critical/828750/default.asp

==
HOSTS file guide:
http://www.mvps.org/winhelp2002/hosts.htm

--
Regards,
Ramesh
[MS-MVP]
AOL: SRamesh2k

«·´`·.(*·.¸(`·.¸ ¸.·´)¸.·*).·´`·»
«.............. Ramesh ...............»
«·´`·.(¸.·´(¸.·* *·.¸)`·.¸).·´`·»

~ Please reply to newsgroup ~


I'm having trouble viewing the google search engine.
Anyone else having a problem with this or AskJeeves? Help!

 

[Tcritser]

-----Original Message-----
I'm having trouble viewing the google search engine.
Anyone else having a problem with this or AskJeeves? Help!
.

I am having the same problem and still no answer. Google,
lycos, yahoo, excite, msn, and altavista. All return a
Page Can not be displayed and/or redirect to 207.44.220.30
I have ran adaware checked the registry, I have done all
updates and installed netscape Nav. Still get the same
error works fine on other computers in the network. It
seems to be a scam to send users to a ad based webpage
rather then the search engine they were attempting to
view. If anyone as any suggetions or help please email me.
Anything is apprectiated.
- Tcritser - VWC Computer Tech

 

[Robin T Cox]

I'm having trouble viewing the google search engine.
Anyone else having a problem with this or AskJeeves? Help!

See:
http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html

Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder.

See: http://www.mvps.org/winhelp2002/hosts.htm
Download: either "RenHelpHostXP.bat" or RenHelpHostME.bat"
Follow up with the link provided instructions .......

Get the latest hotfix:
http://www.microsoft.com/security/security_bulletins/ms03-040.asp

If no joy, run the Beta "Hijack This" utility which detects the HOSTS file
that has been
taken over.
http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip
Hijack This, How-to: http://mvps.org/winhelp2002/unwanted.htm

More info: http://www.spywareinfo.com/newsletter/archives/0903/30.php

 

[frank]

-----Original Message-----
I'm having trouble viewing the google search engine.
Anyone else having a problem with this or AskJeeves? Help!
.

 

[CarolynP]

YES!!! What is going on?
Anyone know.?
Mine hasn't worked in 3 days.
So glad to hear it's not just my puter.
thank you.

 

[Cal]

The same thing has happened to me. I didn't know that
AskJeeves had the same problem until you mentioned it. I
have been using Dogpile which searches with Google and
AskJeeves, among others, and they work there. Also
AskJeeves.co.uk works but not Google.co.uk and if you try
news.google.com it will load and if you search
using "Images" or "News" it will work but not the others.

 

[ROBERT MANN]

The Trojan Qhost removal tool says that I don't have the
virurs, however my AV tool said I did! It deleted the
infected file, but I still cannot use Yahoo or Google. I
still have the file called Imhosts, but how do you open
it?? When I click on it I get the "Windows cannot open
this file" message.

-----Original Message-----
Hi,

If many of the search engines won't work, your system might be affected by
the recent Qhosts Trojan. This Trojan Horse that will modify the TCP/IP
settings to point to a different DNS server. Blocks many search engines.

Trojan.Qhosts Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/t rojan.qhosts.remova

l.tool.html

http://www.symantec.com/avcenter/venc/data/pf/trojan.qhos

ts.html

==
Open the HOSTS file and delete all mappings except:
127.0.0.1 localhost

The file is located at
"C:\windows\system32\drivers\etc" (named "HOSTS")
for 9x/Me, C:\Windows

Backup the current HOSTS file first.

==
Reset TCP/IP - Windows XP.

Click Start | Run | Cmd
type "netsh int ip reset changes.txt"

==
To prevent this from happening:

Install hotfix 828750 which fixes the vulnerability:
http://www.microsoft.com/windows/ie/downloads/critical/82 8750/default.asp

==
HOSTS file guide:
http://www.mvps.org/winhelp2002/hosts.htm

--
Regards,
Ramesh
[MS-MVP]
AOL: SRamesh2k

«·´`·.(*·.¸(`·.¸ ¸.·´)¸.·*).·´`·»
«.............. Ramesh ...............»
«·´`·.(¸.·´(¸.·* *·.¸)`·.¸).·´`·»

~ Please reply to newsgroup ~


I'm having trouble viewing the google search engine.
Anyone else having a problem with this or AskJeeves? Help!


.

 

[Jeff]

Same problem for me. Please let me know if you receive a
fix.

 

[CodyP]

Hi
I downloaded and ran the Qhost Trojan removal tool. At
completition it said the trojan was not detected. So I
assume that is not why I cannot reach numerous web
pages. Any other ideas? I didn't do anything to my host
file. Makes me a little nervous changing program files,
who knows I might blow up the computer!
:}
Cody

-----Original Message-----
Hi,

If many of the search engines won't work, your system might be affected by
the recent Qhosts Trojan. This Trojan Horse that will modify the TCP/IP
settings to point to a different DNS server. Blocks many search engines.

Trojan.Qhosts Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/t rojan.qhosts.remova

l.tool.html

http://www.symantec.com/avcenter/venc/data/pf/trojan.qhos

ts.html

==
Open the HOSTS file and delete all mappings except:
127.0.0.1 localhost

The file is located at
"C:\windows\system32\drivers\etc" (named "HOSTS")
for 9x/Me, C:\Windows

Backup the current HOSTS file first.

==
Reset TCP/IP - Windows XP.

Click Start | Run | Cmd
type "netsh int ip reset changes.txt"

==
To prevent this from happening:

Install hotfix 828750 which fixes the vulnerability:
http://www.microsoft.com/windows/ie/downloads/critical/82 8750/default.asp

==
HOSTS file guide:
http://www.mvps.org/winhelp2002/hosts.htm

--
Regards,
Ramesh
[MS-MVP]
AOL: SRamesh2k

«·´`·.(*·.¸(`·.¸ ¸.·´)¸.·*).·´`·»
«.............. Ramesh ...............»
«·´`·.(¸.·´(¸.·* *·.¸)`·.¸).·´`·»

~ Please reply to newsgroup ~


I'm having trouble viewing the google search engine.
Anyone else having a problem with this or AskJeeves? Help!


.

 

[Jim Byrd]

Hi Cody - Several people have had trouble with this removal tool - you'll
need to do the Manual Removal steps. Here's my "stadard" post about this:

You've apparently gotten infected with the QHosts virus. Read here for
information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191

Try the following:


1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/828750/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates, be sure to get the EXTRADAT.exe update
from the above page as well as your regular update).

3. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.removal.tool.html
If that still doesn't clean it up (and a number of people are reporting that
it did not), then follow the Manual Removal instructions there.

4. You probably will then need to restore your HOSTS file. Download the
Hosts File Reader:

http://members.shaw.ca/techcd/VB_Projects/HostsFileReader.exe

Run the program, click the "Read Hosts File" button, click the button
labeled "Reset Defaults" and click "Save Changes." If you've been using your
HOSTS file for ad blocking (see http://www.mvps.org/winhelp2002/hosts.htm
Blocking Unwanted Ads with a Hosts File), then you'll need to reset it up
for that purpose.


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

Hi
I downloaded and ran the Qhost Trojan removal tool. At
completition it said the trojan was not detected. So I
assume that is not why I cannot reach numerous web
pages. Any other ideas? I didn't do anything to my host
file. Makes me a little nervous changing program files,
who knows I might blow up the computer!
:}
Cody

-----Original Message-----
Hi,

If many of the search engines won't work, your system might be
affected by the recent Qhosts Trojan. This Trojan Horse that will
modify the TCP/IP settings to point to a different DNS server.
Blocks many search engines.

Trojan.Qhosts Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/t
rojan.qhosts.remova l.tool.html

http://www.symantec.com/avcenter/venc/data/pf/trojan.qhos ts.html

==
Open the HOSTS file and delete all mappings except:
127.0.0.1 localhost

The file is located at
"C:\windows\system32\drivers\etc" (named "HOSTS")
for 9x/Me, C:\Windows

Backup the current HOSTS file first.

==
Reset TCP/IP - Windows XP.

Click Start | Run | Cmd
type "netsh int ip reset changes.txt"

==
To prevent this from happening:

Install hotfix 828750 which fixes the vulnerability:
http://www.microsoft.com/windows/ie/downloads/critical/82
8750/default.asp

==
HOSTS file guide:
http://www.mvps.org/winhelp2002/hosts.htm

--
Regards,
Ramesh
[MS-MVP]
AOL: SRamesh2k

«·´`·.(*·.¸(`·.¸ ¸.·´)¸.·*).·´`·»
«.............. Ramesh ...............»
«·´`·.(¸.·´(¸.·* *·.¸)`·.¸).·´`·»

~ Please reply to newsgroup ~


I'm having trouble viewing the google search engine.
Anyone else having a problem with this or AskJeeves? Help!


.

 

[JP]

-----Original Message-----
I'm having trouble viewing the google search engine.
Anyone else having a problem with this or AskJeeves? Help!
.
YESSS!!!

MICROSOFT PLEASE READ ABOUT ALL THESE SEARCH ENGINE
PROBLEMS!!!!

The total list that I' cannot access...Google.com,
Hotbot.com, askjeeves.com,lycos.com, Alta vista.com.
Yahoo search, MSN search does not "display page" IE6
w/service pack running on ME. Somebody is shutting down
search engines!! Read the same problem posted a few times.
Did anyone load a "search bar" add on? like MY SEARCH?

 

[Jim Byrd]

Hi Jeff - You've apparently gotten infected with the QHosts virus. Read here
for information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191

Try the following:


1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/828750/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates, be sure to get the EXTRADAT.exe update
from the above page as well as your regular update).

3. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.removal.tool.html
If that still doesn't clean it up (and a number of people are reporting that
it did not), then follow the Manual Removal instructions there.

4. You probably will then need to restore your HOSTS file. Download the
Hosts File Reader:

http://members.shaw.ca/techcd/VB_Projects/HostsFileReader.exe

Run the program, click the "Read Hosts File" button, click the button
labeled "Reset Defaults" and click "Save Changes." If you've been using your
HOSTS file for ad blocking (see http://www.mvps.org/winhelp2002/hosts.htm
Blocking Unwanted Ads with a Hosts File), then you'll need to reset it up
for that purpose.


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Mike Burgess]

Meiwillirees,
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects *all* major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)

Microsoft has released a cumulative patch for this vulnerability:
Simply go to Windows Update [hotfix 828750]
[more info]
http://www.microsoft.com/security/security_bulletins/ms03-040.asp

If your AV did not detect or you simply don't have an AV (bad idea)
Free Removal Tool:
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.removal.tool.html

AVG AntiVirus 6.0 [freeware] http://www.grisoft.com/

_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid

 

[Mike Burgess]

Frank,
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects *all* major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)

Microsoft has released a cumulative patch for this vulnerability:
Simply go to Windows Update [hotfix 828750]
[more info]
http://www.microsoft.com/security/security_bulletins/ms03-040.asp

If your AV did not detect or you simply don't have an AV (bad idea)
Free Removal Tool:
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.removal.tool.html

AVG AntiVirus 6.0 [freeware] http://www.grisoft.com/

_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid

 

[Mike Burgess]

Robert,
Imhosts file is *not* an issue ....
--
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects *all* major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)

Microsoft has released a cumulative patch for this vulnerability:
Simply go to Windows Update [hotfix 828750]
[more info]
http://www.microsoft.com/security/security_bulletins/ms03-040.asp
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid
--

The Trojan Qhost removal tool says that I don't have the
virurs, however my AV tool said I did! It deleted the
infected file, but I still cannot use Yahoo or Google. I
still have the file called Imhosts, but how do you open
it?? When I click on it I get the "Windows cannot open
this file" message.

-----Original Message-----
Hi,

If many of the search engines won't work, your system might be affected by
the recent Qhosts Trojan. This Trojan Horse that will modify the TCP/IP
settings to point to a different DNS server. Blocks many search engines.

Trojan.Qhosts Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/t rojan.qhosts.remova

l.tool.html

http://www.symantec.com/avcenter/venc/data/pf/trojan.qhos

ts.html

==
Open the HOSTS file and delete all mappings except:
127.0.0.1 localhost

The file is located at
"C:\windows\system32\drivers\etc" (named "HOSTS")
for 9x/Me, C:\Windows

Backup the current HOSTS file first.

==
Reset TCP/IP - Windows XP.

Click Start | Run | Cmd
type "netsh int ip reset changes.txt"

==
To prevent this from happening:

Install hotfix 828750 which fixes the vulnerability:
http://www.microsoft.com/windows/ie/downloads/critical/82 8750/default.asp

==
HOSTS file guide:
http://www.mvps.org/winhelp2002/hosts.htm

--
Regards,
Ramesh
[MS-MVP]
AOL: SRamesh2k

«·´`·.(*·.¸(`·.¸ ¸.·´)¸.·*).·´`·»
«.............. Ramesh ...............»
«·´`·.(¸.·´(¸.·* *·.¸)`·.¸).·´`·»

~ Please reply to newsgroup ~


I'm having trouble viewing the google search engine.
Anyone else having a problem with this or AskJeeves? Help!


.

 

[Mike Burgess]

CodyP,
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects *all* major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)

Microsoft has released a cumulative patch for this vulnerability:
Simply go to Windows Update [hotfix 828750]
[more info]
http://www.microsoft.com/security/security_bulletins/ms03-040.asp
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid
--

Hi
I downloaded and ran the Qhost Trojan removal tool. At
completition it said the trojan was not detected. So I
assume that is not why I cannot reach numerous web
pages. Any other ideas? I didn't do anything to my host
file. Makes me a little nervous changing program files,
who knows I might blow up the computer!
:}
Cody

-----Original Message-----
Hi,

If many of the search engines won't work, your system might be affected by
the recent Qhosts Trojan. This Trojan Horse that will modify the TCP/IP
settings to point to a different DNS server. Blocks many search engines.

Trojan.Qhosts Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/t rojan.qhosts.remova

l.tool.html

http://www.symantec.com/avcenter/venc/data/pf/trojan.qhos

ts.html

==
Open the HOSTS file and delete all mappings except:
127.0.0.1 localhost

The file is located at
"C:\windows\system32\drivers\etc" (named "HOSTS")
for 9x/Me, C:\Windows

Backup the current HOSTS file first.

==
Reset TCP/IP - Windows XP.

Click Start | Run | Cmd
type "netsh int ip reset changes.txt"

==
To prevent this from happening:

Install hotfix 828750 which fixes the vulnerability:
http://www.microsoft.com/windows/ie/downloads/critical/82 8750/default.asp

==
HOSTS file guide:
http://www.mvps.org/winhelp2002/hosts.htm

--
Regards,
Ramesh
[MS-MVP]
AOL: SRamesh2k

«·´`·.(*·.¸(`·.¸ ¸.·´)¸.·*).·´`·»
«.............. Ramesh ...............»
«·´`·.(¸.·´(¸.·* *·.¸)`·.¸).·´`·»

~ Please reply to newsgroup ~


I'm having trouble viewing the google search engine.
Anyone else having a problem with this or AskJeeves? Help!


.

 

[Mike Burgess]

Tcritser,
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects *all* major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid
--

 

[Mike Burgess]

Jim,
FYI: the HOST File Reader is useless in this case ......
As previously pointed out it *only* looks in the default location,
in other words it won't find theQHosts created file in Windows\Help (if
exists)

As a work-around the new beta version of HijackThis can detect ...
http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid
--

 

[Ramesh [MS-MVP]]

It's expected, Frank. thats why the manual procedure "HOSTS" file to be
performed seperately. Follow MVP Jim's instructions at the end of this
thread.

--
Regards,
Ramesh
[MS-MVP]
AOL: SRamesh2k

«·´`·.(*·.¸(`·.¸ ¸.·´)¸.·*).·´`·»
«.............. Ramesh ...............»
«·´`·.(¸.·´(¸.·* *·.¸)`·.¸).·´`·»

~ Please reply to newsgroup ~


I downloaded the trojan hosts removal and once it was
executed it stated that I did not have the virus at all. I
am still having the same problem with searches.