IE

[JD]

Has anyone run across this? When I run IE, and my search
engine is msn or yahoo, when I do a search, I get back
a 'page can not be displayed'. If I go to google, I get a
green cPanel page. I can go directly to url's but I can
not do a search. I have removed IE and all entries from
the registry and re-installed IE and the problem is still
around. I ran my Norton virus scan and it found nothing.
WTF! Any ideas would be helpull.
Thanks
-JD

 

[Mike Burgess]

JD,
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects *all* major search engines to a website.
Note: this website has now been removed, thus the DNS errors.

Microsoft has released a cumulative patch for this vulnerability:
Simply go to Windows Update [hotfix 828750]
[more info]
http://www.microsoft.com/security/security_bulletins/ms03-040.asp

[manual removal method]
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html
Note: not all machines are affected by the same Registry changes
but the user needs to verify in any case.

You can detect "Qhosts" via a new beta version of HijackThis
http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip
[more info]
http://forums.spywareinfo.com/index.php?showtopic=12127

For instruction on using HijackThis!
http://www.mvps.org/winhelp2002/unwanted.htm
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 10-07-03]
Please post replies to this Newsgroup, email address is invalid