Search Engine URLs redirected to bad addresses

[Jaime Castells]

I have a workstation that has symptoms similar to the
Qhost virus, but there is no indicaiton that it was ever
infected. Specificly, access to the common search
engines, such as www.google.com or search.msn.com, fail.
They either produce a standard 404 page not found or they
come up with a formatted web site that says its from
Cpanel and that the URL points to an empty address.
Other browsing works fine inculding access to other pages
at those domains, such as Googles new search or image
search. I have performed virus scans with the latest
Norton Corporate edition and examined the registry at
length. I even went so far as to completely replace the
Internet Explorer portions of HKLM and HKCU with those of
another machine. The problem seems to have something to
do with name resolution. Performing a ping of
www.google.com produces the wrong IP number,
207.44.220.30, which is the source of the Cpanel error
page.

What could be interfering with name resolution? It only
effects particular URLs. I looked in the hosts file, but
there were no entries.

ANy and all help would be greatly appreciated. I'm
really frustrated!

 

[Mike Burgess]

Jaime,
"CPanel" usually involves a trojan or exploit (HTA)

Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Note: make *sure* to follow-up with HijackThis
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 11-26-03]
Please post replies to this Newsgroup, email address is invalid