similar to QHOSTS but different...still need help

[Guest]

Hello,
I have similar problem as other users in the group...
keep getting redirected to:
http://www.flashlightsearch.com/search4U.html on HTTP 404
File Not Found error.

Using Windows 98, IE6.

All patches, updates, EVERYTHING for IE, Windows, etc.
(downloaded latested IE patch AFTER infected..no help).

So, using NAV Corp. Ed. and downloaded latest virus
definitions file...did complete scan. Nothing.
Rebooted and did complete scan...nothing.
Downloaded Symantec's tool to remove QHOST...nothing.
Tried Brown University's tool...nothing.

I am seeing something DIFFERENT than the symptoms of
infection listed in the documentation.
In particular, my HOST file has not been tampered with.
It has not been copied to C:\Windows\Help.
NONE of the registry entries mentioned have been made.
(OK...maybe one but I think this already existed)
BUT the following registry entries HAD been made:

HKEY_USERS\<username>\Software\Microsoft\Windows\CurrentVer
sion\Internet Settings\ZoneMap\www.flashlightsearch.com
-----------------
NOTE: I THINK this is what is WAS...I removed it
BUT I still have the redirection problem. When I search
my registry for "flashlightsearch" I get nothing
-------------------
Has anyone seen something similar to this and might know
the name/flavor of this variant/type of worm/virus/vermin?

I obviously have something...and it isn't QHOSTS.....
at least not the standard army issue described in the
alerts.

Regards,

Bruce G. Williams

 

[YoKenny]

Hello,
I have similar problem as other users in the group...
keep getting redirected to:
http://www.flashlightsearch.com/search4U.html on HTTP 404
File Not Found error.

Using Windows 98, IE6.

All patches, updates, EVERYTHING for IE, Windows, etc.
(downloaded latested IE patch AFTER infected..no help).

So, using NAV Corp. Ed. and downloaded latest virus
definitions file...did complete scan. Nothing.
Rebooted and did complete scan...nothing.
Downloaded Symantec's tool to remove QHOST...nothing.
Tried Brown University's tool...nothing.

I am seeing something DIFFERENT than the symptoms of
infection listed in the documentation.
In particular, my HOST file has not been tampered with.
It has not been copied to C:\Windows\Help.
NONE of the registry entries mentioned have been made.
(OK...maybe one but I think this already existed)
BUT the following registry entries HAD been made:

HKEY_USERS\<username>\Software\Microsoft\Windows\CurrentVer
sion\Internet Settings\ZoneMap\www.flashlightsearch.com
-----------------
NOTE: I THINK this is what is WAS...I removed it
BUT I still have the redirection problem. When I search
my registry for "flashlightsearch" I get nothing
-------------------
Has anyone seen something similar to this and might know
the name/flavor of this variant/type of worm/virus/vermin?

I obviously have something...and it isn't QHOSTS.....
at least not the standard army issue described in the
alerts.

Looks like a job for HijackThis download direct (below):
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/