trojan qhost & search

F

frank

Several people have mentioned to go to symantech web site
to download their trojan qhost virus removal tool.
However, I have done this and it detects no virus; I have
also downloaded the microsoft security updates and I still
have the search problem.

Any more ideas?
 
O

obsolete

hi, frank
If you this doesn't work you did somthing wrong. So if
you can't get it to work e-mail me.

1. Go here http://mvps.org/winhelp2002/unwanted.htm

2. scroll down until you see "To safely remove or block
these type files from your system" Then click
the "http://security.kolla.de/" link under "Experienced
Users"

3. Install the program and update it under settings.

4. Now check you computer, once done with the check fix
the problems.

5. Then go back to Go here
http://mvps.org/winhelp2002/unwanted.htm and go back to
that same section and right underneith that section will
be the section "To double-check your system" download
the "Hijack This" and run the prog.

6. Congrats all is done. If you have any questions e-
mail me. It worked for me and so it should work for you.

..
 
M

Mike Burgess

Frank,
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects *all* major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
See: "Run HijackThis" on the above page ....
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid
 
H

H

Frank,

I had the same problem. This is what I did :

1) Searched for a file named "hosts";
2) I found that that file was changed on the day my
problems started;
3) After opening the file with editor, I found in there
all the web addresses I could not connect. I deleted all
the lines and saved the new empty hosts file;
4) After rebooting the system, everything was working
again.

I am not sure this is the best solution. I am afraid that
I could have damaged something else, but...I didn't know
what to do and I didn't want to download software from
people I didn't know.

Good luck !

P.S. - Have you also noticed your HD working for a long
time, even when you are not doing anything ?
 
J

JP

-----Original Message-----
Several people have mentioned to go to symantech web site
to download their trojan qhost virus removal tool.
However, I have done this and it detects no virus; I have
also downloaded the microsoft security updates and I still
have the search problem.

Any more ideas?
.
If it makes you feel any better, I did the exact same
thing and I still cant get google,lycos,hotbot,altavista
nor askjeeves. nothing detected too.
 
M

Mike Burgess

H,
There are still several important Registry entries that need to be reset.
Also several other files need to be deleted, etc.
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html
Follow the "Manual Method" from the above ......

You can detect "Qhosts" via a new beta version of HijackThis
http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip
[more info]
http://forums.spywareinfo.com/index.php?showtopic=12127

For instruction on using HijackThis!
http://www.mvps.org/winhelp2002/unwanted.htm
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid
--
 
M

Mike Burgess

JP,
You can detect "Qhosts" via a new beta version of HijackThis
http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip
[more info]
http://forums.spywareinfo.com/index.php?showtopic=12127

For instruction on using HijackThis!
http://www.mvps.org/winhelp2002/unwanted.htm
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid
--
 
M

medgirl

Mike Burgess said:
H,
There are still several important Registry entries that need to be reset.
Also several other files need to be deleted, etc.
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html
Follow the "Manual Method" from the above ......

I think the whole thing is a little strange. My NAV never picked up a
trojan. I fixed it by finding the hosts files and deleting them myself. I
went back to use the qhosts fix on the Symantec website and it couldn't find
any evidence of qhosts. I manually went through all the registry entries
they mentioned and I did not find the settings they said to delete. The
Symantec website above says the qhosts file will likely be in C:\Windows,
which for most of us it has not been. Is there a chance many of us have had
perhaps a variant of qhosts and not the exact infection they discuss on this
website?

I bring this up because many people are not having success with the many
programs and fixes being posted, but rather can only fix the problem with a
manual deletion of the qhosts file. My personal concern is that I haven't
fully cleaned this off my computer, even though the search engines are
working; however, again, my spybot and antivirus programs aren't finding
anything.

m
 
M

Mike Burgess

medgirl,
Symantec kinda dropped the ball on this one, by the looks of it.

You can detect "Qhosts" via a new beta version of HijackThis
http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip
[more info]
http://forums.spywareinfo.com/index.php?showtopic=12127

For instruction on using HijackThis!
http://www.mvps.org/winhelp2002/unwanted.htm
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid
 
M

medgirl

Mike Burgess said:
medgirl,
Symantec kinda dropped the ball on this one, by the looks of it.

It seems to be so. Their information is related to the problem, but doesn't
solve the problem.

m
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top