virus/trojan/hacking mystery

[Sanjaya]

A chat friend in England told me her ex boyfriend "hacked"
her computer, and messed with IE. According to her he told
her he did this.

All that's wrong is IE won't load geocities or angelfire pages.

My first thought was the hosts file, which she looked for and
didn't find in the root of drive c:, but did find the generic MS
one in system32. It was normal.

She then tried pandasoftware's activescan and it crashed IE,
but had to go to work before we could investigate further

She has Norton, but not up to date, I'll have her try to update
it, and try panda again and housecall at trendmicro.

In the meantime I have no clue why only geo and angelfire pages
won't load and why the hosts file is missing from C:

Is there a "hack" to rename hosts and make it block stuff?
Any trick of some kind? I know this should be a simple problem
to fix, but it's confusing me right now.

She's running XP Home Edition.

 

[Jeff Cook]

A chat friend in England told me her ex boyfriend "hacked"
her computer, and messed with IE. According to her he told
her he did this.

All that's wrong is IE won't load geocities or angelfire pages.

My first thought was the hosts file, which she looked for and
didn't find in the root of drive c:, but did find the generic MS
one in system32. It was normal.

The hosts file is missing from the root of C: because it lives in
C:\WINDOWS\system32\drivers\etc in XP Home.

I've heard of her problem before, but the solution eludes me. One of the
regulars will post the answer any old tick of the clock...

As for her ex-boyfriend...well, I wouldn't tell someone that I'd hacked into
their PC unless I sincerely wanted some suits to take my computer and I down
town for further investigation.

Jeff

 

[Conor]

The hosts file is missing from the root of C: because it lives in
C:\WINDOWS\system32\drivers\etc in XP Home.

I've heard of her problem before, but the solution eludes me. One of the
regulars will post the answer any old tick of the clock...

Could be that the ISP has blacklisted those domains so they won't
resolve with the DNS nameserver of the ISP.