Google won't open and Yahoo won't search

  • Thread starter Thread starter Greg
  • Start date Start date
G

Greg

Without making any known changes to the system, Google
will not open (DNS error) and yahoo's search function
doesn't work. Alta Vista also does not open. All other
sites work fine and everything else I have tried to do
with the computer works fine. Checked DNS and all other
TCP/IP settings and they are all fine. Reset security
options, checked restricted sites(none), everything looks
the same as all the computers on our network. Any
suggestions?
 
Check the HOSTS file. Also see the answer below:

=====================
Borrowed from Jim (MVP)

You've apparently gotten infected with the QHosts trojan. Read here for
information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/828750/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates, be sure to get the EXTRADAT.exe update
from the above page as well as your regular update).

3. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.remova
l.tool.html

If that still doesn't clean it up (and a number of people are reporting that
it did not), then follow the Manual Removal instructions there. The
following is courtesy of Mike Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis (link on Hosts page)

--
Regards,
Ramesh [MS-MVP]
AIM: SRamesh2k


~ Please reply to newsgroup ~


Without making any known changes to the system, Google
will not open (DNS error) and yahoo's search function
doesn't work. Alta Vista also does not open. All other
sites work fine and everything else I have tried to do
with the computer works fine. Checked DNS and all other
TCP/IP settings and they are all fine. Reset security
options, checked restricted sites(none), everything looks
the same as all the computers on our network. Any
suggestions?
 
Greg,
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects *all* major search engines to a website.
Note: this website has now been removed, thus the DNS errors.

Microsoft has released a cumulative patch for this vulnerability:
Simply go to Windows Update [hotfix 828750]
[more info]
http://www.microsoft.com/security/security_bulletins/ms03-040.asp

[manual removal method]
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html
Note: not all machines are affected by the same Registry changes
but the user needs to verify in any case.

You can detect "Qhosts" via a new beta version of HijackThis
http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip
[more info]
http://forums.spywareinfo.com/index.php?showtopic=12127

For instruction on using HijackThis!
http://www.mvps.org/winhelp2002/unwanted.htm
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 10-07-03]
Please post replies to this Newsgroup, email address is invalid
 
I performed the operations listed in the reply and AV did
not find anyting, even with NAV Corporate edition on
latest virus defs. THe removal tool also dod not find
anything but there was a hosts file in c:\windows\help?
that did contain redirects for google as well as many
other search engines to a bogus IP. Deleted the file and
all is well.

Thanks!
-----Original Message-----
Check the HOSTS file. Also see the answer below:

=====================
Borrowed from Jim (MVP)

You've apparently gotten infected with the QHosts trojan. Read here for
information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp? id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/82 8750/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates, be sure to get the EXTRADAT.exe update
from the above page as well as your regular update).

3. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/t rojan.qhosts.remova
l.tool.html

If that still doesn't clean it up (and a number of people are reporting that
it did not), then follow the Manual Removal instructions there. The
following is courtesy of Mike Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis (link on Hosts page)

--
Regards,
Ramesh [MS-MVP]
AIM: SRamesh2k


~ Please reply to newsgroup ~


Without making any known changes to the system, Google
will not open (DNS error) and yahoo's search function
doesn't work. Alta Vista also does not open. All other
sites work fine and everything else I have tried to do
with the computer works fine. Checked DNS and all other
TCP/IP settings and they are all fine. Reset security
options, checked restricted sites(none), everything looks
the same as all the computers on our network. Any
suggestions?


.
Click to expand...
 
You're Welcome, Greg.

--
Regards,
Ramesh [MS-MVP]
AIM: SRamesh2k


~ Please reply to newsgroup ~


I performed the operations listed in the reply and AV did
not find anyting, even with NAV Corporate edition on
latest virus defs. THe removal tool also dod not find
anything but there was a hosts file in c:\windows\help?
that did contain redirects for google as well as many
other search engines to a bogus IP. Deleted the file and
all is well.

Thanks!
-----Original Message-----
Check the HOSTS file. Also see the answer below:

=====================
Borrowed from Jim (MVP)

You've apparently gotten infected with the QHosts trojan. Read here for
information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp? id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191


Try the following:

1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/82 8750/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates, be sure to get the EXTRADAT.exe update
from the above page as well as your regular update).

3. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/t rojan.qhosts.remova
l.tool.html

If that still doesn't clean it up (and a number of people are reporting that
it did not), then follow the Manual Removal instructions there. The
following is courtesy of Mike Burgess:

"Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects all major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis (link on Hosts page)

--
Regards,
Ramesh [MS-MVP]
AIM: SRamesh2k


~ Please reply to newsgroup ~


Without making any known changes to the system, Google
will not open (DNS error) and yahoo's search function
doesn't work. Alta Vista also does not open. All other
sites work fine and everything else I have tried to do
with the computer works fine. Checked DNS and all other
TCP/IP settings and they are all fine. Reset security
options, checked restricted sites(none), everything looks
the same as all the computers on our network. Any
suggestions?


.
Click to expand...
 
Back
Top