IE6 not able to search

  • Thread starter Thread starter Josh
  • Start date Start date
J

Josh

As of a few days ago, I am unable to search from the
address bar or even visit ANY search page. WHat is going
on? I've noticed it will auto load a website if my search
is exactly what the web page is. For example: "bose".
My setting are NOT to go to the webpage though. Only to
display results in main window. I cannot seem to figure it
out. I've tried going back to IE 5 and that did not fix it.

Thanks
 
Josh,
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects *all* major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)

Microsoft has released a cumulative patch for this vulnerability:
Simply go to Windows Update [hotfix 828750]
[more info]
http://www.microsoft.com/security/security_bulletins/ms03-040.asp

If your AV did not detect or you simply don't have an AV (bad idea)
Free Removal Tool:
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.removal.tool.html

AVG AntiVirus 6.0 [freeware] http://www.grisoft.com/
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid
 
Hi Josh - You've apparently gotten infected with the QHosts virus. Read here
for information:

http://www.sarc.com/avcenter/venc/data/trojan.qhosts.html
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100719
http://www3.ca.com/virusinfo/virus.aspx?ID=37191

Try the following:


1. Be sure that you install hotfix 828750 which fixes the exploit that this
virus uses:

http://www.microsoft.com/windows/ie/downloads/critical/828750/default.asp

2. Update and run a complete Anti-Virus software check of your system. Most
of the major AV companies have updated their latest signatures to detect
this virus (for Network Associates, be sure to get the EXTRADAT.exe update
from the above page as well as your regular update).

3. If running your AV doesn't clean it up, go to this page, read the
directions CAREFULLY (particularly about the Restore option) and download
and run the removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.removal.tool.html
If that still doesn't clean it up (and a number of people are reporting that
it did not), then follow the Manual Removal instructions there.

4. You probably will then need to restore your HOSTS file. Download the
Hosts File Reader:

http://members.shaw.ca/techcd/VB_Projects/HostsFileReader.exe

Run the program, click the "Read Hosts File" button, click the button
labeled "Reset Defaults" and click "Save Changes." If you've been using your
HOSTS file for ad blocking (see http://www.mvps.org/winhelp2002/hosts.htm
Blocking Unwanted Ads with a Hosts File), then you'll need to reset it up
for that purpose.


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In
 
-----Original Message-----
As of a few days ago, I am unable to search from the
address bar or even visit ANY search page. WHat is going
on? I've noticed it will auto load a website if my search
is exactly what the web page is. For example: "bose".
My setting are NOT to go to the webpage though. Only to
display results in main window. I cannot seem to figure it
out. I've tried going back to IE 5 and that did not fix it.

Thanks
.
This must be a new form of a virus attack. I too can't
Click to expand...
reach a search engine. Read all the other ones posted too.
 
I used the removal tool successfully and installed the
latest updates but still get a "this page cannot be
displayed" when I do a search.

I also have an up-to-date and running AVG software which
did not detect or fix this attack.
 
John,
Does a HOSTS file still exist in Windows\Help?
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects *all* major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
[more info]
http://www.mvps.org/winhelp2002/hosts.htm (bottom of page)
Run the beta version of HijackThis (link on Hosts page)
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid
 
-----Original Message-----
As of a few days ago, I am unable to search from the
address bar or even visit ANY search page. WHat is going
on? I've noticed it will auto load a website if my search
is exactly what the web page is. For example: "bose".
My setting are NOT to go to the webpage though. Only to
display results in main window. I cannot seem to figure it
out. I've tried going back to IE 5 and that did not fix it.

Thanks
.
http://securityresponse.symantec.com/avcenter/venc/data/tr
Click to expand...
ojan.qhosts.html

go to this site. follow the instructions for
finding "Host" files. look at them, I had two the same.
they were loaded with all the search engines I couldn't
get. They were created a week ago for me. I deleted them
and now I got my search engines back.
 
I have just donwloaded and started the beta Highjack this

do you want me to post the log file, bcause I do not know
the answer to your question
 
John,
Yes, post your log to their Forum, there is a great bunch of helpful folks
there!
Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates: "hijackthis.log")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, go to the "Spyware and Hijackware Removal" section.
Press "New Topic", copy and paste hijackthis.log into your new message.
_______________________________________
Mike Burgess http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 9-30-03]
Please post replies to this Newsgroup, email address is invalid
 
Back
Top