Jon,
Trojan Qhosts hijacks the HOSTS file, however unlike normal redirectors,
this one hides the HOSTS file in the "Windows\Help" folder. It then
creates entries that redirects *all* major search engines to a website.
Note: this website has now been removed, thus the DNS errors.
Some users have reported multiple HOSTS files in various locations
[more HOSTS info]
http://www.mvps.org/winhelp2002/hosts.htm
Microsoft has released a cumulative patch for this vulnerability:
Simply go to Windows Update [hotfix 828750]
[more info]
http://www.microsoft.com/security/security_bulletins/ms03-040.asp
[Removal Method]
http://www.brown.edu/Facilities/CIS/Software_Services/virus/index.html
[or]
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html
[or]
http://vil.nai.com/vil/content/v_100719.htm
Note: not all machines are affected by the same Registry changes
but the user needs to verify in any case, if changes exist.
You can detect "Qhosts" via "HijackThis!"
http://www.mvps.org/winhelp2002/unwanted.htm
____________________________________________________________
Mike Burgess [MVP Windows Shell\User]
http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 10-21-03]
Please post replies to this Newsgroup, email address is invalid
