Stigs
10-02-2003, 11:08 PM
rather strange problem here
windows XP, IE all updated, DSL shared with D-Link router
cant access sites: google, altavista, lycos
yahoo will load but time out when i actually do a search
these seem to be the only sites not working
any ideas?
Barbarian
10-03-2003, 03:24 AM
http://www.google.com/search?q=trojan.qhosts
this one tells you about it..
http://securityresponse.symantec .com/avcenter/venc/data/trojan.qhosts.html
scroll down, it points all search engines to another site..
<IP address specified in the batch file> elite
<IP address specified in the batch file> www.google.akadns.net
<IP address specified in the batch file> www.google.com
<IP address specified in the batch file> google.com
<IP address specified in the batch file> www.altavista.com
<IP address specified in the batch file> altavista.com
<IP address specified in the batch file> search.yahoo.com
<IP address specified in the batch file> uk.search.yahoo.com
<IP address specified in the batch file> ca.search.yahoo.com
<IP address specified in the batch file> jp.search.yahoo.com
<IP address specified in the batch file> au.search.yahoo.com
<IP address specified in the batch file> de.search.yahoo.com
<IP address specified in the batch file> search.yahoo.co.jp
<IP address specified in the batch file> www.lycos.de
<IP address specified in the batch file> www.lycos.ca
<IP address specified in the batch file> www.lycos.jp
<IP address specified in the batch file> www.lycos.co.jp
<IP address specified in the batch file> alltheweb.com
<IP address specified in the batch file> web.ask.com
<IP address specified in the batch file> ask.com
<IP address specified in the batch file> www.ask.com
<IP address specified in the batch file> www.teoma.com
<IP address specified in the batch file> search.aol.com
<IP address specified in the batch file> www.looksmart.com
<IP address specified in the batch file> auto.search.msn.com
<IP address specified in the batch file> search.msn.com
<IP address specified in the batch file> ca.search.msn.com
<IP address specified in the batch file> fr.ca.search.msn.com
<IP address specified in the batch file> search.fr.msn.be
<IP address specified in the batch file> search.fr.msn.ch
Look in your hosts file (search for "hosts" in c:\) first, also you need to remove the trojan, I think that page has detailed instructions.
Barbarian
10-04-2003, 11:23 PM
There are now patches to address this vulneurability, 828750 on Windows update (Dated Oct 3) for Internet Explorer. Note that it won't remove the installed malware if it's already there.