wierd internet problem (1 Viewer)

[Chris Shelly]

I have a strange internet problem and hope someone can help me out. For some reason when I try to use Yahoo or Google search I always get a "The page can't be found" error 404 message.

Last week I was getting this message on every web page I tried. So I called Comcast tech support and we tried several things. They finely figured out that my computer lost its ability to work with the assigned IP address. So they gave me a new IP address and had me reboot my computer. After reboot I was able to load all my favorite web pages again. Now only Google and Yahoo search is a problem.

Any ideas? I tried to clear history and delete all cookies but I am still having trouble.

thanks
Chris

 

[Noah Gottula]

You have a virus, i think its called qhost-1. I know someone else that had it. Try updating your antivirus software.

 

[Chris Shelly]

Wierd...

I have Norton antivirus and it comes up clean. I just updated it a few days ago.

Could this be a worm not detectable by antivirus software?

If so I might have to pick it out by hand.

 

[Noah Gottula]

http://securityresponse.symantec.com...oval.tool.html

there ya go

 

[Ted Lee]

you almost certainly have the qhosts virus (technically it's not a virus...but whatever).

check out my post - it has what needs to be done.

http://www.hometheaterforum.com/htfo...ghlight=google

specifically, check out the following link

http://www.tweakxp.com/hostsfix.htm

also, be SURE to check to see if you have two "hosts" files. when i deleted the secondary one...that was what finally fixed my problem.

lemme know if you have any questions.

 

[Chris Shelly]

I tried the fix from Symantic and after a long while of searching it finely said I did not have the Ghost virus on my computer. I have not tried any other fixes yet.

I can access the front page of Yahoo and Google but I can't search for anything without an error 404. As an example if I type "home theater" in yahoo search box I get 404. For the address I get this below.

http://www.yahoo.com/r/sx/*-http://s...TF-8&fr=fp-top

Interestingly if I go to www.comcast.net and use that search engine it will work. It is powered by Google.

This does sound like a virus but where is it hiding?

 

[Ted Lee]

chris - did you read the fix on the tweakxp site?

trust me, if this is the qhosts virus, you'll need to read and follow their instructions to fix this.

 

[Chris Shelly]

Hi Ted,

I tried the fix at tweakxp without success.

First I deleted the host file and then I ran the Spybot program. They say that I should check the box "lock hosts file read-only as protection against hijackers". I don't seem to have this option when I select immunize on the right hand side. Perhaps this is why it did not work.

Am I missing something in one of the steps?

thanks
Chris

 

[Ted Lee]

[edit] ya know...before we do anything else, we should make sure it's the qhosts virus you have. do a search for "hosts" and see how many files you find. also, open the hosts file in your system32 directory with notepad - see how many entries you have. you should only have one that says "127.0.0.1 localhosts" - if you have more you are definitely infected.

i don't remember deleting my hosts file from my c:windowssystem32.... directory. iirc, you *have* to keep a hosts file in there. if you don't, i would restore the file you deleted, then edit and remove the extra entries. you only need to keep the first line that says "127.0.0.1 localhosts". delete any other entries.

regarding locking the hosts file, i'm not at home so i don't recall exactly, but i think you have to install something (via that app) first? in any case, all you really have to do is make the hosts file read-only. you can simply right-click the file, then check the "read-only" tab.

did you search for a secondary hosts file? look in c:windowshelp - if it's there, check to see how big it is. open it in notepad - i bet you'll find the file is huge. be sure to delete that one too. the guy in my other thread said all his attempts failed until he deleted the secondary hosts file.

 

[Chris Shelly]

Hey Ted,

I am FIXED ))

I had all sorts of garbage in my host files. Like you I had 2 of them. One located in Windows/System 32/Drivers/ETC and another located in my Windows Help folder.

I basicly just followed your directions in your other thread. It took some work but it fixed it good.

I am wondering how this virus is spread. I don't do any file swapping. I pretty much just hang out at the home theater forums and edmunds.com. I share a lot of e-mail with a friend who does dig deep in the internet and does file sharing. Interestingly he was not affected by this.

Microsoft better start fixing these holes or they are going down. Either legally or from people getting sick of there garbage.

Chris

 

[Ted Lee]

rockin chris! glad it's fixed.

my understanding is there are certain websites with a maliscious advertisement. when you go to that website (you don't even have to click the ad) an activeX script runs which does all the work hosing your system.

if you followed all the stuff on tweakxp you should be fine. your system will now prompt you for any activex stuff that runs.

 

[Chris Shelly]

I think I got mine last week when I was searching for old files for Microsoft Flight Simulator. I went to this one web site that had loads of pop up adds. One of them could have been the affected pop up.

Mine is secure for now. That is until the people make these get more creative.

 

[Todd H]

You could give Opera or Mozilla a try.