CDROM-Guide forums

Go Back   CDROM-Guide forums > Main Forums > Open to All Computer Related Topics
FAQ Calendar Mark Forums Read
Open   CSec   Data   DevDrv   CoOp   Audio   CDRW   CDG   VCD   DVD   HD DVD   Mac   VGB   PS2   DC   Xbox  

Thread Tools Display Modes
Old Oct 08, 2003, 08:45 PM
sammy_510 sammy_510 is offline
Senior Member
Join Date: Jun 2001
Location: Belfast N.Ireland
Posts: 301

sponsored links

had the same problem so decided to upgrade to ie6 and all is well now

Reply With Quote
Old Oct 09, 2003, 01:23 AM
MasterMind MasterMind is offline
Join Date: May 2001
Location: Pune, Maharashtra, India
Posts: 3,219

If at all its a browser hijack then Hoss m8 has already posted few solutions [url=***********]Here.
Reply With Quote
Old Oct 09, 2003, 06:19 AM
Bob and Sam Bob and Sam is offline
Senior Member
Join Date: May 2001
Location: England
Posts: 236

Not sur if it is the same as Hoss's, Ive update my Ie with ms patch, used the Qhost fix - found nothing, updated my Norton to 8/10/03 - found nothing.

But google still doesn't come up and no ther search work

my problem sounds very similar to [I]deleted URL[/I] see below

but non of the fix's work, and I dont know how i would get rid of it manually.

I'm running Win XP SP1 if that any help.

Last edited by Bob and Sam; Oct 09, 2003 at 06:42 AM.
Reply With Quote
Old Oct 09, 2003, 06:40 AM
gooner gooner is offline
Join Date: Jan 2002
Location: London, UK
Posts: 1,795

Hi Bob and Sam - just to let you know links to other forums are not allowed.........I have copied and pasted the question and answers below. Would be an idea to delete the forum link methinks.


noticed a few days ago that I could not reach Google or many other search engines.
This drove me nuts until I found out about the QHosts-1 virus. It was identified Sep 30th as the QHOSTS-1 Virus, (AKA Trojan.Qhosts)

I just removed it from my computer - had me baffled for 2 days.

For more info check: (Partial quote below)
I used the remover, and that did not do the job. I had to turn off the system restore for XP and do the manual removal
(quoted @ bottom), and perform the critical updates before it was wiped out.
I did notice from the removal program that the viral file was sitting in an internet temp folder under my wife's login (on XP) - Thanks Honey!

More info see Symantic Security Response:

*****(Quote from Symantic Security Response)*****
Trojan.Qhosts is a Trojan Horse that will modify the TCP/IP settings to point to a different DNS server.

Trojan.Qhosts cannot spread by itself. For a computer to become infected, you would have to open an HTML page that contains code, which allows it to open a viral HTML file on the target computer, so that the script can create and run the malicious executable.

Symantec Security Response has developed a removal tool to repair damage from infections of Trojan.Qhosts.

Symantec Security Response has received reports that visiting a specific page on caused a popup to be displayed that redirected the visitor to a different web page. Being redirected to the web page appears to have caused the trojan to be downloaded to a visitor's system and then executed. Reports also state that the threat exploited the Internet Explorer Object Data Remote Execution vulnerability on several victims' computers to execute itself.

Microsoft has released a cumulative patch for this vulnerability, available here.

***** Removal Instructions That Worked for Me *****
Removal Instructions

All Windows Users :
Use current engine and DAT files for detection and removal.

The following EXTRA.DAT packages are being made available prior to the regularly scheduled weekly DAT release (working with EXTRA.DAT files ).


Manual Removal Instructions

Apply the MS03-040 patch
Delete the following files:

Set the following registry key value (Information on editing registry keys ):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\
Tcpip\Parameters "DataBasePath" = %SystemRoot%\System32\drivers\etc
Delete the following registry key value (Information on deleting registry keys ):
Services\Tcpip\Parameters\Interfaces\windows "r0x"
Reconfigure your DNS server settings as desired
Reconfigure your Internet Explorer settings as desired
Additional Windows ME/XP removal considerations

I've included a link to your info in the pinned thread at the top of the forum now. The information regarding manual removal and the hijacked Hosts location configured in the XP registry is especially helpful -- I should note that the location you give is specific to WinXp home though.

Other locations:

Windows 95/98/Me c:\windows\hosts
Windows NT/2000/XP Pro_ c:\winnt\system32\drivers\etc\hosts
Windows XP Home_c:\windows\system32\drivers\etc\hosts


Last edited by gooner; Oct 09, 2003 at 06:44 AM.
Reply With Quote
Old Oct 09, 2003, 06:44 AM
Bob and Sam Bob and Sam is offline
Senior Member
Join Date: May 2001
Location: England
Posts: 236

I also tried doing it manually but couldn't find Services\Tcpip\Parameters\Interfaces\windows "r0x"

and also using XP Pro, is this the problem?
Reply With Quote
Old Oct 09, 2003, 06:49 AM
Bob and Sam Bob and Sam is offline
Senior Member
Join Date: May 2001
Location: England
Posts: 236

blah read this

Windows NT/2000/XP Pro_ c:\winnt\system32\drivers\etc\hosts

after deleting this file all works fine bit worrying that Norton didn't pick it up.
Reply With Quote

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
DVD copying problem - works fine on one player won't work on others mart0406 DVD 4 Jul 03, 2003 05:28 PM
Why is my work computer internet connection faster than my home cable? bnbhoha Open to All Computer Related Topics 4 Apr 09, 2003 03:24 AM
AVI to M2V. AVIsynth wont work for me. TMPGEnc wont work for me. Whats wrong here. BRUINSrock DVD 3 Mar 05, 2003 08:41 PM
Can't get a Flash chip to work, but OTP's work fine barracuda Video Game Backup - Xbox 7 Sep 03, 2002 05:58 PM
do all dc backups work on all dc systems THEGURU19 Dreamcast 9 Apr 19, 2002 10:07 PM

All times are GMT -5. The time now is 09:16 PM.

Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.
Copyright 1996-2009 All rights reserved