Does This Sound Like Qhosts Infection?

Discussion in 'Computer Support' started by BroJack, Oct 8, 2003.

  1. BroJack

    BroJack Guest

    Symptom: Inability to use Yahoo or Google to search the web
    _____
    Files show:

    Hosts C:\WINDOWS 1KB Sam File 4/23/99

    Lmhosts C:\WINDOWS 4KB Sam File 4/23/99

    hosts C:\WINDOWS 5KB File 10/1/03

    hosts C:\WINDOWS\HELP 5KB File 10/1/03

    Hosts C:\WINDOWS\Recent 1KB Shortcut 10/7/03

    Qhosts(1) C:\WINDOWS\Temporary Internet File\Content.IE5\4LEB816N
    13KB HTML Document 10/7/03
    ______

    If this is Qhosts, please help me get rid of it.

    Jack
     
    BroJack, Oct 8, 2003
    #1
    1. Advertising

  2. BroJack

    Brian H¹© Guest

    BroJack said:

    > Symptom: Inability to use Yahoo or Google to search the web
    > _____
    > Files show:
    >
    > Hosts C:\WINDOWS 1KB Sam File 4/23/99


    ^^^^^^^^^^^^ sample file

    >
    > Lmhosts C:\WINDOWS 4KB Sam File 4/23/99


    ^^^^^^^^^^^^ sample file

    >
    > hosts C:\WINDOWS 5KB File 10/1/03


    ^^^^^^^^^^^^^ Hosts file

    >
    > hosts C:\WINDOWS\HELP 5KB File 10/1/03


    ^^^^^^^^^^^^ Help file

    >
    > Hosts C:\WINDOWS\Recent 1KB Shortcut 10/7/03


    ^^^^^^^^^^^^^^ shortcut to Hosts file

    >
    > Qhosts(1) C:\WINDOWS\Temporary Internet File\Content.IE5\4LEB816N
    > 13KB HTML Document 10/7/03


    ^^^^^^^^^^^ Qhosts file (as can be seen it it's name)

    > ______
    >
    > If this is Qhosts, please help me get rid of it.
    >
    > Jack


    Internet Options | Delete Files | Include all offline content.
    Will empty your cache.

    Install a firewall (Outpost or ZoneAlarm etc)
    Install anti-virus.
    Don't open e-mail attachments.

    Read the other posts on the subject, and edit your Hosts file as per
    instructions.
     
    Brian H¹©, Oct 8, 2003
    #2
    1. Advertising

  3. BroJack

    °Mike° Guest

    Yes, it's the QHosts trojan, which is evidenced by the
    redirection of the hosts file in the Help folder.

    The new beta HijackThis will detect and fix this problem.

    HijackThis
    http://www.tomcoyote.org/hjt/
    The new BETA (apparently stable)
    http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip


    On Wed, 08 Oct 2003 00:04:08 GMT, in
    <>
    BroJack scrawled:

    >Symptom: Inability to use Yahoo or Google to search the web
    >_____
    >Files show:
    >
    >Hosts C:\WINDOWS 1KB Sam File 4/23/99
    >
    >Lmhosts C:\WINDOWS 4KB Sam File 4/23/99
    >
    >hosts C:\WINDOWS 5KB File 10/1/03
    >
    >hosts C:\WINDOWS\HELP 5KB File 10/1/03
    >
    >Hosts C:\WINDOWS\Recent 1KB Shortcut 10/7/03
    >
    >Qhosts(1) C:\WINDOWS\Temporary Internet File\Content.IE5\4LEB816N
    >13KB HTML Document 10/7/03
    >______
    >
    >If this is Qhosts, please help me get rid of it.
    >
    >Jack
    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Oct 8, 2003
    #3
  4. BroJack

    °Mike° Guest

    On Wed, 8 Oct 2003 01:22:54 +0100, in
    <yNIgb.7894$>
    Brian H¹© scrawled:

    >BroJack said:
    >
    >> Symptom: Inability to use Yahoo or Google to search the web
    >> _____
    >> Files show:
    >>

    <snip>

    >> hosts C:\WINDOWS\HELP 5KB File 10/1/03

    >
    >^^^^^^^^^^^^ Help file


    Wrong. Qhosts redirects hosts to a new version in the
    Windows\Help folder.

    <snip>

    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Oct 8, 2003
    #4
  5. Why the hell do you reply and dont know what the fck you are talking about?


    "°Mike°" <> wrote in message
    news:...
    > Yes, it's the QHosts trojan, which is evidenced by the
    > redirection of the hosts file in the Help folder.
    >
    > The new beta HijackThis will detect and fix this problem.
    >
    > HijackThis
    > http://www.tomcoyote.org/hjt/
    > The new BETA (apparently stable)
    > http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip
    >
    >
    > On Wed, 08 Oct 2003 00:04:08 GMT, in
    > <>
    > BroJack scrawled:
    >
    > >Symptom: Inability to use Yahoo or Google to search the web
    > >_____
    > >Files show:
    > >
    > >Hosts C:\WINDOWS 1KB Sam File 4/23/99
    > >
    > >Lmhosts C:\WINDOWS 4KB Sam File 4/23/99
    > >
    > >hosts C:\WINDOWS 5KB File 10/1/03
    > >
    > >hosts C:\WINDOWS\HELP 5KB File 10/1/03
    > >
    > >Hosts C:\WINDOWS\Recent 1KB Shortcut 10/7/03
    > >
    > >Qhosts(1) C:\WINDOWS\Temporary Internet File\Content.IE5\4LEB816N
    > >13KB HTML Document 10/7/03
    > >______
    > >
    > >If this is Qhosts, please help me get rid of it.
    > >
    > >Jack
    > >

    >
    > --
    > Basic computer maintenance
    > http://uk.geocities.com/personel44/maintenance.html
     
    NewKillerStar, Oct 8, 2003
    #5
  6. BroJack

    Boomer Guest

    BroJack wrote:

    > Symptom: Inability to use Yahoo or Google to search the web
    > _____
    > Files show:
    >
    > Hosts C:\WINDOWS 1KB Sam File 4/23/99
    >
    > Lmhosts C:\WINDOWS 4KB Sam File 4/23/99
    >
    > hosts C:\WINDOWS 5KB File 10/1/03
    >
    > hosts C:\WINDOWS\HELP 5KB File 10/1/03
    >
    > Hosts C:\WINDOWS\Recent 1KB Shortcut 10/7/03
    >
    > Qhosts(1) C:\WINDOWS\Temporary Internet File\Content.IE5\4LEB816N
    > 13KB HTML Document 10/7/03
    > ______
    >
    > If this is Qhosts, please help me get rid of it.
    >
    > Jack



    You'd have to open up your HOST file with note pad and edit.

    This should help.

    http://www.microsoft.com/security/security_bulletins/ms03-040.asp
     
    Boomer, Oct 8, 2003
    #6
  7. BroJack

    Boomer Guest

    BroJack wrote:

    > Symptom: Inability to use Yahoo or Google to search the web
    > _____
    > Files show:
    >
    > Hosts C:\WINDOWS 1KB Sam File 4/23/99
    >
    > Lmhosts C:\WINDOWS 4KB Sam File 4/23/99
    >
    > hosts C:\WINDOWS 5KB File 10/1/03
    >
    > hosts C:\WINDOWS\HELP 5KB File 10/1/03
    >
    > Hosts C:\WINDOWS\Recent 1KB Shortcut 10/7/03
    >
    > Qhosts(1) C:\WINDOWS\Temporary Internet File\Content.IE5\4LEB816N
    > 13KB HTML Document 10/7/03
    > ______
    >
    > If this is Qhosts, please help me get rid of it.
    >
    > Jack


    Also
    http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts
    ..html#technicaldetails
     
    Boomer, Oct 8, 2003
    #7
  8. BroJack

    °Mike° Guest

    And just which little troll-ette would you be, then?


    On Tue, 7 Oct 2003 20:29:27 -0400, in
    <>
    NewKillerStar scrawled:

    >Why the hell do you reply and dont know what the fck you are talking about?
    >
    >
    >"°Mike°" <> wrote in message
    >news:...
    >> Yes, it's the QHosts trojan, which is evidenced by the
    >> redirection of the hosts file in the Help folder.
    >>
    >> The new beta HijackThis will detect and fix this problem.
    >>
    >> HijackThis
    >> http://www.tomcoyote.org/hjt/
    >> The new BETA (apparently stable)
    >> http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip
    >>
    >>
    >> On Wed, 08 Oct 2003 00:04:08 GMT, in
    >> <>
    >> BroJack scrawled:
    >>
    >> >Symptom: Inability to use Yahoo or Google to search the web
    >> >_____
    >> >Files show:
    >> >
    >> >Hosts C:\WINDOWS 1KB Sam File 4/23/99
    >> >
    >> >Lmhosts C:\WINDOWS 4KB Sam File 4/23/99
    >> >
    >> >hosts C:\WINDOWS 5KB File 10/1/03
    >> >
    >> >hosts C:\WINDOWS\HELP 5KB File 10/1/03
    >> >
    >> >Hosts C:\WINDOWS\Recent 1KB Shortcut 10/7/03
    >> >
    >> >Qhosts(1) C:\WINDOWS\Temporary Internet File\Content.IE5\4LEB816N
    >> >13KB HTML Document 10/7/03
    >> >______
    >> >
    >> >If this is Qhosts, please help me get rid of it.
    >> >
    >> >Jack
    >> >

    >>
    >> --
    >> Basic computer maintenance
    >> http://uk.geocities.com/personel44/maintenance.html

    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Oct 8, 2003
    #8
  9. No troll, just someone with a bit of pc knowledge..anyone not as smart as
    you think you are a troll?

    "°Mike°" <> wrote in message
    news:...
    > And just which little troll-ette would you be, then?
    >
    >
    > On Tue, 7 Oct 2003 20:29:27 -0400, in
    > <>
    > NewKillerStar scrawled:
    >
    > >Why the hell do you reply and dont know what the fck you are talking

    about?
    > >
    > >
    > >"°Mike°" <> wrote in message
    > >news:...
    > >> Yes, it's the QHosts trojan, which is evidenced by the
    > >> redirection of the hosts file in the Help folder.
    > >>
    > >> The new beta HijackThis will detect and fix this problem.
    > >>
    > >> HijackThis
    > >> http://www.tomcoyote.org/hjt/
    > >> The new BETA (apparently stable)
    > >> http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip
    > >>
    > >>
    > >> On Wed, 08 Oct 2003 00:04:08 GMT, in
    > >> <>
    > >> BroJack scrawled:
    > >>
    > >> >Symptom: Inability to use Yahoo or Google to search the web
    > >> >_____
    > >> >Files show:
    > >> >
    > >> >Hosts C:\WINDOWS 1KB Sam File 4/23/99
    > >> >
    > >> >Lmhosts C:\WINDOWS 4KB Sam File 4/23/99
    > >> >
    > >> >hosts C:\WINDOWS 5KB File 10/1/03
    > >> >
    > >> >hosts C:\WINDOWS\HELP 5KB File 10/1/03
    > >> >
    > >> >Hosts C:\WINDOWS\Recent 1KB Shortcut 10/7/03
    > >> >
    > >> >Qhosts(1) C:\WINDOWS\Temporary Internet File\Content.IE5\4LEB816N
    > >> >13KB HTML Document 10/7/03
    > >> >______
    > >> >
    > >> >If this is Qhosts, please help me get rid of it.
    > >> >
    > >> >Jack
    > >> >
    > >>
    > >> --
    > >> Basic computer maintenance
    > >> http://uk.geocities.com/personel44/maintenance.html

    > >

    >
    > --
    > Basic computer maintenance
    > http://uk.geocities.com/personel44/maintenance.html
     
    NewKillerStar, Oct 8, 2003
    #9
  10. BroJack

    °Mike° Guest

    Your reaction was troll-like. If you are not a troll, then please
    explain, in detail, your comment, and provide proof that I
    "dont know what the fck" I'm talking about. Either that,
    or STFU.


    On Tue, 7 Oct 2003 21:01:18 -0400, in
    <>
    NewKillerStar scrawled:

    >No troll, just someone with a bit of pc knowledge..anyone not as smart as
    >you think you are a troll?
    >
    >"°Mike°" <> wrote in message
    >news:...
    >> And just which little troll-ette would you be, then?
    >>
    >>
    >> On Tue, 7 Oct 2003 20:29:27 -0400, in
    >> <>
    >> NewKillerStar scrawled:
    >>
    >> >Why the hell do you reply and dont know what the fck you are talking

    >about?
    >> >
    >> >
    >> >"°Mike°" <> wrote in message
    >> >news:...
    >> >> Yes, it's the QHosts trojan, which is evidenced by the
    >> >> redirection of the hosts file in the Help folder.
    >> >>
    >> >> The new beta HijackThis will detect and fix this problem.
    >> >>
    >> >> HijackThis
    >> >> http://www.tomcoyote.org/hjt/
    >> >> The new BETA (apparently stable)
    >> >> http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip
    >> >>
    >> >>
    >> >> On Wed, 08 Oct 2003 00:04:08 GMT, in
    >> >> <>
    >> >> BroJack scrawled:
    >> >>
    >> >> >Symptom: Inability to use Yahoo or Google to search the web
    >> >> >_____
    >> >> >Files show:
    >> >> >
    >> >> >Hosts C:\WINDOWS 1KB Sam File 4/23/99
    >> >> >
    >> >> >Lmhosts C:\WINDOWS 4KB Sam File 4/23/99
    >> >> >
    >> >> >hosts C:\WINDOWS 5KB File 10/1/03
    >> >> >
    >> >> >hosts C:\WINDOWS\HELP 5KB File 10/1/03
    >> >> >
    >> >> >Hosts C:\WINDOWS\Recent 1KB Shortcut 10/7/03
    >> >> >
    >> >> >Qhosts(1) C:\WINDOWS\Temporary Internet File\Content.IE5\4LEB816N
    >> >> >13KB HTML Document 10/7/03
    >> >> >______
    >> >> >
    >> >> >If this is Qhosts, please help me get rid of it.
    >> >> >
    >> >> >Jack
    >> >> >
    >> >>
    >> >> --
    >> >> Basic computer maintenance
    >> >> http://uk.geocities.com/personel44/maintenance.html
    >> >

    >>
    >> --
    >> Basic computer maintenance
    >> http://uk.geocities.com/personel44/maintenance.html

    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Oct 8, 2003
    #10
  11. BroJack

    BroJack Guest

    On 08 Oct 2003 00:37:35 GMT, Boomer <>
    wrote:

    >BroJack wrote:
    >
    >> Symptom: Inability to use Yahoo or Google to search the web
    >> _____
    >> Files show:
    >>
    >> Hosts C:\WINDOWS 1KB Sam File 4/23/99
    >>
    >> Lmhosts C:\WINDOWS 4KB Sam File 4/23/99
    >>
    >> hosts C:\WINDOWS 5KB File 10/1/03
    >>
    >> hosts C:\WINDOWS\HELP 5KB File 10/1/03
    >>
    >> Hosts C:\WINDOWS\Recent 1KB Shortcut 10/7/03
    >>
    >> Qhosts(1) C:\WINDOWS\Temporary Internet File\Content.IE5\4LEB816N
    >> 13KB HTML Document 10/7/03
    >> ______
    >>
    >> If this is Qhosts, please help me get rid of it.
    >>
    >> Jack

    >
    >Also
    >http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts
    >.html#technicaldetails


    OK, but the manual removal instructions are difficult for us dumboes.

    They imply that you need to have some sort of anti-virus device on
    your PC even to remove Qhosts manually.

    Is that correct?

    Thanks,
    Jack
     
    BroJack, Oct 8, 2003
    #11
  12. BroJack

    Brian H¹© Guest

    BroJack said:

    > On 08 Oct 2003 00:37:35 GMT, Boomer <>
    > wrote:
    >
    >> BroJack wrote:
    >>
    >>> Symptom: Inability to use Yahoo or Google to search the web
    >>> _____
    >>> Files show:
    >>>
    >>> Hosts C:\WINDOWS 1KB Sam File 4/23/99
    >>>
    >>> Lmhosts C:\WINDOWS 4KB Sam File 4/23/99
    >>>
    >>> hosts C:\WINDOWS 5KB File 10/1/03
    >>>
    >>> hosts C:\WINDOWS\HELP 5KB File 10/1/03
    >>>
    >>> Hosts C:\WINDOWS\Recent 1KB Shortcut 10/7/03
    >>>
    >>> Qhosts(1) C:\WINDOWS\Temporary Internet File\Content.IE5\4LEB816N
    >>> 13KB HTML Document 10/7/03
    >>> ______
    >>>
    >>> If this is Qhosts, please help me get rid of it.
    >>>
    >>> Jack

    >>
    >> Also
    >> http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts
    >> .html#technicaldetails

    >
    > OK, but the manual removal instructions are difficult for us dumboes.
    >
    > They imply that you need to have some sort of anti-virus device on
    > your PC even to remove Qhosts manually.
    >
    > Is that correct?
    >
    > Thanks,
    > Jack


    Do you mean to say that you _don't_ have anti-virus installed on your pc?
     
    Brian H¹©, Oct 8, 2003
    #12
  13. BroJack

    Boomer Guest

    BroJack wrote:

    > On 08 Oct 2003 00:37:35 GMT, Boomer
    > <> wrote:
    >
    >>BroJack wrote:
    >>
    >>> Symptom: Inability to use Yahoo or Google to search the web
    >>> _____

    [snip]
    >>> If this is Qhosts, please help me get rid of it.
    >>>
    >>> Jack

    >>
    >>Also
    >>http://securityresponse.symantec.com/avcenter/venc/data/trojan.qh
    >>osts .html#technicaldetails

    >
    > OK, but the manual removal instructions are difficult for us
    > dumboes.
    >
    > They imply that you need to have some sort of anti-virus device
    > on your PC even to remove Qhosts manually.
    >
    > Is that correct?
    >
    > Thanks,
    > Jack


    Hi

    Go towards the bottom of the page
    http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts
    ..html

    Look for #5 "Reversing the changes made to the Hosts file"
    As the instructions say, find you Hosts file on your had drive. Open
    it with notepad and remove the entries listed in the above link.
     
    Boomer, Oct 8, 2003
    #13
  14. BroJack

    Guest

    Boomer <> wrote in message news:<3f840d85$0$205$>...
    > BroJack wrote:
    >
    > > On 08 Oct 2003 00:37:35 GMT, Boomer
    > > <> wrote:
    > >
    > >>BroJack wrote:
    > >>
    > >>> Symptom: Inability to use Yahoo or Google to search the web
    > >>> _____

    > [snip]
    > >>> If this is Qhosts, please help me get rid of it.
    > >>>
    > >>> Jack
    > >>
    > >>Also
    > >>http://securityresponse.symantec.com/avcenter/venc/data/trojan.qh
    > >>osts .html#technicaldetails

    > >
    > > OK, but the manual removal instructions are difficult for us
    > > dumboes.
    > >
    > > They imply that you need to have some sort of anti-virus device
    > > on your PC even to remove Qhosts manually.
    > >
    > > Is that correct?
    > >
    > > Thanks,
    > > Jack

    >
    > Hi
    >
    > Go towards the bottom of the page
    > http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts
    > .html
    >
    > Look for #5 "Reversing the changes made to the Hosts file"
    > As the instructions say, find you Hosts file on your had drive. Open
    > it with notepad and remove the entries listed in the above link.


    IT WORKED! IT REALLY WORKED!! I can google and yahoo again!

    Thank you, Mr. Boomer.

    BroJack
     
    , Oct 8, 2003
    #14
  15. BroJack

    Boomer Guest

    wrote:

    > Boomer <> wrote in message

    [snip]
    >> Hi
    >>
    >> Go towards the bottom of the page
    >> http://securityresponse.symantec.com/avcenter/venc/data/trojan.q
    >> hosts .html
    >>
    >> Look for #5 "Reversing the changes made to the Hosts file"
    >> As the instructions say, find you Hosts file on your had drive.
    >> Open it with notepad and remove the entries listed in the
    >> above link.

    >
    > IT WORKED! IT REALLY WORKED!! I can google and yahoo again!
    >
    > Thank you, Mr. Boomer.
    >
    > BroJack


    Ms.Boomer. ;)

    You're welcome.
     
    Boomer, Oct 8, 2003
    #15
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Harrison

    QHOSTS Trojan Spread Through Pop-Up Ads

    Harrison, Oct 3, 2003, in forum: Computer Support
    Replies:
    4
    Views:
    606
    slumpy
    Oct 3, 2003
  2. Dr. Compynei

    Playing a sound like MS does?

    Dr. Compynei, Feb 15, 2005, in forum: Computer Support
    Replies:
    3
    Views:
    931
    Dr. Compynei
    Feb 16, 2005
  3. MB_

    Does this sound like a hardware problem??

    MB_, Sep 13, 2005, in forum: Computer Support
    Replies:
    13
    Views:
    1,444
  4. Allen
    Replies:
    3
    Views:
    932
  5. Ray Tracer
    Replies:
    1
    Views:
    432
    Sydney Assbasket
    Aug 22, 2003
Loading...

Share This Page