Qhost or something else??

Discussion in 'Computer Support' started by Blobby J Blobdom, Oct 9, 2003.

  1. Howdo,

    For the last couple of days nobody on our network can see
    www.msn.co.uk

    Just get a "Page cannot be displayed error'

    We have an ADSL connection to a Win2K server, then Win2K clients are
    connecting thru DHCP.

    Have patched everything with Microsoft Update, and read and follow
    security bulletins wrt to Qhost which was my first thought for this.
    Still same problem though :-(

    Have scanned with Ad-Aware, which didnt find much.

    We CAN see sites such as google, yahoo, altavista, just NOT msn.co.uk

    Any clues???

    Thanks :)
     
    Blobby J Blobdom, Oct 9, 2003
    #1
    1. Advertisements

  2. Blobby J Blobdom

    Boomer Guest

    What is in your Hosts file?

    I can't get to http://www.msn.co.uk/ because of something in my Hosts
    file having to do with this:
    amch.questionmarket.com/adsc/d123922/2/143081/randm.js
     
    Boomer, Oct 9, 2003
    #2
    1. Advertisements

  3. Only thing in hosts file is....

    127.0.0.1 localhost
     
    Blobby J Blobdom, Oct 10, 2003
    #3
  4. Blobby J Blobdom

    Brian H¹© Guest

    Blobby J Blobdom said:
    No that is the Hosts.sam file, a sample file.
    If you don't have a file called Hosts (no extension) in that same folder , then
    you don't have a Hosts file.
     
    Brian H¹©, Oct 10, 2003
    #4
  5. No, that IS my hosts file.....

    Directory of C:\WINDOWS\system32\drivers\etc

    27/09/2002 01:03 <DIR> .
    27/09/2002 01:03 <DIR> ..
    29/08/2002 13:00 734 hosts <===== THIS FILE!
    29/08/2002 13:00 3,683 lmhosts.sam
    29/08/2002 13:00 407 networks
    29/08/2002 13:00 799 protocol
    29/08/2002 13:00 7,116 services
    5 File(s) 12,739 bytes

    :)
     
    Blobby J Blobdom, Oct 10, 2003
    #5
  6. Blobby J Blobdom

    nemo Guest

    You've had this argument before and you were wrong then and you are
    wrong now. On this system and another that I checked yesterday (both
    win2k) there is the file host (yes that's host with no extension)
    with the only entry:

    127.0.0.1 localhost.

    Regards

    nemo
     
    nemo, Oct 10, 2003
    #6
  7. Blobby J Blobdom

    Boomer Guest

    Hi

    Are you still having problems?

    If so read through these links:

    Trojan.Qhosts
    http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts
    ..html
    Or click: http://makeashorterlink.com/?M1B332226
    Trojan.Qhosts Removal Tool
    http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts
    ..removal.tool.html

    Security Update for Microsoft Internet Explorer October 3, 2002
    http://www.microsoft.com/security/security_bulletins/ms03-040.asp

    "Are You Trying To Get To Google?"
    http://www.spywareinfo.net/sept30,2003#searchjack
    http://www.spywareinfo.com/newsletter/archives/1003/7.php


    HiJack This
    http://www.spywareinfo.com/~merijn/files/hijackthis.zip
     
    Boomer, Oct 11, 2003
    #7
  8. Used the Symantec Qhosts removal tool - it found nothing.

    Ive got all MS patches.

    I CAN get other search engines - google,altavista,lycos,etc

    Just NOT msn.co.uk!!!

    Its weird....

    <scratches head>
     
    Blobby J Blobdom, Oct 13, 2003
    #8
  9. Blobby J Blobdom

    Boomer Guest

    Will it work if you enter this? 213.199.154.54

    Have you cleaned out your cache, history, temp etc. files?
     
    Boomer, Oct 13, 2003
    #9
  10. Blobby J Blobdom, Oct 13, 2003
    #10
  11. Blobby J Blobdom

    Boomer Guest

    I went here to get the address http://www.canufly.net/~georgegg/dns/
    You said you scanned with Ad-Aware. What version and do you have the
    newest Ad-Aware ref file?

    Have you tried these?

    SpybotSD Aims for the dialers, trojans, hijackers and
    security/privacy issues.
    http://www.safer-networking.org/

    Spyware Blaster
    http://www.wilderssecurity.net/spywareblaster.html

    A-spy For trojans hiding in startup entries.
    http://vipmeister.com/dl/aspy/aspy.html

    HiJack This
    http://www.spywareinfo.com/~merijn/files/hijackthis.zip
     
    Boomer, Oct 13, 2003
    #11
  12. Using Ad-Aware 6.0 build 6.181
    Ref File is 01R225, dated 13th Oct
    Just done a fresh scan.
    Tried this too. Just grabbing the others to try them....
     
    Blobby J Blobdom, Oct 14, 2003
    #12
  13. And they've drawn a blank too.

    :-(
     
    Blobby J Blobdom, Oct 14, 2003
    #13
  14. Blobby J Blobdom

    Boomer Guest

    What did "HiJack This" report?
     
    Boomer, Oct 14, 2003
    #14
  15. AHA!

    Now we're getting somewhere!!

    Our W2K server is setup to provide local DNS.

    However, changing DNS lookup to use DNS over at our ISP instead and
    BINGO! we get a result!

    So its obvious the DNS on our box this end is stuffed.

    As a temporary measure we'll use the ISP's DNS until I can take some
    action on the server at the weekend.

    Thanks for all your help!!!

    :)

    James
     
    Blobby J Blobdom, Oct 15, 2003
    #15
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.