Qhost or something else??

Howdo,

For the last couple of days nobody on our network can see
www.msn.co.uk

Just get a "Page cannot be displayed error'

We have an ADSL connection to a Win2K server, then Win2K clients are
connecting thru DHCP.

Have patched everything with Microsoft Update, and read and follow
security bulletins wrt to Qhost which was my first thought for this.
Still same problem though :-(

Have scanned with Ad-Aware, which didnt find much.

We CAN see sites such as google, yahoo, altavista, just NOT msn.co.uk

Any clues???

Thanks

 

What is in your Hosts file?

I can't get to http://www.msn.co.uk/ because of something in my Hosts
file having to do with this:
amch.questionmarket.com/adsc/d123922/2/143081/randm.js

 

Only thing in hosts file is....

127.0.0.1 localhost

 

Blobby J Blobdom said:

No that is the Hosts.sam file, a sample file.
If you don't have a file called Hosts (no extension) in that same folder , then
you don't have a Hosts file.

 

No, that IS my hosts file.....

Directory of C:\WINDOWS\system32\drivers\etc

27/09/2002 01:03 <DIR> .
27/09/2002 01:03 <DIR> ..
29/08/2002 13:00 734 hosts <===== THIS FILE!
29/08/2002 13:00 3,683 lmhosts.sam
29/08/2002 13:00 407 networks
29/08/2002 13:00 799 protocol
29/08/2002 13:00 7,116 services
5 File(s) 12,739 bytes

 

You've had this argument before and you were wrong then and you are
wrong now. On this system and another that I checked yesterday (both
win2k) there is the file host (yes that's host with no extension)
with the only entry:

127.0.0.1 localhost.

Regards

nemo

 

Hi

Are you still having problems?

If so read through these links:

Trojan.Qhosts
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts
..html
Or click: http://makeashorterlink.com/?M1B332226
Trojan.Qhosts Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts
..removal.tool.html

Security Update for Microsoft Internet Explorer October 3, 2002
http://www.microsoft.com/security/security_bulletins/ms03-040.asp

"Are You Trying To Get To Google?"
http://www.spywareinfo.net/sept30,2003#searchjack
http://www.spywareinfo.com/newsletter/archives/1003/7.php


HiJack This
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

 

Used the Symantec Qhosts removal tool - it found nothing.

Ive got all MS patches.

I CAN get other search engines - google,altavista,lycos,etc

Just NOT msn.co.uk!!!

Its weird....

<scratches head>

 

Will it work if you enter this? 213.199.154.54

Have you cleaned out your cache, history, temp etc. files?

 

No.
That /tries/ to see
http://emealogin.msn.com/pplogin.asp?strRS=http://213.199.154.54/Default.asp
....but it doesnt make it. Just get "page cannot be displayed"

Is that the address your DNS is giving for www.msn.co.uk?
Mine is returning it as 207.46.28.49

Yup.

 

I went here to get the address http://www.canufly.net/~georgegg/dns/

You said you scanned with Ad-Aware. What version and do you have the
newest Ad-Aware ref file?

Have you tried these?

SpybotSD Aims for the dialers, trojans, hijackers and
security/privacy issues.
http://www.safer-networking.org/

Spyware Blaster
http://www.wilderssecurity.net/spywareblaster.html

A-spy For trojans hiding in startup entries.
http://vipmeister.com/dl/aspy/aspy.html

HiJack This
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

 

Using Ad-Aware 6.0 build 6.181
Ref File is 01R225, dated 13th Oct
Just done a fresh scan.

Tried this too. Just grabbing the others to try them....

 

And they've drawn a blank too.

:-(

 

What did "HiJack This" report?

 

AHA!

Now we're getting somewhere!!

Our W2K server is setup to provide local DNS.

However, changing DNS lookup to use DNS over at our ISP instead and
BINGO! we get a result!

So its obvious the DNS on our box this end is stuffed.

As a temporary measure we'll use the ISP's DNS until I can take some
action on the server at the weekend.

Thanks for all your help!!!



James