Browser hijacked Google.com

Hi,

Say, I have an ugly virus that I can not find a solution
to. I have tried Ad-aware, Sybot, Hijackthis, etc. and
am still unable to resolve this issue.

Problem: The IP for Google.com is being translated into
wrong entry. If I "nslookup" Google it returns the right
value but if I "ping" or use any other program to access
Google the wrong IP is used. My "hosts" and "lmhosts"
files are empty. How is the IP getting changed? Also,
entrys in the "hosts" file do not appear to be working.
Maybe they changed the location/name of it.

Data: I am using Windows XP Professional. The bad IP it
is trying to accesss is "207.44.220.30" which "nslookup"
says is "ns1.sitething.net".

Sure would appreciate any insite into this issue. Thank
you in advance for any help provided.

Dan

> Say, I have an ugly virus that I can not find a solution

> to. I have tried Ad-aware, Sybot, Hijackthis, etc. and
> am still unable to resolve this issue.
>
> Problem: The IP for Google.com is being translated into
> wrong entry. If I "nslookup" Google it returns the right
> value but if I "ping" or use any other program to access
> Google the wrong IP is used. My "hosts" and "lmhosts"
> files are empty. How is the IP getting changed? Also,
> entrys in the "hosts" file do not appear to be working.
> Maybe they changed the location/name of it.
>
> Data: I am using Windows XP Professional. The bad IP it
> is trying to accesss is "207.44.220.30" which "nslookup"
> says is "ns1.sitething.net".
>
> Sure would appreciate any insite into this issue. Thank
> you in advance for any help provided.

http://securityresponse.symantec.com...an.qhosts.html

have you checked if it could be QHOSTS virus? there should be more info
regarding it on symantec site.

>
> Dan

I am having the same problem. I have run the utilities
that Dan mentioned, but the problem still exist. Help,
please!

>-----Original Message-----

solution

into

right

access

it

which "nslookup"

Thank

>
>http://securityresponse.symantec.com...er/venc/data/t

rojan.qhosts.html

>
>have you checked if it could be QHOSTS virus? there

should be more info

>regarding it on symantec site.
>

>
>
>.
>

Occasionally seen something like this when the proxy settings were not
correct. No guarantees though.
Dave
"Wÿrm" <nomailstodragon@north.com> wrote in message
news:bm4567$okc$1@phys-news1.kolumbus.fi...

>
> http://securityresponse.symantec.com...an.qhosts.html
>
> have you checked if it could be QHOSTS virus? there should be more info
> regarding it on symantec site.
>

>
>

I haven't seen any more info on this, but I was having the same
problem and I found a host file in C:\\WINNT\help that redirected all
search inquiries to 207.44.220.30. After deleting that file, my
browser is now able to access google et al.

-ghundi



"Dan" <vjmail@comcast.net> wrote in message news:<00c501c38e87$b0d3de30$a401280a@phx.gbl>...

> Hi,
>
> Say, I have an ugly virus that I can not find a solution
> to. I have tried Ad-aware, Sybot, Hijackthis, etc. and
> am still unable to resolve this issue.
>
> Problem: The IP for Google.com is being translated into
> wrong entry. If I "nslookup" Google it returns the right
> value but if I "ping" or use any other program to access
> Google the wrong IP is used. My "hosts" and "lmhosts"
> files are empty. How is the IP getting changed? Also,
> entrys in the "hosts" file do not appear to be working.
> Maybe they changed the location/name of it.
>
> Data: I am using Windows XP Professional. The bad IP it
> is trying to accesss is "207.44.220.30" which "nslookup"
> says is "ns1.sitething.net".
>
> Sure would appreciate any insite into this issue. Thank
> you in advance for any help provided.
>
> Dan