Dismiss Notice
Join Physics Forums Today!
The friendliest, high quality science and math community on the planet! Everyone who loves science is here!

Search engine problem

  1. Apr 28, 2004 #1
    Ive lived with this for ages now, and im kinda used to it. But now that ive stumbled upon this wonderful little forum here i was wonder if anyone could tell me why non/very few of the most common search engines will work on my PC?

    Heres what gets returned to me when i enter most sires such as Google etc.

    "404 Error Page Not Found

    A message from Server Admin: Some people have reported arriving at our error page after typing in or clicking a link to a major search engine. After extensive research into the issue we have found that one of our server I.P. addresses has been targeted by a virus which you may have on your computer called "QHosts". This virus was made several months before we were allocated the server I.P. addresses we have now, and therefore we have no control over it (much to our dismay as it causes disruption to our servers on a regular basis, however it is gradually diminishing.) The Microsoft cumulative patch for this vulnerability is available here.

    We have provided our links page below which contains, amongst other things, hyperlinks to some major engines, routed thru our own server which is not affected by the virus, so they work Ok. You are welcome to use these links, if you want to, until your own computer is working properly."

    Searching on msn etc and all the usual suspects tends to return the old 'The page cannot be found' page, and its been bugging me for a while now so any help in fixing would be most welcome.

  2. jcsd
  3. Apr 28, 2004 #2


    User Avatar

    Staff: Mentor

    Ikovian, it sounds like you may have been infected by the Qhosts Trojan.

    Here is what Symantic has to say: Trojan.Qhosts is a Trojan Horse that will modify the TCP/IP settings to point to a different DNS server.

    Trojan.Qhosts cannot spread by itself. For a computer to become infected, you would have to open an HTML page that contains code, which allows it to open a viral HTML file on the target computer, so that the script can create and run the malicious executable.

    Symantec Security Response has received reports that visiting a specific page on www.fortunecity.com caused a popup to be displayed that redirected the visitor to a different web page. Being redirected to the web page appears to have caused the trojan to be downloaded to a visitor's system and then executed.


    Go here to remove it: http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.removal.tool.html
  4. Apr 29, 2004 #3
    I second what Evo said.

    You are infected with Qhost for sure.

    Check your DNS addresses and make sure they are what they should be. Also, go to windowsupdate.com and update your machine (if you are running Windows that is,) patch MS03-040 adrresses this issue.

    Also, run a full virus scan on your machine if you have a virus protection program.

  5. Apr 29, 2004 #4
    Thanx for the help, im trying that removal tool now. cant remember ever visiting 'fortunecity' but fingers crossed that you're right :wink: . Ive been downloading ever windows update there is, particularly the security updates for sometime with no joy. I also have ran many scans with Norton anti-virus and not found a thing - god only knows why i pay for that, i thought it was meant to sort things like this out for me! :tongue: .
  6. Apr 29, 2004 #5
    "Trojan.Qhosts has not been found on your computer"... hmmmm :frown:

    Edit: also just checked my install history for windows update and i installed the relevant update sometime back in october 2003. once more i am at a loss. is it possible that it could still be this trojan but it just somehow slipped through the net?
    Last edited: Apr 29, 2004
  7. Apr 29, 2004 #6
    Check your DNS addresses and confirm they are the name servers of your ISP. If needed I can give you detailed instructions on how to do this.

    First try this though.... open your browser and type in this address this is the IP of google.com if you can hit google.com by using their IP and not by using their FQDN (Fully Qualified Domain Name, example www.domain.com) then you have an address resolution problem. DNS is used for resolving FQDNs into IP addresses which is why I am suggestion you check your DNS addresses. (Also you may need to check your HOSTS file)

    What type of environment are you in? If you are on a corporate Active Directive environment (or have internal DNS servers) then the problem may be on those DNS servers with wrong entrees in for the Host entries or A records.
    Last edited by a moderator: Apr 20, 2017
  8. Apr 30, 2004 #7
    Well blow me, that IP address worked like a treat. Thank you syano! I could search for stuff and everything. So what does that mean then? You might have to really break it down into layman type words in order for me to try and correct this, as frankly 'Check your DNS addresses and confirm they are the name servers of your ISP' might as well be Latin to me.

    My environment is... well it's just a half decent PC in the spare bedroom of a little semi-detached house by the sea, running windows xp, and obviously my browser is Microsoft Explorer. There’s no networking or anything like that, just a straightforward broadband connection. I wasn’t aware that I was on a corporate Active Directive environment (or have internal DNS servers), but if you think that this is probably the case then I couldn’t really disagree.

    So if you could pass on those intrusions you spoke of (like I say you might want to keep ‘em fairly simple) then ill certainly see what I can do with them.
  9. Apr 30, 2004 #8
    Good deal man… now we have the problem diagnosed.

    No, you are not on a corporate type of environment. I was asking that so we would know how to proceed.

    Step 1 Check you Host file.
    -Open Explorer (right click on your start bar and click Explorer)
    -Drill down to this path c:\systemfolder\system32\drivers\etc (where is systemfolder is the name of your system folder which is usually “windows” or “winnt”) Within this folder double click on the “hosts” file. Select “choose a program to open this file with” and then choose “notepad.” Once opened, scroll to the bottom passing all lines of text that start with a “#” character. The only entry you should see in this file will look like” localhost” If you see any others then delete them. If you see the words google.com in this file then we know for sure the issue is within this file. Close this file and save changes and then try and hit google.com (if any changes were made that is).

    Step 2 Check your DNS addresses
    -Open a command prompt (click “start” then “run” type “cmd” and then hit enter. A command prompt window will open. From here type in “ipconfig /all” and hit enter. Look for your DNS addresses and write down what they are. Also, look to see if DHCP is enabled or disabled. (If you are not able to see these addresses because the text scrolls down to fast and it all doesn’t fit on one page then type “ipconfig /all | more” and hit enter, this will pause the text before it runs off the page and you can press any key for it to show you the rest of the text.

    If DHCP is enabled then type “ipconfig /release” hit enter and wait a few seconds, then type “ipconfig /renew” hit enter and wait a few seconds. Then type “ipconfig /all” again and see if your DNS addresses have changed. If they have changed then you problem will most likely be resolved.

    If your DNS addresses do not change, then proceed to the next paragraph. Even though you may have DHCP enabled there still may be DNS addresses statically entered into your TCP/IP properties page.

    If DHCP is disabled, then click “start,” “control panel,” “network connections,” then right click on “local Area Connection” and click “properties” then highlight “TCP/IP” and click “properties” and look at where is says, “Preferred DNS address and Alternate DNS address” and write down what the addresses are. Also, click on the “advance” button and then the “DNS” tab and see if there are any other DNS addresses listed. If there are then make note of them.

    Now you have to figure out what DNS addresses you should have listed. If you had more than 2 DNS addresses listed then you could figured out which one you should be using by process of elimination. Remove all but one (be sure to click “apply” and “ok” your way out of the property pages so the changes take affect) and try and hit google.com; if it doesn’t work then remove that DNS address and try another and check google.com again. Or you could call your ISP and ask them what the DNS addresses should be and plug those in.

    That’s it. This will work unless your ISP has faulty DNS server that they are not fixing (which in my opinion equates to a lousy ISP) If they do have faulty DNS servers then they should be able to give you alternate servers to use. I couldn’t imagine this being the case though. But who knows.

    In conclusion:
    Let me use an analogy… DNS servers are similar to phone books. You have a bum phone book that is giving you the wrong phone numbers when you look up someone to call. You need to remove that phone book and tell your computer a good phone book to use. Locate these bum phone books (bogus DNS or Host entries) and replace them with the correct phone books (correct DNS / domain name servers)

  10. Apr 30, 2004 #9
    Wow thats a whole lot of help right there, best get to work on this

    Well I hunted for that hosts file and the first thing i found was windows/help/hosts, which contained the following...

    " elite www.google.akadns.net[/URL] [url]www.google.com[/url] google.com [url]www.altavista.com[/url] altavista.com search.yahoo.com uk.search.yahoo.com ca.search.yahoo.com...
    ....blah blah blah... (::insert waste of forum space here::)
    ... google.com.ru google.com.sg [url]www.hotbot.com[/url] hotbot.com"

    Which, despite being nothing like you described, seemed interesting to me because it seems to list pretty much every search engine I’ve ever used... and a whole lot i haven’t, of all manner of types from various countries. anyway, back to the point...

    A little disappointed that it didn’t seem to match up i looked on, and found 'windows/I386/HOSTS'. This had all the crap hidden behind the '#' as you said, and the ' localhost' at the end to top it off.... actually this is gonna take a while to log everything I do down, and I have work in the morning so ill fly through these instructions and see how it goes.

    ...Well well, pure genius syano, thank you is all I can say. I’ve tried most of the above sites and they all seem to be working fine after I had a play around with DNS thingies in the TCP/IP properties section. Good job really coz I was beginning to worry by then since there weren’t a great deal more steps to follow.

    Many thanks again syano, but the morning draws ever nearer so I think Ill have to call it a thread for now. :biggrin: <--- satisfied customer

    PS:- What's 'HTH' stand for?
    Last edited by a moderator: Apr 20, 2017
  11. Apr 30, 2004 #10
    Pleasure dude...

    HTH = Hope this helps,
  12. May 1, 2004 #11
    Ah yes, it really did help. Thought it was like your name or something lol.
Share this great discussion with others via Reddit, Google+, Twitter, or Facebook