NEW Virus

Mark W · 02-10-2003, 19:27

just so you guys know, tech support are getting a fair few of these -

Symantec have dubbed this virus Trojan.Qhosts aka QHosts-1 [McAfee], VBS.QHOSTS [CA]

This virus effects various parts of the machine .

However the main concern for us is that it changes the DNS settings to apparently non working DNS servers = no browsing.

The quickest way to spot this virus is to check the DNS settings.

For 2k / XP

Click Start -> Run
type CMD
In the new window type ipconfig
look at the DNS servers entry.
This should say

DNS Servers . . . . . . . . : 194.168.4.100
194.168.8.100

However if the Trojan.Qhost virus is there this entry will start with either 69.57.XXX.XXX or 216.127.XXX.XXX

Alan Waddington · 02-10-2003, 19:39

Thanks,

Looks like a lot of repair work if it attacks. And its not in my current virus defs.

Nemesis · 02-10-2003, 19:40

Quote:

Originally Posted by Alan Waddington

Thanks,

Looks like a lot of repair work if it attacks. And its not in my current virus defs.

Nor mine, just tried Liveupdate and nothing new ?!?!?!?!

MovedGoalPosts · 02-10-2003, 19:55

My AV supplier www.pandasoftware.co.uk doesnt list that name. They do however show a similar effect virus detected a few days ago

Trojan:HATOY.A

It too changes the DNS settings although the address given is different: 207.44.220.30

Mark W · 02-10-2003, 19:57

Quote:

Originally Posted by Nemesis

Nor mine, just tried Liveupdate and nothing new ?!?!?!?!

lol, some of our tech support guys picked this up yesterday - well before symantech

albone · 02-10-2003, 19:58

Hope I am up to date got a live update this morning, but can't aford another refit!

Alan Waddington · 02-10-2003, 20:04

Liveupdate doesn't have the definition - appears to be only in the daily instant updates - since there is no patch on Micro$oft to fix the hole, I'm installing the instant update - I'll let you know how i got on

/edit I downloaded the file, ran it & it said it updated the defs - but still no change as far as i can see - going for a reboot. See you in 5 mins

/edit still no joy - don't know what i'm doing wrong

/edit I've found the problem - the front page says the intelligent updater file was updated on the 2nd Oct, but when i went to download it only a file from the 1st oct was available

02-10-2003, 20:07

Caugh Mcafee caugh

02-10-2003, 21:12

Quote:

Originally Posted by Defiant

Caugh Mcafee caugh

Yup.... mcafee had it listed a couple of days ago....
Oh and is that a Salford *cough* you've got there Defiant?

Sounds like you need a little antivirus protection yourself :p

Shaun · 02-10-2003, 21:42

This intelligent update file has it in

http://securityresponse.symantec.com...es/US-N95.html

Thats for XP

Alan Waddington · 02-10-2003, 21:57

Quote:

Originally Posted by dellwear

This intelligent update file has it in

http://securityresponse.symantec.com...es/US-N95.html

Thats for XP

That did the job nicely

MadGamer · 02-10-2003, 22:22

Quote:

Originally Posted by Nemesis

Nor mine, just tried Liveupdate and nothing new ?!?!?!?!

Just updated my virus definations.