Google down?

Google seems to have gone down (or its DNS maybe) - there's a holding page from cPanel. First time I've ever seen it fail!

Rob

I have the google task bar loaded on IE6, and I was just able to do a search.

Strange, I can't.

Rob

Sure you haven't got that QHost virus/trojan going around?

http://www.theregister.co.uk/content/56/33187.html

edit: Here's teh Symantec page - they have a fix tool:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html

I think the latest "Critical" update might fix the vulnerability too. Apparently a banner on a FortuneCity site has been spreading it.

Gareth

Yep, that almost certainly is it. We got a bunch of people at my work hit by it as well.

That was it, thanks!

The wierd thing is I can't get the rogue google entries out of my DNS cache. There are a couple of dozen fake records such as:

go.google.com
----------------------------------------
Record Name . . . . . : go.google.com
Record Type . . . . . : 1
Time To Live . . . . : 601844
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 207.44.194.56

ipconfig /flushdns claims to have worked, but those records never go away. I thought they might have been in the hosts file but they're not.

Any ideas?

Rob

Reminds me of this post where everything in my hosts file point to Google...

You couldn't get Google, I couldn't get rid of it!

I just did a search and it seems there is another hosts file dropped in the %SystemRoot%\help folder and it sets that as the default hosts file.

Have you run the Symantec cleaner yet? It should reset all this back to the default values and delete the files:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.removal.tool.html

Gareth

Yay! That was it, the cleaner program does not remove the extra hosts file in winnt\help.

Rob