Forum Moderators: open
whenever i use internet explorer, and type in www.google.com, it will automatically redirects me to www.cpanel.net with a message "There is no website configured at this address". This is the only website that I'm having problems gettin through. And the weirdest part is, when I use my AOL browser, it works fine. I tried deleting all the files in the cache, and cookies. I scanned for any virus and didn't find any, and searched for any file that has the word 'cpanel' in it, and found 1 html document and deleted it, but that didn't do anything. I even uninstalled and reinstalled Internet Explorer 6.0 but that didn't do the job neither. My co-worker told me to delete the file named 'hosts' in the c:/windows/system32/drivers/etc/ but it didn't help me neither.
Please, I really really need your help.
I viewed the source, and this is what's exactly in there:
<HTML>
<HEAD>
<TITLE>cPanel</TITLE>
<link href="sys_cpanel/css/style.css" rel="stylesheet" type="text/css">
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
</HEAD>
<SCRIPT LANGUAGE = "JavaScript">
<!--
function openWin(URL) {
aWindow=window.open(URL,"","scrollbars=yes,resizable=yes,fullscreen=no,
toolbar=no,status=no,menubar=no,directories=no,location=no,
height=500,width=800,left=200,top=100");
}
// -->
</SCRIPT>
<BODY leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr valign="top">
<td height="75" nowrap>
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="10%"><a href="http://www.cpanel.net"><img src="sys_cpanel/images/index_01.gif" width="126" height="46" alt="cPanel" border=0></a></td>
<td width="27%"><img src="sys_cpanel/images/index_02.gif" width="343" height="46"></td>
<td width="1%" background="sys_cpanel/images/index_04.gif"><img src="sys_cpanel/images/index_04.gif" width="43" height="46"></td>
<td width="62%" align="right" background="sys_cpanel/images/index_04.gif"><img src="sys_cpanel/images/index_03.gif" width="138" height="46"></td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<center>
<font class="verybigorangebold">
There is no website configured at this address.
</font>
</center>
<br><br>
<table width=100%>
<tr>
<td width=50% align=center><font class=biglink><a href="/cpanel/">cPanel</a></font></td>
<td width=50% align=center><font class=biglink><a href="/whm/">Web Host Manager</a></font></td>
</tr>
</table>
<br><br>
</td>
</tr>
<tr>
<td height="10">
<table width="100%" border="0" cellspacing="0" cellpadding="0" background="sys_cpanel/images/bbg.gif">
<tr align="center">
<td background="sys_cpanel/images/bbg.gif"><img src="sys_cpanel/images/bbg.gif" width="179" height="22"></td>
<td background="sys_cpanel/images/bbg.gif"><img src="sys_cpanel/images/bottom_label.gif" width="382" height="22"></td>
<td background="sys_cpanel/images/bbg.gif"><img src="sys_cpanel/images/bbg.gif" width="179" height="22"></td>
</tr>
</table>
</td>
</tr>
</table>
<!--- REVISION: 1.0.0 --->
</BODY>
</HTML>
[edited by: Marcia at 12:19 am (utc) on Oct. 7, 2003]
#1) Reformat your hard drive.
#2) Just use google.ca, google.de, etc. as a workaround.
A little OT, are you using a static IP address? Were you running any type of automated queries (software) on Google's database during the time that you lost access or shortly beforehand?
I'm not to sure why cPanel would end up as a link for spyware or scumware. The above suggestions are definitely the first things you should look at. cPanel is a fairly reputable windows control panel for IIS and I just can't imagine that they would be involved with spyware.
There are bugs in versions lower than IE6 where you can get downloads without having to accept them. If it's only in IE and not other browsers, it doesn't make sense that it's not connected to IE in some way.
What version of IE are you using?
marcia - if you're asking me, im using ie 6
pageoneresults - thanks. im not familiar with the lingo, but im on a network. and will you give me some examples of automated queries?
rfgdxm1 - tried goin to google.de and .ca, and still it redirected me to cpanel.
plasma - i have antivirus, aparently, its not workin too well... grrrrrrrrrr. and thanks for the url's. i just did a scan through housecall and it didn't find any virus. i really don't get it.
ok few more questions people:
a.) how come google is the only website im having problems with when using ie? i mean, i can access it fine in AOL browser.
b.) why didn't norton detect the virus when i did a scan?
c.) what is a scumware?
thanks for all your help.
I've come across it four times today alone.
Symantec has some info on it:
[securityresponse.symantec.com...]
In one case, it sent my client to the White House website, in another it just produced blank pages, in the fourth case, it produced a "you can't get there form here" webpage.
It won't hurt to take a look, anyway.
Serenata
That's where my problem file was located. Once I deleted that, everything worked fine. None of the three scumware programs I used found it.
serena - thanks for the suggestion. will do right away.
Yep, and I did. The one in windows\help was the virus culprit. It listed the IPs of tons of search engines in order to redirect you. I was only redirected to www2.google.com, but it immediately stopped when I deleted that hosts file.
i just fixed it last night, and i wouldn't have done it if it weren't for all of your suggestions, and i thank you all so much.
now ncysaint, did you look for the hosts file in your system?
88.88.88 elite <<this IP # is listed once
207.44.220.30 www.google.akadns.net <<< this IP # is listed over 100 times with every single search engine web address.
I am sorry I am being so detailed, but I was going crazy looking for the problem and I just couldnt find anything until I got here...Hopefully this will help someone else.
I cant thank you enough..
Thanks for the help
I was helping someone with this...
thanks
More info:
[f-secure.com...]
I had this very problem Google redirecing to cpanel. I followed your advice. Found the anoying "hosts" file. I Deleated the files and hey presto!
Once I had rebooted problem solved.
It's worth noting that the fix Qhost tool by symantic does not find the problem (well not in my case.)
Looking through the host's file they have missed out www.lycos.co.uk (although the dot com is blocked) this was a life line for me - it helped me find your forum.
Thanks again guys
Keep up the good work
Chris_D
Symantec has received reports that visiting a specific page on fortunecity-com caused a popup to be displayed that redirected the visitor to a different web page. Being redirected to the web page appears to have caused the trojan to be downloaded to a visitor's system and then executed.
I don't wan't to point any fingers in their direction, with out proof so if anyone has any other ideas I'll happily eat humble pie.
Had already deleted hosts but thanks to this post deleted the one found in \windows\help and installed the Microsoft patch and now all is fine.
Thanks for your help guys
-Chris
