Trojans/spyware that make internet searches become slow?

[AL_n]

Are there any trojan or other spyware devices that might be making my
internet searches become slow? I've noticed that if I do a few searches
(using virtually any search engine), they become progressively slower, very
quickly. This has only happened to me over the past 6 months or so. I've
also found that searching eBay has become impossibly slow too.

On the other hand, I think all this started when I switched ISP's a few
months ago. Perhaps they have inadequate bandwidth for the amount of users
thay have...

I've run three spyware/trojan scanners and eradicated what they found, but
the problem persists unchanged.

TIA
Jake

[Virus Guy]

AL_n wrote:

> Are there any trojan or other spyware devices that might be making
> my internet searches become slow?

Check your hosts file.

You might have host file entries for search portal domains (like
google.com) that point to a third party that hijacks the search and
tries to do something with it (like generate extra ad revenue).

[AL_n]

Virus Guy <Virus@Guy.com> wrote in news:4ED2445B.E39B1797@Guy.com:

> AL_n wrote:
>
>> Are there any trojan or other spyware devices that might be making
>> my internet searches become slow?
>
> Check your hosts file.
>
> You might have host file entries for search portal domains (like
> google.com) that point to a third party that hijacks the search and
> tries to do something with it (like generate extra ad revenue).
>

Thanks. I looked at my Windows 7 host file. It has hundreds of one-line
entries, all 'inserted by Spybot - Search & Destroy'. Does that sound OK?
It means nothing to me, although I am familiar with SSD, which I run
occasionally.

Al

[~BD~]

AL_n wrote:
> Virus Guy<Virus@Guy.com> wrote in news:4ED2445B.E39B1797@Guy.com:
>
>> AL_n wrote:
>>
>>> Are there any trojan or other spyware devices that might be making
>>> my internet searches become slow?
>>
>> Check your hosts file.
>>
>> You might have host file entries for search portal domains (like
>> google.com) that point to a third party that hijacks the search and
>> tries to do something with it (like generate extra ad revenue).
>>
>
> Thanks. I looked at my Windows 7 host file. It has hundreds of one-line
> entries, all 'inserted by Spybot - Search& Destroy'. Does that sound OK?
> It means nothing to me, although I am familiar with SSD, which I run
> occasionally.
>
> Al

FYI - The 'hosts' may be reset to it's default state. Read here:-
http://support.microsoft.com/kb/972034

Perhaps it's worth a try and see if your current 'problems' are alleviated.

Good luck! :-)

[Virus Guy]

AL_n wrote:

> Are there any trojan or other spyware devices that might be making
> my internet searches become slow?

Another possibility:

The DNS server setting for you PC may have been changed to point to a
machine that will essentially accomplish the same ends as if your hosts
file was tampered with.

This may not be easily possible to do on a windows-7 machine, but if you
can, run the "nslookup" program that is buried somewhere on your system
and get the IP result for google.com (or what-ever you use to perform
searches).

If you tell us what your search URL is, and what your nslookup result
is, then we can tell you if your hosts file or DNS server setting is
suspect.

For example, if I perform an nslookup on "google.com", I get several
results:

74.125.226.80
74.125.226.81
74.125.226.82
74.125.226.83
74.125.226.84

The website IPtools.com gives these results:

173.194.64.99
173.194.64.103
173.194.64.104
173.194.64.105
173.194.64.106
173.194.64.147

The difference is probably a function of the DNS server being used, as
the google name servers seem to give a different result depending on
what machine is making the query.

If you open a command shell and issue the command "ipconfig /all" you'll
get a line saying what your DNS server(s) are. Either look them up
yourself, or post them here and we might be able to tell you if they're
legit or malicious.

[FromTheRafters]

"~BD~" <~BD~@nomail.afraid.org> wrote in message
news:jatqhr$6ha$1@dont-email.me...
> AL_n wrote:
>> Virus Guy<Virus@Guy.com> wrote in news:4ED2445B.E39B1797@Guy.com:
>>
>>> AL_n wrote:
>>>
>>>> Are there any trojan or other spyware devices that might be making
>>>> my internet searches become slow?
>>>
>>> Check your hosts file.
>>>
>>> You might have host file entries for search portal domains (like
>>> google.com) that point to a third party that hijacks the search and
>>> tries to do something with it (like generate extra ad revenue).
>>>
>>
>> Thanks. I looked at my Windows 7 host file. It has hundreds of one-line
>> entries, all 'inserted by Spybot - Search& Destroy'. Does that sound OK?
>> It means nothing to me, although I am familiar with SSD, which I run
>> occasionally.
>>
>> Al
>
> FYI - The 'hosts' may be reset to it's default state. Read here:-
> http://support.microsoft.com/kb/972034
>
> Perhaps it's worth a try and see if your current 'problems' are alleviated.
>
> Good luck! :-)

He could rename it hosts.old too. That way all that data isn't lost.

[~BD~]

FromTheRafters wrote:
> "~BD~"<~BD~@nomail.afraid.org> wrote in message
> news:jatqhr$6ha$1@dont-email.me...
>> AL_n wrote:
>>> Virus Guy<Virus@Guy.com> wrote in news:4ED2445B.E39B1797@Guy.com:
>>>
>>>> AL_n wrote:
>>>>
>>>>> Are there any trojan or other spyware devices that might be making
>>>>> my internet searches become slow?
>>>>
>>>> Check your hosts file.
>>>>
>>>> You might have host file entries for search portal domains (like
>>>> google.com) that point to a third party that hijacks the search and
>>>> tries to do something with it (like generate extra ad revenue).
>>>>
>>>
>>> Thanks. I looked at my Windows 7 host file. It has hundreds of one-line
>>> entries, all 'inserted by Spybot - Search& Destroy'. Does that sound OK?
>>> It means nothing to me, although I am familiar with SSD, which I run
>>> occasionally.
>>>
>>> Al
>>
>> FYI - The 'hosts' may be reset to it's default state. Read here:-
>> http://support.microsoft.com/kb/972034
>>
>> Perhaps it's worth a try and see if your current 'problems' are alleviated.
>>
>> Good luck! :-)
>
> He could rename it hosts.old too. That way all that data isn't lost.
>
>

Indeed! :-)

In fact, at that very link I posted, it says, at step 2.:-

"Rename the Hosts file to Hosts.old".

[David H. Lipman]

From: "Virus Guy" <Virus@Guy.com>

> AL_n wrote:
>
>> Are there any trojan or other spyware devices that might be making
>> my internet searches become slow?
>
> Another possibility:
>
> The DNS server setting for you PC may have been changed to point to a
> machine that will essentially accomplish the same ends as if your hosts
> file was tampered with.
>
> This may not be easily possible to do on a windows-7 machine, but if you
> can, run the "nslookup" program that is buried somewhere on your system
> and get the IP result for google.com (or what-ever you use to perform
> searches).
>
> If you tell us what your search URL is, and what your nslookup result
> is, then we can tell you if your hosts file or DNS server setting is
> suspect.
>
> For example, if I perform an nslookup on "google.com", I get several
> results:
>
> 74.125.226.80
> 74.125.226.81
> 74.125.226.82
> 74.125.226.83
> 74.125.226.84
>
> The website IPtools.com gives these results:
>
> 173.194.64.99
> 173.194.64.103
> 173.194.64.104
> 173.194.64.105
> 173.194.64.106
> 173.194.64.147
>
> The difference is probably a function of the DNS server being used, as
> the google name servers seem to give a different result depending on
> what machine is making the query.
>
> If you open a command shell and issue the command "ipconfig /all" you'll
> get a line saying what your DNS server(s) are. Either look them up
> yourself, or post them here and we might be able to tell you if they're
> legit or malicious.


Which is a very good point. I have see DNS problems cause slowness in resolution and even
an inability to access sites.

Use of of the following DNS servers has alleviated those problems for those I have
suggested their use...

8.8.4.4 - Google
8.8.8.8 - Google
4.2.2.3 - former GTE DNS (Now Verizon)
4.2.2.1 - former GTE DNS (Now Verizon)
208.67.220.220 - OpenDNS
208.67.220.222 - OpenDNS

NOTE: Use of OpenDNS can help with malicious sites as OpenDNS will poison the address and
will resolve to an OpenDNS web page indicating the malicious site was blocked. The bad
part is it has poisoned sites like the University of Mannheim.

I use the Google and fGTE DNS servers.



--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[Virus Guy]

"David H. Lipman" wrote:

> 4.2.2.3 - former GTE DNS (Now Verizon)
> 4.2.2.1 - former GTE DNS (Now Verizon)

I used to use 4.2.2.2 until I found faster servers.

> I use the Google and fGTE DNS servers.

Have you ever tried Gibson's DNSBench.exe?

I've used it a few times over the past year or two and have changed my
servers based on the results.

The GTE servers are consistently in the top 10 as far as performance
goes, so as a generic recommendation they're not bad.

I think there's something creepy about using google's dns servers.