virus help!

kika

Ok, dont know if this thread is acceptable here. If mods have a prob just delete it.

I think i've got a virus which if i do its clever little a**hole. I have an entry level Dell with win Xp Home eddition.

I have norton internet security 2005 and anti-virus. I went into the norton cp cos i noticed banners getting thru more than usual and the whole thing was flashing red. Updates have been disabled as have alerts and firewall and AV wont open because it says certain component are missing/corrupt. On the norton site it describes the exact thing thats happening (says its some sort of virus) but when i follow the steps to fix it the fix never initalizes correctly.

Simillarly I downloaded AVG and ran it. I tried to update it and it could not establesh a connection to update its definitions. Its like i'm being blocked at every step.

The oddest thing is I have no problem accessing the internet with certain exceptions. I can get to the hotmail homepage but when I try to log in it displays the ie "page cannot be displayed" screen. also I cannot even get near gmail. It is totally blocked. Also I'm gettin screwed left right and centre with adware and trojans, etc. since i lost the firewall. I have changed my hotmail account passwords from a friends computer and havent accessed them from my home PC in case the virus uses it to spread.

I figure if it is a virus I want to get rid of it before i reinitialize norton and do me updatin and all that (and switch to someting which is effective). Any help with this would be GREATLY appreciated. If you recognize the symptoms/can suggest an uneffected AV scanner I will be forever in your debt*.

Thanks in advance
Kika

*note I will not actually be forever in your debt

Blub2k4

Go to your hosts file and remove all the blocked websites, there will be a large list of blocks there, if you need help then post it here and I will help you.

c:\windows\system32\drivers\etc\hosts

All you want to see in there is this:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost




Anything else except stuff you entered is guff,
have a good scroll down too, there is a trick that makes it look like the above by placing the changes way down the file.
If yo do this you should be able to update your AVG and Norton.

Blub2k4

Normally you will see something extra like

127.0.0.1 www.symantec.com
127.0.0.1 www.avg.com

similar to that

first impression that I get from your post.

Hope it helps.

kika

Cheers will have to get back to u later (in work now).

Thanks a mill tho'

Blub2k4

No problem, if you need more help post back and I'll try to help.

It's not that any AV scanner would be unaffected the thing is that this file points the websites at your own pc and it cant connect to the real site in the internet.
It's a trick a few of them use recently.

andy1249

What you have is the "MyDoom" virus , it blocks access to all antivirus sites thus preventing you from getting an update to deal with it , there is a removal tool available from the symantec website at the link below ,
Also there are detailed removal instructions , once your pc is clean I strongly suggest disconnecting from the net , removing and then reinstalling Norton Antivirus or whatever antivirus package you have as this virus damages the detection engine.
Also , get and install xp service pack 2 which is supposed to block the vulnerability in windows that this virus exploits.
The following link should take you straight to the page that the removal tool is on regardless of the virus as only "Symantec.com" is blocked by the virus.

Hope this helps
http://securityresponse.symantec.com/avcenter/venc/data/w32.mydoom@mm.removal.tool.html

kika

Hey i'm back

went into the blocked url file and it was exactly as u described with no additional blocked urls (i made sure to try scroll down). I also used the MyDoom tool and it said my computer didn't have it.

any other suggestions welcome!