antivirus websites blocked

[Pascal]

In the process of setting up a new computer with ADSL, I aquired a virus that used the NT/system authority shut down when ever I logged in on the internet, shut down norton internet security, microsoft updates, the ability to use REGEDIT and access to any of the antivirus websites.<br /><br />I managed to find and eliminate the virus and have all the functions back except access to the antivirus websites. <br /><br />Any ideas on how to get around this obsticle would sure be appreciated. <br /><br />thanks<br /><br />JD

 

[rwise]

Re: antivirus websites blocked

what did you have, that may help someone help you. If we know what it is someone could look for info on it for you!

 

[roscoe]

Re: antivirus websites blocked

Re-install your antivirus software.

 

[SpinnerBait_Nut]

Re: antivirus websites blocked

Yea, remove and re-install AV software.

 

[Pascal]

Re: antivirus websites blocked

It was the w32/Rbot I virus. <br /><br />I found the information on removing it at www.sophos.com. <br /><br />The associated files on my computer were named slightly different than the instructions indicated but I managed to figure it out by comparing the system32 folder contents with that on another computer. <br /><br />I renamed the suspected associated files, turned of the restore function and rebooted in safe mode to find the hiden file where the virus was and deleted it. <br /><br />I was then able to use regedit to search for and remove the references to the 4 associated files in the registery.<br /><br />Just can't get into the norton updates. <br /><br />I have uninstalled and reinstalled the AV ware and no change.<br /><br />Still looking. Thanks for the good suggestions so far. <br /><br />JD

 

[achris]

Re: antivirus websites blocked

The virus may be the thing that's stopping the AV re-loading properly. I had this problem on a friend's machine about a year ago. What I did was put another HDD in as 'C' and formatted and loaded a bare bones OS and the AV. Then plugged the original HDD as 'D' and got the AV on the new 'C' to kill the virus on 'D'. Then removed the 'C' and plugged it all back up. Worked a treat.<br /><br />Chris.........

 

[SpinnerBait_Nut]

Re: antivirus websites blocked

Yea what Chris said.

 

[Spidybot]

Re: antivirus websites blocked

Or: Go get the fix from Norton/Panda/McAfee on a different puter. Store it on a diskette and run it on the infected puter.<br /><br />Once the fix has completed you should be able to run LiveUpdate (from control panel without actually going on the web).<br /><br />Provided your clean-up did not remove any needed files, it'll work.<br /><br />The idea is similar to Chris' but doesn't take an extra HDD.

 

[SpinnerBait_Nut]

Re: antivirus websites blocked

Or how about uninstall Norton and then put the Norton disk in and reboot to clean your computer of viruses?

 

[rwise]

Re: antivirus websites blocked

I found this on another board take a look it may help or may not!<br /> http://www.webuser.co.uk/cgi-bin/fo...r=75338&page=5&view=collapsed&sb=5&o=93&part=

 

[Pascal]

Re: antivirus websites blocked

Thanks rwise<br /><br />I'm looking into that those fixes (Hijack this and the shredder one). There are some similarities in the situation but this is not a home page problem. (been through that before too!!!). Still might have some good possibilities though.<br /><br />I've now uninstalled and reinstalled the AV and windows, scanned and rescanned, booted and rebooted. <br /><br />I haven't reformated yet and I can't do the 2nd hard drive setup cause the cheep Dell will only mount one hard drive.<br /><br />Used a borrowed uptodate version of that Sophos AV ware and there are no viruses on this puter.<br /><br />Still can't access the AV websites. <br /><br />Guess I"ll think for a while and work on my Jeep. Maybe something else will come to mind before I reformat and start from scratch again <br /><br />Thanks<br /><br />JD

 

[Pascal]

Re: antivirus websites blocked

Thankyou for all your suggestions and efforts to help.<br /><br />I knew that the virus was gone so I did a Google on blocking websites and found a lot of references to a HOSTS file in a sub folder of the windows folder. <br /><br />When I located the hosts file, there they were - all the names of the AV websites listed to bring up a file not found message. The virus must have modified or replaced it when I was infected.<br /><br />According to the information in the links below you can customize this file to prevent access to ads and undesirable sites without using a blocking program.<br /><br /> http://accs-net.com/hosts/what_is_hosts.html <br /><br /> http://www.mvps.org/winhelp2002/hosts.htm <br /><br />Anyway, I deleted the lines where the AV websites were and now I can upgrade my Norton AV. I don't think any of the automatic virus removal features in the AV software will fix the hosts file enteries. <br /><br />Anyway life is good again. <br /><br />This is a great forum community. I don't post much but I do appreciate the good hearts of all the good ole boys ( and gals) on here.<br /><br />Thanks again!!!<br /><br />JD

 

[gsbodine]

Re: antivirus websites blocked

Originally posted by Pascal:<br /> ... I don't think any of the automatic virus removal features in the AV software will fix the hosts file enteries. <br />...

Well, JD, the AV software may not fix it, but SpyBot is able to lock the hosts file against most of these sorts of attacks, and it will notice when changes have taken place to it. <br /><br />I'm surprised I didn't think of the hosts file before, but it's just so rarely used on Windows machines. Anyway, if you don't have Spybot already (http://safer-networking.org), you should get it and use it. <br /><br />happy trails.