Norton Internet Security / Norton AntiVirus

[FrankBarajas]

I have a new install of Norton Antivirus 2009 and LiveUpdate can't connect to the update server. I ran a full scan with original virus definitions that came on the disk (using the Norton Recovery on the NAV2009 - booted from the CDROM) and what it found was fixed, but the weird thing is that I can no longer connect to the Symantec Website. It appears as though my Internet connection is down. Reports an IP of 127.0.0.1 for the website. This affects every "antivirus" type of website I go to, but most any other website is OK, such as Amazon. Funny thing is that Google appears to be "nerfed" in that if I search for "Norton Antivirus 2009 LiveUpdate can't connect to Internet" I get a bunch of hits but the links are phony or at the least misleading to some products that claim will fix my problems if I only agree to pay or buy... Something along those lines. However, if I view the Google cached version I usually get the real site (a correct hit) unless it is a Symantec or any real utility kind of website, then that site is blocked with the can't connect error.

But wait, this gets better; for some reason I can get to the Symantec software shopping site! I can only assume this "good hit" is so that "they (pond scum) can collect on a referral or something. By the way, I should mention this wasn't why I installed NAV2009 in the first place. I was hit with the "AntiVirusPro2009" virus or fake software or whatever clever type of malware it is called. NAV2009 killed it right out of the box, but now I have dumb system on my hands and no way to update the over 70 day old virus definitions. The hosts file is the standard XP issue, empty except for the remarked contents, unlike my home PC (which I am using now) which has all the blocked sites given to it by SpyBot Search & Destroy. Which I find really interesting since this "AntiVirusPro2009" somehow managed to kill the SpyBot Search & Destroy install on that computer and rendered it useless. I mean the SpyBot S&D is still on the harddisk but the installation is gone from the system! I have never seen anything like this, needless to say, but SpyBot S&D wont reinstall, which is why ultimately I went to NAV2009.

I have downloaded the current virus definitions to manually attempte to update NAV2009 and will try that tomorrow, but if that doesn't the problem or fix liveupdate what can I do to stop the redirect on IE 7.0? Is there anyway to Activate the NAV2009 without using LiveUpdate as I only have 12 day left before it dies on me. Please keep in mind, the PC with the problem is at my office and I can only access this forum from my home PC at the moment. The problem PC has XP Home with service pack 2 on it. System Restore will not work on any restore point and any Microsoft Windows websites for updates or any related Antivirus/Antispam websites such as AVG, Trend Micro, MacAfee are all blocked as well, but Outlook and most other Internet activities run fine. Don't ask me to attempt to reinstall NAV2009 as I have tried twice, uninstall just hangs and does nothing; if you want it reinstalled I'll need a manual uninstall script. Also, the Norton Activation screen has become really annoying after two days of it asking me if my computer is connected to the Internet... Any ideas or help fixing this digital nightmare would be appreciated greatly. 

[Dieselman743]

Please try downloading and installing Malware Bytes Anti Malware. Update it then run a scan in Safe Mode. Seems like your still infected.

 http://www.malwarebytes.org/

[johna · Accepted solution]

Hi FrankBarajas

Seems like you have been infected with Internet Explorer Redirect Malware.

Can you run Malwarebytes' as advised in the previous post, then remove any corruptions found. After this, you will need to reset your router. To do this, there should be a small button on the back which you have to press and hold in. When it resets, you will see the lights on the front go out, then it should restart.

After this, you must flush your DNS. To do this, go to Start>Run type  ipconfig /flushdns.

Let us know if this works, there are a couple more steps you will need to take even if you are clear to access the sites and run Live Update again.

Thanks

[FrankBarajas]

Thanks Guys. I will download the software and will try this fix tomorrow then report back to you. In case you are wondering, I did get the virus definitions updated using the "manual" method but nothing else was found after a full scan with NAV2009. I also managed to repair the install on the SpyBot S&D but it also cannot update via the Internet. However, it reported a possible issue with CTFMON.EXE, which I will research tonight.

[Dieselman743]

Spybot is past its prime and pretty much worthless now a days. CTFMON is part of Windows.

[FrankBarajas]

Malwarebytes' Anti-Malware did fix the problem. I am back to normal. Thanks again for the suggestion. I have to ask though, does NAV2009 and Anti-Malware work well together? In other words, should I buy the complete version of Anti-Malware and have it's protection running in the background with NAV2009? I am kind of concerned since one program wasn't the solution, in this case.

[FrankBarajas]

Thanks your help. The Anti-Malware fixed the problem. Also, CTFMON was indeed part of the problem. It's part of Windows when you have MSOffice but I don't have that software, so when I tried to disable it via the Microsoft Knowledge Base instructions the "button" was grayed out, as it really wasn't there, the Microsoft version. It was also identified by the software and removed sand o that closes this fun chapter. Thanks again for your suggestions.

[Dieselman743]

Interesting.........I suggested that you use Malware Bytes first but you gave the kudo's to johna who posted after me. Glad you fixed it.

[mijcar]

Oh, Diesel, I am sorry you didn't get a kudo.  Here, I will give you one.

Oh, I see you got one after all.  Well, now you have an extra.  Enjoy.

Message Edited by mijcar on 11-12-2008 10:16 PM

[Dieselman743]

AAAAAwwwwwwwwwww thank you mijcar......your all heart.