Raevix
December 13, 2008, 5:47am
1
Hello,
I recieved a virus today and it is starting to annoy me. It prevents norton 360 from starting. you cant run 360 in safe mode so it tells you to down load NSS1. I downloaded nss1 and it cannot connect to download the virus definitions. while trying to seach out ways of running a virus scan i noticed that randomly firefox will open up and load a random web page. I also cannot run love update or any other virus scan software. everything else seems to be unaffected.
Any ideas.
I did come across a post on the internet that sounded similar.
"Running the Norton Security Scan failed when it was unable to
The antivirus package does not include a virus definition file, so
any help would be welcome
Raevix
December 13, 2008, 5:47am
2
Hello,
I recieved a virus today and it is starting to annoy me. It prevents norton 360 from starting. you cant run 360 in safe mode so it tells you to down load NSS1. I downloaded nss1 and it cannot connect to download the virus definitions. while trying to seach out ways of running a virus scan i noticed that randomly firefox will open up and load a random web page. I also cannot run love update or any other virus scan software. everything else seems to be unaffected.
Any ideas.
I did come across a post on the internet that sounded similar.
"Running the Norton Security Scan failed when it was unable to
The antivirus package does not include a virus definition file, so
any help would be welcome
Quads
December 13, 2008, 6:04am
3
Ok may have a bit on it.
1. Download Hijackthis http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download and download the third in the list (Excutable) and click "Scan with log" open the log in Notepad, the paste me the results please in a Personal Message. We will try and stop any starting Items first.
Quads
Quads
December 13, 2008, 6:14am
4
If you can't get to Trend Micro's website cos that is blocked try
http://www.filehippo.com/download_hijackthis/
Quads
Raevix
December 13, 2008, 6:21am
5
OK a bit of an update. I was able to download malware bytes and got rit of a buch of the mess that was going on. I was able to turn back on my windows firewall but am still unable to start norton 360 or NSS ( Norton security scan) in safe mode.
per the request here is the hijack this info
Logfile of Trend Micro HijackThis v2.0.2http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=69157 http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/ *http://www.yahoo.com http://go.microsoft.com/fwlink/?linkid=39204 http://inst.c-wss.com/n035p/EN/install/gtdownlr.cab http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab http://www1.snapfish.com/SnapfishActivia.cab http://lads.myspace.com/upload/MySpaceUploader.cab http://www.linkedin.com/cab/LinkedInContactFinderControl.cab http://static.slide.com/uploader/SlideImageUploader.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146297815828 http://www.systemrequirementslab.com/sysreqlab2.cab http://www.acclaim.com/cabs/acclaim_v4.cab http://updates.lifescapeinc.com/installers/pinstall/pinstall.cab http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab http://www.legendofares.com/download/mgusamanagerv1001.cab https://mail.duke-energy.com/InternalSite/WhlCompMgr.cab http://camera.clemson.edu/tillman/AxisCamControl.ocx http://www.linksysfix.com/netcheck/67/install/gtdownls.cab http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab http://www.tricksteronline.com/control/tricksterActiveX.cab http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab http://www.tricksteronline.com/control/KALogoutComponent.cab
Raevix
December 13, 2008, 6:40am
6
another symptom i have just noticed is I can use the internet with firefox but i cannot open any web pages using explorer.
thanks for the help
Quads
December 13, 2008, 6:52am
7
Ok her goes,
It is not "Norton Security Scan" but Northon Security scan and for it to work you have to contact the Northon AV site. It's a Rogue security Program that uses the local loopback to block legit Security sites.
So start Hijackthis again and tick these entries.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O20 - AppInit_DLLs: wbsys.dll yiassq.dll (although wbsys.dll is windows blinds, "yiassq.dll" is NOT)
Then click "fix checked"
Now download and use HostsXpert, http://www.funkytoad.com/index.php?option=com_content&view=article&id=13&Itemid=31
Unzip HostsXpert.zip
It will create a folder named HostsXpert in whatever folder you extract it to.
Run HostsXpert.exe by double clicking on it.
Click the Make Writeable? button.
Click Restore Microsoft's Hosts File and then click OK.
Click the X to exit the program
That should remove the local loopback (127.0.0.1) address and or IP address list.
Then see if you can download SuperAntispyware Free http://www.superantispyware.com/download.html
Install, Update them and then do a Full Scan in Safe Mode.
Quads
Quads
December 13, 2008, 7:45am
8
There is a legit Norton Security Suite and something else that is blocking legit AV sites and Allowing Malware AV sites
Quads
Raevix
December 13, 2008, 7:04pm
9
Sadly this did not help. Norton 360 will still not start. Internet explorer will still not connect to the internet ( only firefox will ) and i still cannot connect to live update to run Norton security scan. I was able to run malewarebytes to clean a lot of stuff that was a result of the virus. thanks for the help tho
Quads
December 13, 2008, 7:32pm
10
You are only the 3rd person I can find reporting this imposter problem.
How good are you at slowly doing step by step investigating?? Can be hard enough and some major hours when I am at the Computer with my software.
Quads
Raevix
December 14, 2008, 5:06am
11
problem is fixed. took a lot of registry editing and creative bootups using msconfig. It seems the virus changed the registry entries for norton, deleted some files and was redirecting web pages using key words.
thanks for the help
Quads
December 14, 2008, 5:19am
12
OK, what were the registry changes etc.
Quads
I would appreciate any help anyone may offer in solving this problem, the same thing is happening on my sister’s computer.