Virus blocking access to Norton and other security sites

Norton Security | Norton Internet Security
1

Hello I’m a Norton user and well I have the same problem I can’t access any protection from norton except pc checkup (a lot of good that did me) and i can’t acess the malwarebytes.org site nor can i use the hijack log that you were talking about as this virus wont let me. What happened was i was on google asking a simple question didnt even click on a link when Norton said it blocked something… then about 10 seconds later my comp froze and ctrl alt del wouldnt bring up task manager so i shut it off then rebooted and thats when i couldnt access anything including my internet until just recently. Is there any way i can get help?

Message Edited by freeten on 07-08-2009 11:06 PM
<<Edit: Subject edited to better reflect the issue>>
Message Edited by TomV on 07-08-2009 11:40 PM

2

Hello I’m a Norton user and well I have the same problem I can’t access any protection from norton except pc checkup (a lot of good that did me) and i can’t acess the malwarebytes.org site nor can i use the hijack log that you were talking about as this virus wont let me. What happened was i was on google asking a simple question didnt even click on a link when Norton said it blocked something… then about 10 seconds later my comp froze and ctrl alt del wouldnt bring up task manager so i shut it off then rebooted and thats when i couldnt access anything including my internet until just recently. Is there any way i can get help?

Message Edited by freeten on 07-08-2009 11:06 PM
<<Edit: Subject edited to better reflect the issue>>
Message Edited by TomV on 07-08-2009 11:40 PM

3

Hi freeten:

 

Following Dbrisendine's advice, I would recommend that you disable system restore, dump your temp files and empty your browser caches.

 

 

4

Hi Freeten,

 

Welcome to Norton Community!

 

It's sure that something like DNSChanger may have got into your computer and that is why you are unable to access the secured websites such as malwarebyes.org. Let us know which version of Norton program you use and your Operating System.

 

In meantime, I would suggest you to try to Update the virus definitions using the Intelligent Updater and then run a scan in Safe mode. You can download and run Intelligent Updater from the following link:

http://www.symantec.com/business/security_response/definitions/download/detail.jsp?gid=n95

 

You have to download the intelligent updater file for your version of Norton program and run it. Now, run the scan in Safe Mode.

1. Restart your computer.

2. As soon as the computer starts, tap the F8 key about once per second until you see the Windows Advanced Options menu.

3. Use the arrow keys on the keyboard to select Safe Mode With Networking, and then press Enter.

4. Click Yes to proceed to Safe mode.

5. Click Start button, and then click Run.

6. Type the following text and click OK:

navw32.exe /L

7. Check whether the scan runs completely and then restart the computer.

 

You can also check whether you are able to connect to secured Websites in Safe Mode with Networking.

 

Yogesh

 

5

ok ill try all your guys’s advice i just hope itll let me run the scan cause i tried hijackthis it didnt work even though i could download cause the virus prevented me. Also, i am running Norton antivirus 2008 with windows xp 2000.

Message Edited by freeten on 07-09-2009 11:34 AM

6

I think it is mainly due to the presence of W32.Downadup. I had the same issue on my windows 2 days ago:smileysad: I have resolved it by running the removal tool for W32.Downadup.

 

You need to disable Windows System restore first. You can find the steps to disable System Restore here.

 

Then download and run W32.Downadup removal tool from the following site.

 

Download the D.exe file from: http://www.symantec.com/content/en/us/global/removal_tool/threat_writeups/D.exe.

 

After running this tool, you may be asked to restart the computer.

 

Then turn on System Restore.

 

Try to access the security sites.

 

Vineeth--

7

vineeth thanks but i think that its more than that becuase until recently it affected my whole entire internet and the cause was a virus that norton said it blocked but i guess it didnt cause my computer froze and stopped working seconds after the message.

8

Ok i tried gmer but in the middle of the scan(tried twice)my computer just turned off then rebooted itself so im not sure whats wrong but i did nothing other than let it scan.

9

Try to run the GMER scan in Safe Mode, please.  Let us know how this works or doesn’t.  Please attach the log file here if it does run.  Thanks.

10

I would also recommend trying Vineeth’s advice.  Since he is a “Volunteer” in rank, it means that he works in support for Symantec.  He knows his stuff.

11

Sorry ive been away for a bit and in safe mode things are slow and tend not to work so well ill try tomorrow and also i unistalled and reinstalled norton and can run scans and stuff but its way out of date so it might not detect the virus or w/e is causing the problem and when live update completes nothing happens. (just keeping you updated).

Message Edited by freeten on 07-13-2009 12:33 AM

12

freeten,

 

could you please:

 

1) Download Superantispyware from www.superantispyware.com, update it a run a scan - try and rename the downloaded file and the .exe if it won't run. also, you can try getting to malwarebytes.org through a proxy maybe.

 

2) Please run the gmer scan as requested in a previous post

 

Safe Mode is generally slow and strange looking

 

Matt

Message Edited by mattsegers on 07-13-2009 02:42 PM
13

Hi Freeten:

 

It seems as though you may have a rootkit.  Normal means of remediation will be unlikely to work.  If you are unable to get GMER to run, please try to provide a Rootrepeal log.  We prefer to work with the files that are on your machine.

 

http://homepages.slingshot.co.nz/~crutches/RootRepel/ 

14

ok well gmer did work until it finished then it just shut my comp off right then like you had killed the power to the tower and malwarebytes setup i found was on my flashdrive but its the same results when i install it just simply wont let me run it. also there was a red service thing on gmer before it quit it was service 32 and really long letters. ill rerun it to copy it then ill paste it here ok.

15

Try with GMER just scanning the "service" then just the "Registry" then just the "Files"

 

By only having each ticked only down the right hand side per scan.

 

Quads 

16

root repeal log on the red highlights (not enough room to post whole log sorry)


Name: MSIVXlvdbbownsrpdqvsbwwyrdlxgbivxturr.sys
Image Path: C:\WINDOWS\system32\drivers\MSIVXlvdbbownsrpdqvsbwwyrdlxgbivxturr.sys
Address: 0xEDB9C000    Size: 176128    File Visible: -    Signed: -
Status: Hidden from Windows API!

17

this was also the gmer highlight as well

 



---- Services - GMER 1.0.15 ----

Service  C:\WINDOWS\system32\drivers\MSIVXlvdbbownsrpdqvsbwwyrdlxgbivxturr.sys (*** hidden *** )     [SYSTEM] MSIVXserv.sys          <-- ROOTKIT !!!

---- EOF - GMER 1.0.15 ----.

 

 

 

 

p.s. i did try vineeth's advice there were no downadups (hope i spelled right)

Message Edited by freeten on 07-13-2009 02:10 PM
Message Edited by freeten on 07-13-2009 02:32 PM
18

Freeten:

 

You will be able to post the entire log, if you follow the instructions in the PM.  We need more than the parts you picked out as relevant.

19

oh sorry

Message Edited by freeten on 07-13-2009 03:08 PM
Message Edited by freeten on 07-13-2009 03:09 PM

20

Hi Freeten:

 

That log should help.  What version of Norton are you running NIS or NAV, or a Symantec Antivirus. The version number should be under Help & Support - About.