hi All,

I work on Windows 2000 professional. And i use windows 2000 norton client for virus protection.
For the past few days i have not been able to download virus definitions from norton's site bcoz whenver i tried accessing their site to download, it showed me page not accessible. Today i noticed that it takes it to 127.0.0.1 for opening the page and then displays it unaccessible.

Bcoz of that i checked my host file and find that all the security sites like norton, mcafee etc have been resolved by 127.0.0.1 which surprised me.
I deleted the entries but still i am unable to access norton site updates for virus definition updation.
Can u help me to remove this (may be its a virus)?

thnx
Rabeea

yeah... i saw the same thing once...

gotta be a virus, though i didn't determine which one... couldn't dig up enough info from syamtec's security response...

i think all i did was straighten out the hosts file get the virus defs updated, and run some sweeps, and sure enough, there were viruses on the system... i don't think i had to do anything complex for removal.

Sometimes a virus/malware will add an entry but first it will add a bunch of blank lines so you can't see it. Check for that. Also, unless you are using the host file for something specific you can just rename it to hosts.old. You don't really need one. Also reboot your computer after doing that.

It sounds like W32.gaobot or one of its variants. I know when my company go hit with it that was one of the main issues that it was causing. There a removal tool that you can download that will get rid of it.

hi All,

thnx for taking out time to help me solve this issue.
But the thing is that i already have removed those lines from hosts file but still my browser doesnt let me go to norton's site rather it shows
connecting on 127.0.0.1 -> page cannot be displayed.

where else do i have to remove the entry.
waiting for ur response.
Rabeea

should just be a matter of changing/saving the hosts file (and restarting the browser?)

I'd check out this thread. They seem similar

http://www.linuxquestions.org/questi...hreadid=263182

Sometimes you just have to bit the bullet and re-install windows. There might be a way to fix your problem, but you can very easily spend so much time tracking down the scum-ware or fixing the problem that you could've re-installed faster. I work on PC's in a Windows environment and I have had times where that was the case. Back up all your files and make a list of all the programs you need to re-install and go for it. Also write down all of your hardware too. This will help when looking for drivers.

to get slightly off topic--

hence my support stance for the last couple months: if i can't get spyware/junkware/whatever cleaned off your system within 20 minutes, you should reinstall windows.

i know where to find most of this junk, but seems to be that some junk has become very persistant. even with utilities, i can't make the system any cleaner than i can by hand... and if i can't get it done in 20 minutes...

so my stance is move into recovery mode, and salvage what you can, then reinstall. and teach users best practices for safe internet use which includes step one: ONLY use IE for things like windows update!

and back on topic--
your problem, however, baffles me with its apparent complexity. i didn't expect you to have any problem. have you tried "shut up and reboot?"