unable to update?

I have a very strange bug with my comp.. recently i have not been able to update my norton antivirus 2002 or go to the symantec.com site. It just gives me a page not found error. Strange this is it only happens when i go to symantec pages.

I've scanner for both the gaobot and the sasser virus and nothing was found.... i'm suspecting its some sorta worm.. anyone have any idea whats going on??? TIA

Yeah, cant get to any virus killer pages either, pretty sure its due to sasser

sounds like a sasser symptom to me too

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.removal.tool.html

i can't even access that page... Gives me the no page found thingy...

OMG i found it!!! LIL POS!!

So i was lookin thru my startup apps in msconfig and found a lil file called "msrv32.exe"... so i did a lil search on google and found:

This variant belongs to a family of IRC bots based on W32/Gaobot.worm group. The worm bears the following characteristics:
?Spreads through shares
?Stealthy and hides itself in memory. The file is deleted.
?Connects to IRC servers to perform various functions
?Terminates security services
?Carries out Denial of Service attack
?Modifies hosts file on infected system
?May spread through MS03-026 vulnerability

linkie

So yea i del it and now all is well... DANG NASTY LIL WORMS!!!

Edit: crappy still can't connect to the symantec site to run liveupdate.... nor can i connect to the site from IE, but any other site works... very strange...

woohoo figured it out... gotta delete the host file from /windows/system32/drivers/etc folder. Apparently it blocks the site....

Haha cute, it adds an entry to your hosts file. Easy enough to remove manually if you need to. Just look in your windows system directory and remove the entry in the hosts file for the norton webpages. Clever though!

XprincoX said:

woohoo figured it out... gotta delete the host file from /windows/system32/drivers/etc folder. Apparently it blocks the site....

Click to expand...

you are correct,,,,,,,,,,,but if you haven't used the removal tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.removal.tool.html

and done a windowsupdate to fix the exploit and update your virus defs, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

you could still be infected - sigh