1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

need norton/symantec tech support email addy

Discussion in 'Windows XP' started by cj2448, Apr 25, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. cj2448

    cj2448 Thread Starter

    Joined:
    Apr 25, 2004
    Messages:
    544
    Norton discovered a virus on my computer yesterday named W32.HLLW.Gaobot.gen

    I could not repair, so I tried to download 'fix' file and I couldn't get on the Symantec website. I can't run liveupdate, and no matter what site I go to to get to Symantec it says not found.

    I went to my neigbors and downloaded the fix, did the fix, reformated my hard drive and loaded XP home, (needed to do this and thought might as well now) got everything reloaded, installed, no problem, except the Norton, still can't live update or even get on their site :(

    This morning I woke up to find my Norton open, saying I had the same virus again, I again, did the fix, says it is fixed but still cannot get on Nortons site?

    I don't know if settings are wrong, I messed with everything under the internet security, added norton/symantec as trusted sites. I would like to just email symantec tech support, but I can't find their email address anywhere, I have even tried to guess at what it is but they came back :(

    HELP...please someone, tell me how to fix my problem or let me know the tech support addy.

    Kindest regards,
    Christine
     
  2. Rockn

    Rockn

    Joined:
    Jul 29, 2001
    Messages:
    21,334
    Do you have a home network with any other PC's connected? Email support through Symantec will get you nowhere and if they do answer will take ages.
    Here is how it spreads:

    W32.Gaobot.ADX is a worm that spreads through open network shares and several Windows vulnerabilities. The worm also propagates through back doors installed by the Beagle and Mydoom families of worms

    I would also suggest disconnecting your PC from any network or internet connection when you run the fix.
     
  3. ~Candy~

    ~Candy~ Retired Administrator

    Joined:
    Jan 27, 2001
    Messages:
    103,706
    Hi and welcome. If you said you reformatted the hard drive, I'm confused as to how the virus could be back :confused:
     
  4. ~Candy~

    ~Candy~ Retired Administrator

    Joined:
    Jan 27, 2001
    Messages:
    103,706
    Recent Gaobot variants may add entries %System%\drivers\etc\hosts file, to disable access to certain antivirus Web sites. Refer to the W32.Gaobot.ZW writeup for a typical list of entries that may be added to the Hosts file.


    Windows XP
    Click Start, and then click Search.
    Click All files and folders.
    In the "All or part of the file name" box, type:

    hosts


    Verify that "Look in" is set to "Local Hard Drives" or to (C:).
    Click "More advanced options."
    Check "Search system folders."
    Check "Search subfolders."
    Click Search.
    Click Find Now or Search Now.
    For each one that you find, note its location. (This is displayed in the "In Folder" column.)
    Right-click each file, and then click "Open With."
    Deselect the "Always use this program to open this program" check box.
    Scroll through the list of programs and double-click Notepad.
    When the file opens, delete all the entries in the Hosts file that begin with "127.0.0.1," except for the following line:

    127.0.0.1 localhost


    Close Notepad and save your changes when prompted.


    Note: Some variants of this worm do not modify the hosts file.

    Did you follow the rest of the removal instructions on the Symantec page?
     
  5. cj2448

    cj2448 Thread Starter

    Joined:
    Apr 25, 2004
    Messages:
    544
    It wasn't there last night, woke up this morning and the norton was open again (I have it set up to auto scan every night) and it said the same virus!
     
  6. ~Candy~

    ~Candy~ Retired Administrator

    Joined:
    Jan 27, 2001
    Messages:
    103,706
    Hi Christine, in your email you said you were connected via cable modem. You need to get disconnected and follow Symantecs instructions.
     
  7. cj2448

    cj2448 Thread Starter

    Joined:
    Apr 25, 2004
    Messages:
    544
    Thank you, so I should disconnect my cable modem, then run the fix again? I ran it this morning and it said it was fixed. I am having no other problems except with Norton's website and Live Update.

    I cannot thank you enough for your advice! I'm just confused as how this is only affecting my ability to connect to the Symantec website. The virus name was W32.HLLW.Gaobot.gen
     
  8. ~Candy~

    ~Candy~ Retired Administrator

    Joined:
    Jan 27, 2001
    Messages:
    103,706
    That is one of the things that particular virus does ;)

    Connects to an IRC server, using its own IRC client, and then listens for commands to do any of the following:

    Download and execute files
    Steal system information
    Send the worm to other IRC users
    Add new accounts
    Perform Denial of Service (DoS) attacks


    Attempts to spread to other computers using numerous vulnerabilities. These could include:

    The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135.
    The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80.
    The Workstation service buffer overrun vulnerability (described in Microsoft Security Bulletin MS03-049) using TCP port 445. Windows XP users are protected against this vulnerability if Microsoft Security Bulletin MS03-043 has been applied. Windows 2000 users must apply MS03-049.
    The Microsoft Messenger Service Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS03-043).
    The Locator service vulnerability (described in Microsoft Security Bulletin MS03-001) using TCP port 445. The worm specifically targets Windows 2000 machines using this exploit.
    The UPnP vulnerability (described in Microsoft Security Bulletin MS01-059).
    The vulnerabilities in the Microsoft SQL Server 2000 or MSDE 2000 audit (described in Microsoft Security Bulletin MS02-061), using UDP port 1434.
    The backdoor ports that the Beagle and Mydoom families of worm open.


    Attempts to connect to the following network shares:

    admin$
    c$
    d$
    e$
    print$

    using easily guessed user name/password combinations, including empty passwords.

    Read the W32.HLLW.Gaobot.AA writeup for a sample list of user names and passwords.


    Copies itself to any computers it compromised using the previously mentioned exploits.


    Remotely schedules a task to run the worm on a newly infected computer.


    Queries the registry to steal the CD keys of various games.


    Terminates antivirus and firewall software, as well as the process names associated with other worms.


    Recent Gaobot variants may add entries %System%\drivers\etc\hosts file, to disable access to certain antivirus Web sites. Refer to the W32.Gaobot.ZW writeup for a typical list of entries that may be added to the Hosts file.
     
  9. cj2448

    cj2448 Thread Starter

    Joined:
    Apr 25, 2004
    Messages:
    544
    Jeesh. Well, I will follow yours/symamtecs instructions. Again, THANK YOU! This web site is incredible!
     
  10. cj2448

    cj2448 Thread Starter

    Joined:
    Apr 25, 2004
    Messages:
    544
    Last reply/question, I promise :)

    You are very knowlegable about this virus stuff, I have to ask, my husband and I are curious....how does this happen? How did it get on my computer? I didn't open any attachments and as discussed earlier I reformatted my hard drive and reloaded everything new and it showed up again when I awoke this morning? I Guess what I am asking is, I always thought you had to open an email attachment to get a virus...how did this happen?

    Also, I will be donating to this site! I am still blown away by the contents, people and help on here.
     
  11. ~Candy~

    ~Candy~ Retired Administrator

    Joined:
    Jan 27, 2001
    Messages:
    103,706
    If you will read that whole page on the Symantec site, you will see the many ways in which it can happen. Since you said you reinstalled XP, be sure you reinstall all the security updates, probably at least 24 or so the last time I did a clean XP install ;)

    Actual, viruses are not my specialty, I just google really well :D There are way more brilliant folks around here on viruses than me :eek: :D


    Oh, and no problem whatsoever on the replies and questions. Next time give us a harder one :D
     
  12. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - need norton symantec
  1. silver1976
    Replies:
    8
    Views:
    216
  2. gjcdigartntch
    Replies:
    41
    Views:
    1,635
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/223675

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice