need norton/symantec tech support email addy

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

cj2448

Thread Starter
Joined
Apr 25, 2004
Messages
544
Norton discovered a virus on my computer yesterday named W32.HLLW.Gaobot.gen

I could not repair, so I tried to download 'fix' file and I couldn't get on the Symantec website. I can't run liveupdate, and no matter what site I go to to get to Symantec it says not found.

I went to my neigbors and downloaded the fix, did the fix, reformated my hard drive and loaded XP home, (needed to do this and thought might as well now) got everything reloaded, installed, no problem, except the Norton, still can't live update or even get on their site :(

This morning I woke up to find my Norton open, saying I had the same virus again, I again, did the fix, says it is fixed but still cannot get on Nortons site?

I don't know if settings are wrong, I messed with everything under the internet security, added norton/symantec as trusted sites. I would like to just email symantec tech support, but I can't find their email address anywhere, I have even tried to guess at what it is but they came back :(

HELP...please someone, tell me how to fix my problem or let me know the tech support addy.

Kindest regards,
Christine
 
Joined
Jul 29, 2001
Messages
21,334
Do you have a home network with any other PC's connected? Email support through Symantec will get you nowhere and if they do answer will take ages.
Here is how it spreads:

W32.Gaobot.ADX is a worm that spreads through open network shares and several Windows vulnerabilities. The worm also propagates through back doors installed by the Beagle and Mydoom families of worms

I would also suggest disconnecting your PC from any network or internet connection when you run the fix.
 

~Candy~

Retired Administrator
Joined
Jan 27, 2001
Messages
103,706
Hi and welcome. If you said you reformatted the hard drive, I'm confused as to how the virus could be back :confused:
 

~Candy~

Retired Administrator
Joined
Jan 27, 2001
Messages
103,706
Recent Gaobot variants may add entries %System%\drivers\etc\hosts file, to disable access to certain antivirus Web sites. Refer to the W32.Gaobot.ZW writeup for a typical list of entries that may be added to the Hosts file.


Windows XP
Click Start, and then click Search.
Click All files and folders.
In the "All or part of the file name" box, type:

hosts


Verify that "Look in" is set to "Local Hard Drives" or to (C:).
Click "More advanced options."
Check "Search system folders."
Check "Search subfolders."
Click Search.
Click Find Now or Search Now.
For each one that you find, note its location. (This is displayed in the "In Folder" column.)
Right-click each file, and then click "Open With."
Deselect the "Always use this program to open this program" check box.
Scroll through the list of programs and double-click Notepad.
When the file opens, delete all the entries in the Hosts file that begin with "127.0.0.1," except for the following line:

127.0.0.1 localhost


Close Notepad and save your changes when prompted.


Note: Some variants of this worm do not modify the hosts file.

Did you follow the rest of the removal instructions on the Symantec page?
 

cj2448

Thread Starter
Joined
Apr 25, 2004
Messages
544
It wasn't there last night, woke up this morning and the norton was open again (I have it set up to auto scan every night) and it said the same virus!
 

~Candy~

Retired Administrator
Joined
Jan 27, 2001
Messages
103,706
Hi Christine, in your email you said you were connected via cable modem. You need to get disconnected and follow Symantecs instructions.
 

cj2448

Thread Starter
Joined
Apr 25, 2004
Messages
544
Thank you, so I should disconnect my cable modem, then run the fix again? I ran it this morning and it said it was fixed. I am having no other problems except with Norton's website and Live Update.

I cannot thank you enough for your advice! I'm just confused as how this is only affecting my ability to connect to the Symantec website. The virus name was W32.HLLW.Gaobot.gen
 

~Candy~

Retired Administrator
Joined
Jan 27, 2001
Messages
103,706
That is one of the things that particular virus does ;)

Connects to an IRC server, using its own IRC client, and then listens for commands to do any of the following:

Download and execute files
Steal system information
Send the worm to other IRC users
Add new accounts
Perform Denial of Service (DoS) attacks


Attempts to spread to other computers using numerous vulnerabilities. These could include:

The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135.
The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80.
The Workstation service buffer overrun vulnerability (described in Microsoft Security Bulletin MS03-049) using TCP port 445. Windows XP users are protected against this vulnerability if Microsoft Security Bulletin MS03-043 has been applied. Windows 2000 users must apply MS03-049.
The Microsoft Messenger Service Buffer Overrun Vulnerability (described in Microsoft Security Bulletin MS03-043).
The Locator service vulnerability (described in Microsoft Security Bulletin MS03-001) using TCP port 445. The worm specifically targets Windows 2000 machines using this exploit.
The UPnP vulnerability (described in Microsoft Security Bulletin MS01-059).
The vulnerabilities in the Microsoft SQL Server 2000 or MSDE 2000 audit (described in Microsoft Security Bulletin MS02-061), using UDP port 1434.
The backdoor ports that the Beagle and Mydoom families of worm open.


Attempts to connect to the following network shares:

admin$
c$
d$
e$
print$

using easily guessed user name/password combinations, including empty passwords.

Read the W32.HLLW.Gaobot.AA writeup for a sample list of user names and passwords.


Copies itself to any computers it compromised using the previously mentioned exploits.


Remotely schedules a task to run the worm on a newly infected computer.


Queries the registry to steal the CD keys of various games.


Terminates antivirus and firewall software, as well as the process names associated with other worms.


Recent Gaobot variants may add entries %System%\drivers\etc\hosts file, to disable access to certain antivirus Web sites. Refer to the W32.Gaobot.ZW writeup for a typical list of entries that may be added to the Hosts file.
 

cj2448

Thread Starter
Joined
Apr 25, 2004
Messages
544
Jeesh. Well, I will follow yours/symamtecs instructions. Again, THANK YOU! This web site is incredible!
 

cj2448

Thread Starter
Joined
Apr 25, 2004
Messages
544
Last reply/question, I promise :)

You are very knowlegable about this virus stuff, I have to ask, my husband and I are curious....how does this happen? How did it get on my computer? I didn't open any attachments and as discussed earlier I reformatted my hard drive and reloaded everything new and it showed up again when I awoke this morning? I Guess what I am asking is, I always thought you had to open an email attachment to get a virus...how did this happen?

Also, I will be donating to this site! I am still blown away by the contents, people and help on here.
 

~Candy~

Retired Administrator
Joined
Jan 27, 2001
Messages
103,706
If you will read that whole page on the Symantec site, you will see the many ways in which it can happen. Since you said you reinstalled XP, be sure you reinstall all the security updates, probably at least 24 or so the last time I did a clean XP install ;)

Actual, viruses are not my specialty, I just google really well :D There are way more brilliant folks around here on viruses than me :eek: :D


Oh, and no problem whatsoever on the replies and questions. Next time give us a harder one :D
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top