Stubborn little bugger... Donk.Q

[Tony Meyer]

Hey people... Had a machine in with the Sasser worm on it. Symantec's
removal tool didn't pick it up, but Grisoft's removal tool did... 11 files
with Sasser E. Machine was still playing up, and acting like it was
infected, wouldn't run AVG, and wouldn't let me onto Symantec's website, or
Mcafee's but any other web page was fine. I Installed Norton AV 2004, which
installed ok, but when I went to update it, it wouldn't update, the download
kept failing. I took the machine to my workbench, downloaded the definitions
onto disk, and installed them on the affected machine. So far, so good. Ran
a scan in safe mode with Norton, and piced up two instances of W32.Donk.Q.
Gotcha! But not yet. Rebooted into normal mode, went to update Mr. Norton,
and it still won't connect, and still cant get onto Symantec's web site.
Every other website is ok, and I can access symantec from my machine. Its
making me tired thinking about it... Its almost like its not clean yet.
Currently running another safe mode scan, but anyone got any other ideas,
cos I'm about out of them now... thank you so much....

 

[Tony Meyer]

Just an update on this.... Ran the full system scan again in safe mode,
rebooted after coming up clean, and the problem is still there. Can't get
onto Symantec or mcafee, everything else is fine. Also can't update Norton
2004... Thinking about an uninstall of Norton and reinstall? Cheers T.

 

[Tony Meyer]

Got it sorted people... This crafty little bugger had changed every entry in
the hosts file to 127.0.0.1 thereby looping it back to me and confusing the
machine... Thanks for thinking about it anyway!!! Cheers T.

 

[MAP]

-----Original Message-----
Hey people... Had a machine in with the Sasser worm on it. Symantec's
removal tool didn't pick it up, but Grisoft's removal tool did... 11 files
with Sasser E. Machine was still playing up, and acting like it was
infected, wouldn't run AVG, and wouldn't let me onto Symantec's website, or
Mcafee's but any other web page was fine. I Installed Norton AV 2004, which
installed ok, but when I went to update it, it wouldn't update, the download
kept failing. I took the machine to my workbench, downloaded the definitions
onto disk, and installed them on the affected machine. So far, so good. Ran
a scan in safe mode with Norton, and piced up two instances of W32.Donk.Q.
Gotcha! But not yet. Rebooted into normal mode, went to update Mr. Norton,
and it still won't connect, and still cant get onto Symantec's web site.
Every other website is ok, and I can access symantec from my machine. Its
making me tired thinking about it... Its almost like its not clean yet.
Currently running another safe mode scan, but anyone got any other ideas,
cos I'm about out of them now... thank you so much....

--
Tony Meyer
CompUTec Computer & Network Services
Pukekohe New Zealand


.

Check your "hosts" folder, there could be an entry there
to stop you from connecting to sysmantec.

Right click on start select explore,scroll to "windows"
ane expand,scroll to system32 and expand,scroll
to "drivers" expand click on "etc" open hosts with
notepad, for most people there should only be an entry
like 127.0.0.1 local host
If you see 127.0.0.1 sysmantec delete it.
Note" some programs add entrys that are valid so there
may be other entrys than 127.0.0.1 local host but
norton does not append your hosts file.

 

[MAP]

I should have read all of your posts before answering.
I'm glad that you got it sorted out.