What's up with Symantec's homepage?

[That guy]

www.symantec.com
nothing happens here - do any of you get it?

 

[Dave]

looks fine to me. check your machine for viruses and other malware. many
of them now prevent access to known anti-virus sites as part of their
attack.

 

[Torgeir Bakken \(MVP\)]

www.symantec.com
nothing happens here - do any of you get it?

Hi

Your hosts file could be compromised by spyware, malware etc.,
edit the following file with Notepad:

Win95/98/ME: %windir%\hosts
Windows NT/2000/XP: %windir%\system32\drivers\etc\hosts

If there is anything within the file, remove it (the only line that
usually is in there is "127.0.0.1 localhost" in addition to
the comment lines at the top).


To check for Spyware and Parasites, you can run e.g. the
tools mentioned in the links below...

Dealing with Unwanted Spyware and Parasites
http://www.mvps.org/winhelp2002/unwanted.htm

The Parasite Fight
http://aumha.org/a/parasite.htm

 

[That guy]

www.symantec.com

Your hosts file could be compromised by spyware, malware etc.,
edit the following file with Notepad:
Windows NT/2000/XP: %windir%\system32\drivers\etc\hosts

winnt\system32\drivers\etc\hosts is what I have using Win2000 pro with
latest updates. When I open it with Notepad there is only "127.0.0.1"
repeated many times. I guess they are IP addresses. They all seem to be
associated with anti-virus companies. So everything there looks ok. I've
run Adaware pro and Spider for malware/adware and AVG 6 for viruses. For
some reason I can't get my Live Update for Symantec 8.0 corporate edition to
work. Also I can't seem to get it to autostart. I just formatted and
freshly installed my OS.

 

[George Hester]

That sounds fishy. Try this. Rename the hosts file to hosts.txt. Then try Symantec again.

 

[Dave]

winnt\system32\drivers\etc\hosts is what I have using Win2000 pro with
latest updates. When I open it with Notepad there is only "127.0.0.1"
repeated many times. I guess they are IP addresses. They all seem to be
associated with anti-virus companies. So everything there looks ok. I've

nope, that is wrong. a virus or worm has gotten to your machine and
associated all those web site names with 127.0.0.1 which is your local
loopback address... therefore you can't get to any of them.

 

[Torgeir Bakken \(MVP\)]

winnt\system32\drivers\etc\hosts is what I have using Win2000 pro with
latest updates. When I open it with Notepad there is only "127.0.0.1"
repeated many times. I guess they are IP addresses. They all seem to be
associated with anti-virus companies. So everything there looks ok.

Hi

That is not good, your host file is hijacked.

You should only have one line in there with 127.0.0.1,
pointing to localhost.

Remove all the other lines than the "127.0.0.1 localhost" line.

 

[Danny Mingledorff]

Hi

That is not good, your host file is hijacked.

You should only have one line in there with 127.0.0.1,
pointing to localhost.

Remove all the other lines than the "127.0.0.1 localhost" line.


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/community/scriptcenter/default.mspx

After you remove the offending entries, reboot your machine to make sure
you've removed the cached list.

....danny

 

[George Hester]

Not necessary. Just close all open browsers.

 

[Torgeir Bakken \(MVP\)]

After you remove the offending entries, reboot your machine to make sure
you've removed the cached list.

Hi

That is not necessary. The cache is updated every time the hosts
file is changed (the Protocol Driver service gets a file change
notification from the OS when the file is edited).

 

[Danny Mingledorff]

Hi

That is not necessary. The cache is updated every time the hosts
file is changed (the Protocol Driver service gets a file change
notification from the OS when the file is edited).

--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/community/scriptcenter/default.mspx

That was my understanding as well, but I've run into situations where it
didn't go according to theory, and it took a reboot to clear. I chalk it up
to these things being more art than science...

....danny

 

[That guy]

www.symantec.com

I've

nope, that is wrong. a virus or worm has gotten to your machine and
associated all those web site names with 127.0.0.1 which is your local
loopback address... therefore you can't get to any of them.

I guess these are the best antivirus sites since they are the ones the virus
author has wanted to protect himself against. This is what was in my hosts
file.
127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com

And sure enough there was the liveupdate.symantec.com sitting there which
would explain why THAT didn't work. Now its working just peachy! Thanks a
bunch. If it wasn't for helpful people like you all out there in newsgroup
land, others like me would be utterly lost. Or go broke paying Microsoft
for help that is!

 

[George Hester]

Yup nasty. The interesting thing here is your statement that "nothing happens" when you went to Symantic. You should have gotten an error unless your Web Server is running with Nothing as it's default page. I don't mean not exist what I mean is a page like this:

<html>
<head>
</head>
<body>
</body>
</html>

That would give "nothing." But if your IIS is not running you should have gotten: "The page cannot be displayed" a DNS error. Check your IIS.