Internet is fine, but can't surf any Norton site, even can't process live updates
|
|
 Jul 6 2012, 03:12 PM, updated 14y ago
Show posts by this member only | Post
#1
|
 
Junior Member
200 posts Joined: Sep 2008  
|
Hi,
i am using genuine norton internet security 2012. Recently realized that my norton cannot do live updates. i can't even surf any norton related website. but other website like google and facebook work perfectly fine. can anyone give me a hand here? thanks. |
|
|
|
|
|
Jul 7 2012, 07:14 AM
Show posts by this member only | Post
#2
|
Junior Member
29 posts Joined: Apr 2009
|
can u loggon to another antivirus webpage？ such as avira or kapasky
|
|
|
Jul 8 2012, 12:56 PM
Show posts by this member only | Post
#3
|
|
Junior Member
200 posts Joined: Sep 2008
|
QUOTE(tokthoo2002 @ Jul 7 2012, 07:14 AM) can u loggon to another antivirus webpage？ such as avira or kapasky i found that i cant surf any of the anti virus website..  can anyone help to so solve? |
|
|
Jul 8 2012, 02:40 PM
Show posts by this member only | Post
#4
|
Senior Member
657 posts Joined: Jul 2008 From: Bikini Bottom 
|
install spybot S&D, scan...
|
|
|
 Jul 12 2012, 11:35 AM
Show posts by this member only | Post
#5
|
 
VIP
18,182 posts Joined: Jan 2005 From: Dagobah
|
QUOTE(kentkoh @ Jul 6 2012, 03:12 PM) i am using genuine norton internet security 2012. Recently realized that my norton cannot do live updates. i can't even surf any norton related website. but other website like google and facebook work perfectly fine. can anyone give me a hand here? QUOTE(kentkoh @ Jul 8 2012, 12:56 PM) i found that i cant surf any of the anti virus website.. Sounds like malware infection. Nowadays many malware block antivirus websites. I would suggest you check the HOSTS file for starters (located at "\Windows\System32\drivers\etc" folder). Other than that, please post a HijackThis log for examination as well as scanning with Malwarebytes... can anyone help to so solve?  |
|
|
Jul 12 2012, 01:31 PM
Show posts by this member only | Post
#6
|
|
Junior Member
200 posts Joined: Sep 2008
|
QUOTE(lex @ Jul 12 2012, 11:35 AM) Sounds like malware infection. Nowadays many malware block antivirus websites. I would suggest you check the HOSTS file for starters (located at "\Windows\System32\drivers\etc" folder). Other than that, please post a HijackThis log for examination as well as scanning with Malwarebytes... i can't surf malwarebytes website. but i just run thru hijackthis. » Click to show Spoiler - click again to hide... « does it indicate anything? sorry coz i am not pro in computer, but really hope u guys can give me a hand here. i do not want my pc to be formatted. This post has been edited by kentkoh: Jul 12 2012, 01:33 PM |
|
|
|
|
|
Jul 12 2012, 02:14 PM
Show posts by this member only | Post
#7
|
Junior Member
64 posts Joined: Jun 2012
|
Have you check the HOSTS file as suggested? in c:\windows\system32\drivers\etc folder. Open the file with notepad.
|
|
|
Jul 12 2012, 02:45 PM
Show posts by this member only | Post
#8
|
|
VIP
18,182 posts Joined: Jan 2005 From: Dagobah
|
QUOTE(kentkoh @ Jul 12 2012, 01:31 PM) i can't surf malwarebytes website. Please check the HOSTS file as earlier mentioned...  Other than some adware (e.g. "Browser Configuration Utility", etc) and P2P stuff (e.g. Thunder, PPSteam, Xunlei, etc), noticed this... QUOTE(kentkoh @ Jul 12 2012, 01:31 PM) R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local While rest looks legit, thus there's a possibility of a rootkit (superhidden malware) in the system. Try using Rootkit Revealer to check for rootkits. Also try checking with TDSSKiller in case of the "bootkit" infection...  QUOTE(kentkoh @ Jul 12 2012, 01:31 PM) O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe Did you install this software yourself?  QUOTE(kentkoh @ Jul 12 2012, 01:31 PM) O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE') Did you use nLiteOS? O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') This post has been edited by lex: Jul 12 2012, 02:49 PM |
|
|
Jul 12 2012, 02:51 PM
Show posts by this member only | Post
#9
|
|
Junior Member
200 posts Joined: Sep 2008
|
QUOTE(lex @ Jul 12 2012, 02:45 PM) Please check the HOSTS file as earlier mentioned... YES I install teamview. Other than some adware (e.g. "Browser Configuration Utility", etc) and P2P stuff (e.g. Thunder, PPSteam, Xunlei, etc), noticed this...While rest looks legit, thus there's a possibility of a rootkit (superhidden malware) in the system. Try using Rootkit Revealer to check for rootkits. Also try checking with TDSSKiller in case of the "bootkit" infection... Did you install this software yourself? Did you use nLiteOS? may i know what is Nlite os? this is the rusult of rootkit: 
is there any virus?  |
|
|
Jul 12 2012, 03:59 PM
|
|
VIP
18,182 posts Joined: Jan 2005 From: Dagobah
|
QUOTE(kentkoh @ Jul 12 2012, 02:51 PM) YES I install teamview. Just need verification on this remote control software. QUOTE(kentkoh @ Jul 12 2012, 02:51 PM) may i know what is Nlite os? Its a Windows installation customization tool (usually for slimming down Windows and slipstreaming patches, drivers, updates, etc). You can check here: nLite - Deployment Tool for the bootable Unattended Windows installation. Of course, there's also the possibility of the malware disguising itself as nLiteOS since you did not know anything about using nLiteOS. QUOTE(kentkoh @ Jul 12 2012, 03:12 PM) this is the rusult of rootkit: Yes, there is. As I've suspected, a rootkit. Notice that weird file "C:\Documents and Settings\WindowsXP\Application Data\Vbjgjb.exe"? Try using HijackThis function "Delete a file on reboot..." to remove that file (first make sure to enable viewing files extensions, system files, hidden files and folders under Folder Options). After selecting that file or naming that file (just add the name directly, in case it cannot be seen), you will need to reboot to take effect. If that doesn't work, then try using Killbox to delete (also requires rebooting).
is there any virus? This post has been edited by lex: Jul 12 2012, 04:00 PM |
|
|
Jul 12 2012, 04:01 PM
|
All Stars
12,851 posts Joined: May 2005 From: Puchong, Selangor
|
Use another pc to download Malwarebytes :-
http://www.malwarebytes.org/ If you sucessful remove all malware/virus, reset the host file :- http://support.microsoft.com/kb/972034 |
|
|
Jul 12 2012, 04:51 PM
|
|
Junior Member
200 posts Joined: Sep 2008
|
QUOTE(lex @ Jul 12 2012, 03:59 PM) Just need verification on this remote control software. already change setting on view file, but can't get to find "C:\Documents and Settings\WindowsXP\Application Data\Vbjgjb.exe" on Hijackthis. Its a Windows installation customization tool (usually for slimming down Windows and slipstreaming patches, drivers, updates, etc). You can check here: nLite - Deployment Tool for the bootable Unattended Windows installation. Of course, there's also the possibility of the malware disguising itself as nLiteOS since you did not know anything about using nLiteOS. Yes, there is. As I've suspected, a rootkit. Notice that weird file "C:\Documents and Settings\WindowsXP\Application Data\Vbjgjb.exe"? Try using HijackThis function "Delete a file on reboot..." to remove that file (first make sure to enable viewing files extensions, system files, hidden files and folders under Folder Options). After selecting that file or naming that file (just add the name directly, in case it cannot be seen), you will need to reboot to take effect. If that doesn't work, then try using Killbox to delete (also requires rebooting). what should i do?? |
|
|
Jul 12 2012, 04:58 PM
|
|
VIP
18,182 posts Joined: Jan 2005 From: Dagobah
|
QUOTE(kentkoh @ Jul 12 2012, 04:51 PM) already change setting on view file, but can't get to find "C:\Documents and Settings\WindowsXP\Application Data\Vbjgjb.exe" on Hijackthis. Possibly because its "superhidden" (not visible to the operating system due to rootkit's own self-protection). Copy and paste the filename directly (you can save the log in RootkitRevealer, then open the log and copy the full filename). Otherwise, use Killbox (which allows direct filename without browsing for the file). what should i do?? |
|
|
|
|
|
Jul 12 2012, 10:56 PM
|
Senior Member
1,597 posts Joined: Aug 2010 From: Taufu Kingdom
|
TS do download process explorer from here:
http://download.cnet.com/Process-Explorer/...4-10223605.html and disable/kill the Vbjgjb.exe if you found any. TS might be able to disable the superhidden option under the folder option after the virus process had been killed. |
|
|
Jul 13 2012, 01:01 PM
|
|
Junior Member
200 posts Joined: Sep 2008
|
QUOTE(lex @ Jul 12 2012, 04:58 PM) Possibly because its "superhidden" (not visible to the operating system due to rootkit's own self-protection). Copy and paste the filename directly (you can save the log in RootkitRevealer, then open the log and copy the full filename). Otherwise, use Killbox (which allows direct filename without browsing for the file). killbox are not available to download. the webpage is dead.. any other recommendation or other link to download.sorry i have to request here without google it. my antivirus is outdated. hope can provide another link.tq QUOTE(sI Taufu @ Jul 12 2012, 10:56 PM) TS do download process explorer from here: i can't find any vbjgjb.exe from process explorer.http://download.cnet.com/Process-Explorer/...4-10223605.html and disable/kill the Vbjgjb.exe if you found any. TS might be able to disable the superhidden option under the folder option after the virus process had been killed. |
|
|
Jul 13 2012, 01:11 PM
|
|
Junior Member
64 posts Joined: Jun 2012
|
Hmm... do you have a Windows Vista or Windows 7 DVD lying around. You can use it's Windows PE to find the file.
 Or try opening command prompt (start menu > run > type in: cmd) now and type below to find the file. dir Vbjgjb.exe /s If you are able to find it in command prompt in the same folder then delete it by typing below (remember to include the quotes): del "C:\Documents and Settings\WindowsXP\Application Data\Vbjgjb.exe" |
|
|
Jul 14 2012, 01:32 PM
|
|
VIP
18,182 posts Joined: Jan 2005 From: Dagobah
|
QUOTE(kentkoh @ Jul 13 2012, 01:01 PM) killbox are not available to download. the webpage is dead.. any other recommendation or other link to download. Try this link: Softpedia > Windows > Security > Secure cleaning > Download Pocket Killbox - Allows you to erase programs that Windows Explorer doesn't allow you to remove... sorry i have to request here without google it. my antivirus is outdated. hope can provide another link.tq QUOTE(kentkoh @ Jul 13 2012, 01:01 PM) i can't find any vbjgjb.exe from process explorer. Rootkits are usually hidden in the task/process list also. That's why specific programs like RootkitRevealer are required to detect them.  |
| Change to: |  0.0255sec
 0.83
 6 queries
 GZIP Disabled
Time is now: 20th December 2025 - 05:15 PM |
Quote