Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1163
  • Last Modified:

Virus problems! Pinom.J worm

Hello, i completed a full avg virus scan on my PC, which found and removed Worm/Pinom.J from a file called SETUP.EXE that had been copyed to some of my shared folders.
I am unable to access websites like www.grisoft.com symantec, sofos etc, any antivirus website...
Can anyone advice me?

madlan.
0
madlan
Asked:
madlan
  • 5
  • 2
1 Solution
 
anil_uCommented:
Some viruses add urls to the "hosts" file, find this file on you PC, this should be in
c:\WINNT\system32\etc
open it with notepad
and then delete all of them except
127.0.0.1       localhost

for example there will be one that says
127.0.0.1      www.symantec.com

when you try to go to this site, it looks at the host file, then uses the static ip assigned to symantec.com which is 127.0.0.1, which is a loopback address, ie your machine, thats why you get an error beacuse it goes to 127.0.0.1, removing this line will allow you to access symantec.com

After that you should be able to access the required sites, do the upadtes and you should be fine.


Hope I could help

Enjoy
Anil
0
 
madlanAuthor Commented:
I cant seem to find the host file? (win XP home)
All 5 pcs on the network have the same problem, same sites cant be accessed.
i notice that 172.0.0.1 appears in the status bar while connecting to said websites.

madlan.
0
 
anil_uCommented:
This is a private address.
Try this:
Go to start->Search->Find files and folder->hosts*.*

The host file has not got an extention like .exe. But it will definately be there.

On XP it should be on c:\windows\system32\drivers\etc



0
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

 
madlanAuthor Commented:
OK, i found it:
C:\WINDOWS\system32\drivers\etc\Hosts

and you were right! thankyou!

Do you know anything about this virus? i cant find any information on it.
Just want to make sure its not damaged anything else...

thankyou

----------------------------------------------------------------------------------------------------------
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost





127.0.0.1      www.symantec.com
127.0.0.1      securityresponse.symantec.com
127.0.0.1      symantec.com
127.0.0.1      www.sophos.com
127.0.0.1      sophos.com
127.0.0.1      www.mcafee.com
127.0.0.1      mcafee.com
127.0.0.1      liveupdate.symantecliveupdate.com
127.0.0.1      www.viruslist.com
127.0.0.1      viruslist.com
127.0.0.1      viruslist.com
127.0.0.1      f-secure.com
127.0.0.1      www.f-secure.com
127.0.0.1      kaspersky.com
127.0.0.1      kaspersky-labs.com
127.0.0.1      www.avp.com
127.0.0.1      www.kaspersky.com
127.0.0.1      avp.com
127.0.0.1      www.networkassociates.com
127.0.0.1      networkassociates.com
127.0.0.1      www.ca.com
127.0.0.1      ca.com
127.0.0.1      mast.mcafee.com
127.0.0.1      my-etrust.com
127.0.0.1      www.my-etrust.com
127.0.0.1      download.mcafee.com
127.0.0.1      dispatch.mcafee.com
127.0.0.1      secure.nai.com
127.0.0.1      nai.com
127.0.0.1      www.nai.com
127.0.0.1      update.symantec.com
127.0.0.1      updates.symantec.com
127.0.0.1      us.mcafee.com
127.0.0.1      liveupdate.symantec.com
127.0.0.1      customer.symantec.com
127.0.0.1      rads.mcafee.com
127.0.0.1      trendmicro.com
127.0.0.1      www.trendmicro.com
127.0.0.1      www.grisoft.com
0
 
anil_uCommented:
Yes it look fine
delete the following

127.0.0.1     www.symantec.com
127.0.0.1     securityresponse.symantec.com
127.0.0.1     symantec.com
127.0.0.1     www.sophos.com
127.0.0.1     sophos.com
127.0.0.1     www.mcafee.com
127.0.0.1     mcafee.com
127.0.0.1     liveupdate.symantecliveupdate.com
127.0.0.1     www.viruslist.com
127.0.0.1     viruslist.com
127.0.0.1     viruslist.com
127.0.0.1     f-secure.com
127.0.0.1     www.f-secure.com
127.0.0.1     kaspersky.com
127.0.0.1     kaspersky-labs.com
127.0.0.1     www.avp.com
127.0.0.1     www.kaspersky.com
127.0.0.1     avp.com
127.0.0.1     www.networkassociates.com
127.0.0.1     networkassociates.com
127.0.0.1     www.ca.com
127.0.0.1     ca.com
127.0.0.1     mast.mcafee.com
127.0.0.1     my-etrust.com
127.0.0.1     www.my-etrust.com
127.0.0.1     download.mcafee.com
127.0.0.1     dispatch.mcafee.com
127.0.0.1     secure.nai.com
127.0.0.1     nai.com
127.0.0.1     www.nai.com
127.0.0.1     update.symantec.com
127.0.0.1     updates.symantec.com
127.0.0.1     us.mcafee.com
127.0.0.1     liveupdate.symantec.com
127.0.0.1     customer.symantec.com
127.0.0.1     rads.mcafee.com
127.0.0.1     trendmicro.com
127.0.0.1     www.trendmicro.com
127.0.0.1     www.grisoft.com


Then save the file, then try to access nai.com or symantec.com etc


0
 
anil_uCommented:
Regarding the virus
have a look at
http://www.sophos.com/virusinfo/analyses/w32cissic.html
0
 
anil_uCommented:
Hey did that work, anyways glad I could help :)

Please dont forget to allocate the points.

Thanks
Anil
0
 
ISKPatelCommented:
Dear this is all Worm
i have a site where u remove this all problums
see this
www.pandasoftware.com/activescan/default_com.asp
this is onlive traking & cleaning+scanning tools for any worm & virus ..
plz chk it out
Best regards
ISKPatel
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now