i'm hoping you all can help with a problem i'm having with a friend's computer. she uses DSL and had NO virus protection and NO firewall for at least six months. i installed norton antivirus 2003, ad-aware, and sygate firewall and ended up scanning and removing more than 65 infected files and 300 spyware components. everything was working fine, then she told me her liveupdate wasn't working. i looked at the computer and discovered i couldn't get to symantec's website, and got suspicious about gaobot. i downloaded current virus definitions on my computer, then ftp'd them to a site so she could download and install them. after that, she ran a full scan and told me it found a gaobot infection. she brought the computer to me and i couldn't find anything in her quarantine, so i ran another complete system scan, which came back clean. however, liveupdate still wouldn't work, and i'm unable to browse to either symantec's or mcafee's website, so i'm suspicious. we completely uninstalled and reinstalled norton with current virus definitions, and nothing changed--nothing's found in the scan and still can't use liveupdate or get to antivirus websites. i tried starting in safe mode and running a scan there, but it wouldn't run (no hourglass, no error, just no response). i even downloaded the gaobot removal fixtool from a non-symantec website and the scan came back clean. obviously there's still something wrong here, and i'm not sure what to try next. can anyone help? thanks in advance. ann

Have you turned system restore off and then restarted the computer to enter the safe mode? Viru/worms love to hide in those protected files. Since you do have a limited internet access with the infected computer you could try downloading a trial version of SOLO from http://www.srnmicro.com/ You could of course download it your computer and burn it to a cd and then install it, if you have to. I have had some success using it when other antivirus programs cannot be used due to corruption of their system integrity.

Its probably best if you can place the hard drive as slave in another pc and scan there. I would run AntiVir , it works http://www.free-av.com/index.htm Also, try a good AntiTrojan for assurance ...TDS3 http://tds.diamondcs.com.au/index.php?page=download

Go to Trend Micro (PC Cillin) website and run their free online scan. Just follow the directions. Unlike some, Trend will kill whatever it finds and is very thorough: http://housecall.trendmicro.com/

ann, It very well could be the hosts(no extension)file was altered by the trojan/virus. Go to the link below and follow the instructions under "Do this first: Check a Windows file" for the version of Windows on the problem computer. Here's what the hosts file for Windows XP should look like. # Copyright (c) 1993-1999 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a '#' symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host 127.0.0.1 localhost The hosts(no extension)file to check is in the C:\Windows\System32\drivers\etc directory (folder). Note: Delete every entry below 127.0.0.1 localhost DO NOT DELETE 127.0.0.1 localhost I had a variant of the W32.HLLW.Gaobot.gen trojan a few weeks ago and had the same exact problem. NAV 2003 Live Update Problems HTH, Tufenuf

tufenuf--thanks so much! that was exactly the problem, and as soon as i fixed the host file i was able to update her virus definitions using liveupdate. i'm running a full system scan now and can only hope we're nearing the end of this ordeal. thanks a lot for all your help! ann