Can't access Symantec, McAfee, Sophos sites

I'm running Windows XP SP1 (Home Edition) & IE 6 SP1 and all of a sudden I can't run my Norton Live Update and can't even access the Symantec, McAfee, Sophos web sites. I get a page cannot be displayed. In my running processes there appears a msawindows.exe entry. The file is located in my Windows\System32 folder and is 138KB. The file does not have a version tab and has no references to Microsoft. I've run a full virus scan and it came up clean and my Norton virus definitions were updated 4/28/04. I've also ran Ad-aware and Spybot S&D which are both up to date and they found nothing. Should I do a System Restore back to a couple of days ago and should I delete the "msawindows.exe" file. I searched google and nothing comes up for that file name. Any help would be appreciated. I've also checked my HOSTS file and it is normal.

Edited to add: msawindows.exe also now appears under the Startup tab and is checkmarked in msconfig. It was nece there before.

Thanks in advance,
Tufenuf

Have you tried running a hijackthis log to see if it contains anything out of the ordinary? If not, you should. You can download Hijackthis from here. Then install the software into a folder of it's own, but not on the desktop. Click Scan, then after it scans, Save Log, when it opens in Notepad, copy and paste the log in this thread. We'll check it for you. ;)

photolady, Here's my HijackThis log.

Logfile of HijackThis v1.97.7
Scan saved at 6:25:35 AM, on 4/29/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINNT\System32\SK9910DM.EXE
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINNT\GWMDMMSG.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\msawindows.exe
C:\Documents and Settings\Owner\My Documents\HijackThis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iwon.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.net
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {3DE88907-3E38-11D4-BEB2-CBE76C0598DD} - C:\Program Files\ISP40\bin\BandObject.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\ISP40\hta\station.sbrt
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [mswspl] C:\Program Files\Windows Media Player\wmplayer.exe
O4 - HKLM\..\Run: [Microsoft Update] msawindows.exe
O4 - HKLM\..\RunServices: [Microsoft Update] msawindows.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/s...vest/gwCID.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...874.6221064815
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab

Thanks in advance,
Tufenuf

msawindows.exe seems to be the Windows Update file in your startup folder. This however sounds very suspicious to me because there is no mention of it anywhere.
My guess is its a virus/trojan/spyware that may have neutralized your NAV and blocked certain AV sites. Try to do an on-line virus scan such as Housecall (link in my sig), download A-Squared (in my sig) to scan for trojans, and run CWShredder.

Ok now here's what you need to do. Run Hijackthis again, closing all open windows including IE. Then tell hijackthis to fix the following problems:

O4 - HKLM\..\Run: [Microsoft Update] msawindows.exe
O4 - HKLM\..\RunServices: [Microsoft Update] msawindows.exe
C:\Program Files\ISP40\bin\BandObject.dll (file missing)

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.c...7874.6221064815

Then go to this file: C:\WINNT\System32\msawindows.exe and remove it physically from the computer.

Even though they say M$ updates they are not valid M$ update files.

photolady and usil,

photolady, I ran HijackThis and fixed the items you described and deleted the msawindows.exe file which corrected that problem.

usil, I ran HouseCall and it detected a "DOSAGABOT.AM virus in the C:\WINNT\System32]drivers\etc. folder which it stated was uncleanable.

I checked this out and my HOSTS file was modified as of this morning. Here is a copy of it.

Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

According to the info at the link below which I could reach here is what it says.

The virus appends to the hosts files in order to redirect the below URLs to the IP address 127.0.0.1. This will prevent users from accessing these websites to receive AV updates.

localhost
www.symantec.com
securityresponse.symantec.com
symantec.com
www.sophos.com
sophos.com
www.mcafee.com
mcafee.com
liveupdate.symantecliveupdate.com
www.viruslist.com
viruslist.com
viruslist.com
f-secure.com
www.f-secure.com
kaspersky.com
www.avp.com
www.kaspersky.com
avp.com
www.networkassociates.com
networkassociates.com
www.ca.com
ca.com
mast.mcafee.com
my-etrust.com
www.my-etrust.com
download.mcafee.com
dispatch.mcafee.com
secure.nai.com
nai.com
www.nai.com
update.symantec.com
updates.symantec.com
us.mcafee.com
liveupdate.symantec.com
customer.symantec.com
rads.mcafee.com
trendmicro.com
www.trendmicro.com


http://vil.nai.com/vil/content/v_101100.htm

I can't get to many of those sites listed above and can you good people tell me what my HOSTS file should look like and read. I still can't use LiveUpdate for my Norton AV 2003. I believe if I could get the HOSTS file edited correctly it may solve my problems.

Thanks for all your help on this,
Tufenuf

Hi Tufenuf

The Host file is a text file and for normal situations it is an empty file. Search for it. Open it in Notepad and delete the contents.

Note! the file we are talking about is called 'host' without any extension. BF

Here is some sites with HOSTS file information , you can also download a HOSTS file with many ad sites , tracking sites etc filled in so they are blocked .

http://www.accs-net.com/hosts/

http://www.mvps.org/winhelp2002/hosts.htm

BigFred, "The Host file is a text file and for normal situations it is an empty file. Search for it. Open it in Notepad and delete the contents."

Are you saying that I should open the HOSTS file (no extension) and delete all the contents so that is totally empty.

TIA,
Tufenuf

This is what an "empty" hosts file should look like.

Empty hosts file

DuaneB, My hosts file is exactly the same (see my reply above which has a I copied & pasted it) as the one you posted as an attachment. I'm at a loss as why I can't get to any of the Antivirus sites (Symantec, MacAfee) and I can't run my NortonAV 2003 Live Update either. Any other suggestions would be welcome.

TIA,
Tufenuf

www.ravantivirus.com/scan/indexie.php is by far the best virus scanner I as of last week. Try going there and scanning your computer. It picks up viruses I made myself and a whole lot of other stuff that McAfee and Norton can not even recognize. For example Rootkits bypass McAfee and Norton like they had their back turned and eyes shut when scanning.

Your McAfee link lists Gaobot as an alias. Why not try a removal tool for Gaobot. It won't do any harm if the tool doesn't find anything.
http://securityresponse.symantec.com...oval.tool.html

Or, a more general removal tool McAfee's Avert Stinger v.2.2.2
http://vil.nai.com/vil/averttools.asp

This has me half nuts. The "msawindows.exe" came back and also the entries I fixed in HijackThis. I ran HijackThis again and fixed and removed them (see log in my previous post). I ran RAV on-line scan and it comes up clean and I ran my Norton AV full scan and also came up clean. I still can't reach Symantec sites or McAfee and even was having trouble getting to this site untill I ran HijackThis and fixed the entries for "msawindows.exe" which I also deleted that file again. I can't run Live Update for Norton and it gives me an error but I can't get to the Symantec Support site to look for a fix. Would anyone recommend that I try a System Restore prior to when this horror show began. I didn't open any e-mails or attachments and only visited my normal web sites and had my updated Norton AV running in Real Time mode. I am totally frustrated at this point and never ran into anything like this before. What about a System Restore good people. Please give me your opinions.

TIA,
Tufenuf

System Restore is your friend. Definitely use System Restore if you have a good Restore point from a time before this problem started.