TechSpot

Do I have a virus/trojan ?

By ptitterington
Apr 7, 2004
Topic Status:
Not open for further replies.
  1. Just a question,
    A few nights ago while trying to find a way to delete all the old address bar searches I downloaded a program winbrush 17 day trial.

    Somehow I ended up with a casino advert and home page and google bar was replaced with a casino bar.

    I spent all evening trying to delete but it just kept coming back.
    I used spybot, regscrub, adaware and ran norton antivirus. In the end I did a system restore to a few days before.

    All appeared ok but I have now had norton pick up 2 trojans and everytime I reboot norton internet security is disabled even though I enable on startup.

    Is there likely something evil in here?

    Thanks:(
  2. Nodsu

    Nodsu TS Rookie Posts: 9,431

    Oh yes.
  3. me(who else?)

    me(who else?) TS Rookie Posts: 433

    Did you have any trojan problems before, like, say...when you restored too? You might see if you could restore evn further back until the problem is gone.

    Also, you could use msconfig to see what's running on startup and get rid of any suspicious files that are starting with windows.
  4. BrownPaper

    BrownPaper TS Rookie Posts: 467

    get Hijackthis and post a log of what it outputs. maybe we can identify suspicious entries.

    if a program is free but from a shady site, it is probably filled with loads of spyware and other malware nasties. stick to more trustworthy sites like majorgeeks.com or something if you are going to download free stuff.

    btw where did you download that winbrush program? i'll make a note to stay away from there.
  5. me(who else?)

    me(who else?) TS Rookie Posts: 433

    Download.com is good for downloading too...if a program includes malware or adware (like Kazaa) then the download page will list all the packages you're getting.
  6. Masque

    Masque TechSpot Chancellor Posts: 1,212

    If I were you I'd take a look around HERE to see if your problem is described. They've pretty much got all the tools necessary to get yourself cleaned up. Good luck.
  7. ptitterington

    ptitterington TS Maniac Topic Starter Posts: 376

    Thanks for the replies, Ill work through this weekend
    I have also downloaded spywareblaster as recommended in the spybot/adaware post

    thanks:grinthumb
  8. ptitterington

    ptitterington TS Maniac Topic Starter Posts: 376

    Well, all appears ok, spybot and adaware and spyware blaster and norton all come back fine, but try as I might I cannot remove 'my web search (smiley central)' . Ad and remove locks and regedit does not do the job.

    Masque, I looked at your link, it was good but the programmes that located any nasties want $$$ before they will remove it.

    Only thing I have to remember to do is manually enable Norton internet security each time I reboot.

    Thanks
  9. me(who else?)

    me(who else?) TS Rookie Posts: 433

    Put a reference to the internet security program into the registry under HKEY_LOCAL_MACHINE\SOFTWARE
    \Microsoft\Windows\Run
    Then the program will run on startup.
  10. BloodRaven

    BloodRaven TS Rookie Posts: 118

    whats the difference between a virus and a trojan anyways? arnt they both the same thing?
  11. BrownPaper

    BrownPaper TS Rookie Posts: 467

     
  12. poertner_1274

    poertner_1274 secroF laicepS topShceT Posts: 4,745

    The basic difference is that a trojan allows people to gain access to your computer, and can do anything they wish. A virus is usually something that just causes problems to Windows.
  13. PanicX

    PanicX TechSpot Ambassador Posts: 829

    Did you resolve this issue? Like most new features, there's a good and a bad side to System Restore. Obviously, being able to restore your machine to a previously working state is a good thing, unfortunately, System Restore will also restore a virus if you where infected during the time of backup. Windows prevents any programs from writing to the space allocated for System Restore, and this will prevent Anti-Virus's from removing any infected files, hence your situation. To fully remove the virus, you'll have to disable System Restore and then scan your PC.
  14. GuruConsulting

    GuruConsulting TS Rookie

    Internet hijackers

    General information:

    There are new attacks on your internet experience.

    Hijacking programs that redirect you to their sites.

    Adware addons that place new programs on your computer.

    Google offers a popup blocker that also incorporates several addition programs to pop up or redirect you to sites that pay them for advertising. They do block popup that don't pay to their advertising program. Neat catch!

    If you are looking for software that will clean your machine even in the demo mode check out http://www.lavasoft.de/ . Their software demo cleans most of the files, folders and keys out. The software is called Ad-Ware version 6.0

    I used this with Pestpatrol and between the two I catch 99.9% of the software. Pestpatrol has both a demo download and an online demo you can try.
  15. ptitterington

    ptitterington TS Maniac Topic Starter Posts: 376

    All is generally working fine other than Norton internet security will not enable on startup.

    Spybot and adaware come back fine.

    Im sure something is somewhere in there.

    :(
  16. me(who else?)

    me(who else?) TS Rookie Posts: 433

    What do you mean, won't enable on startup? Did you run msconfig to make it run on startup, or did you just add the key? I forgot to mention, you may need to use msconfig to enable Internet Scan on startup. Just search the forums for msconfig if you don't have it or don't know how to use it. The guides section also has a guide to altering startup.
  17. ptitterington

    ptitterington TS Maniac Topic Starter Posts: 376

    I have done my best to do It,

    I use msconfig to do selective startup stuff.

    I was unable to add the key as I was too stupid
    (Put a reference to the internet security program into the registry under HKEY_LOCAL_MACHINE\SOFTWARE
    \Microsoft\Windows\Run
    Then the program will run on startup.)

    to find out how to put a reference here.

    I did find that there was no reference to the above until I enable Norton Internet security.

    Sorry for the stupidity but a step by step would be appreciated.

    Many thanks

    Father Innuendo
    churchofchristiankinship.co.uk
  18. me(who else?)

    me(who else?) TS Rookie Posts: 433

    Go to Run and run regedit . Then, using the navigator at the side, find the correct folder. Double click on the folder. Then right click in the right pane and click ADD-->String Value. As the value put in the path of the .exe file for the internet security program.

    There you go, a step-by-step ;)
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.