Do I have a virus/trojan ?

By ptitterington ยท 17 replies
Apr 7, 2004
  1. Just a question,
    A few nights ago while trying to find a way to delete all the old address bar searches I downloaded a program winbrush 17 day trial.

    Somehow I ended up with a casino advert and home page and google bar was replaced with a casino bar.

    I spent all evening trying to delete but it just kept coming back.
    I used spybot, regscrub, adaware and ran norton antivirus. In the end I did a system restore to a few days before.

    All appeared ok but I have now had norton pick up 2 trojans and everytime I reboot norton internet security is disabled even though I enable on startup.

    Is there likely something evil in here?

  2. Nodsu

    Nodsu TS Rookie Posts: 5,837   +6

    Oh yes.
  3. me(who else?)

    me(who else?) TS Rookie Posts: 387

    Did you have any trojan problems before, like, say...when you restored too? You might see if you could restore evn further back until the problem is gone.

    Also, you could use msconfig to see what's running on startup and get rid of any suspicious files that are starting with windows.
  4. BrownPaper

    BrownPaper TS Rookie Posts: 407

    get Hijackthis and post a log of what it outputs. maybe we can identify suspicious entries.

    if a program is free but from a shady site, it is probably filled with loads of spyware and other malware nasties. stick to more trustworthy sites like or something if you are going to download free stuff.

    btw where did you download that winbrush program? i'll make a note to stay away from there.
  5. me(who else?)

    me(who else?) TS Rookie Posts: 387 is good for downloading too...if a program includes malware or adware (like Kazaa) then the download page will list all the packages you're getting.
  6. Masque

    Masque TechSpot Chancellor Posts: 1,058

    If I were you I'd take a look around HERE to see if your problem is described. They've pretty much got all the tools necessary to get yourself cleaned up. Good luck.
  7. ptitterington

    ptitterington TS Maniac Topic Starter Posts: 255

    Thanks for the replies, Ill work through this weekend
    I have also downloaded spywareblaster as recommended in the spybot/adaware post

  8. ptitterington

    ptitterington TS Maniac Topic Starter Posts: 255

    Well, all appears ok, spybot and adaware and spyware blaster and norton all come back fine, but try as I might I cannot remove 'my web search (smiley central)' . Ad and remove locks and regedit does not do the job.

    Masque, I looked at your link, it was good but the programmes that located any nasties want $$$ before they will remove it.

    Only thing I have to remember to do is manually enable Norton internet security each time I reboot.

  9. me(who else?)

    me(who else?) TS Rookie Posts: 387

    Put a reference to the internet security program into the registry under HKEY_LOCAL_MACHINE\SOFTWARE
    Then the program will run on startup.
  10. BloodRaven

    BloodRaven TS Rookie Posts: 89

    whats the difference between a virus and a trojan anyways? arnt they both the same thing?
  11. BrownPaper

    BrownPaper TS Rookie Posts: 407

  12. poertner_1274

    poertner_1274 secroF laicepS topShceT Posts: 4,172

    The basic difference is that a trojan allows people to gain access to your computer, and can do anything they wish. A virus is usually something that just causes problems to Windows.
  13. PanicX

    PanicX TechSpot Ambassador Posts: 669

    Did you resolve this issue? Like most new features, there's a good and a bad side to System Restore. Obviously, being able to restore your machine to a previously working state is a good thing, unfortunately, System Restore will also restore a virus if you where infected during the time of backup. Windows prevents any programs from writing to the space allocated for System Restore, and this will prevent Anti-Virus's from removing any infected files, hence your situation. To fully remove the virus, you'll have to disable System Restore and then scan your PC.
  14. GuruConsulting

    GuruConsulting TS Rookie

    Internet hijackers

    General information:

    There are new attacks on your internet experience.

    Hijacking programs that redirect you to their sites.

    Adware addons that place new programs on your computer.

    Google offers a popup blocker that also incorporates several addition programs to pop up or redirect you to sites that pay them for advertising. They do block popup that don't pay to their advertising program. Neat catch!

    If you are looking for software that will clean your machine even in the demo mode check out . Their software demo cleans most of the files, folders and keys out. The software is called Ad-Ware version 6.0

    I used this with Pestpatrol and between the two I catch 99.9% of the software. Pestpatrol has both a demo download and an online demo you can try.
  15. ptitterington

    ptitterington TS Maniac Topic Starter Posts: 255

    All is generally working fine other than Norton internet security will not enable on startup.

    Spybot and adaware come back fine.

    Im sure something is somewhere in there.

  16. me(who else?)

    me(who else?) TS Rookie Posts: 387

    What do you mean, won't enable on startup? Did you run msconfig to make it run on startup, or did you just add the key? I forgot to mention, you may need to use msconfig to enable Internet Scan on startup. Just search the forums for msconfig if you don't have it or don't know how to use it. The guides section also has a guide to altering startup.
  17. ptitterington

    ptitterington TS Maniac Topic Starter Posts: 255

    I have done my best to do It,

    I use msconfig to do selective startup stuff.

    I was unable to add the key as I was too stupid
    (Put a reference to the internet security program into the registry under HKEY_LOCAL_MACHINE\SOFTWARE
    Then the program will run on startup.)

    to find out how to put a reference here.

    I did find that there was no reference to the above until I enable Norton Internet security.

    Sorry for the stupidity but a step by step would be appreciated.

    Many thanks

    Father Innuendo
  18. me(who else?)

    me(who else?) TS Rookie Posts: 387

    Go to Run and run regedit . Then, using the navigator at the side, find the correct folder. Double click on the folder. Then right click in the right pane and click ADD-->String Value. As the value put in the path of the .exe file for the internet security program.

    There you go, a step-by-step ;)
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...