Do I have a virus/trojan ?

[ptitterington]

Just a question,
A few nights ago while trying to find a way to delete all the old address bar searches I downloaded a program winbrush 17 day trial.

Somehow I ended up with a casino advert and home page and google bar was replaced with a casino bar.

I spent all evening trying to delete but it just kept coming back.
I used spybot, regscrub, adaware and ran norton antivirus. In the end I did a system restore to a few days before.

All appeared ok but I have now had norton pick up 2 trojans and everytime I reboot norton internet security is disabled even though I enable on startup.

Is there likely something evil in here?

Thanks

 

[Nodsu]

Oh yes.

 

[me(who else?)]

Did you have any trojan problems before, like, say...when you restored too? You might see if you could restore evn further back until the problem is gone.

Also, you could use msconfig to see what's running on startup and get rid of any suspicious files that are starting with windows.

 

[BrownPaper]

get Hijackthis and post a log of what it outputs. maybe we can identify suspicious entries.

if a program is free but from a shady site, it is probably filled with loads of spyware and other malware nasties. stick to more trustworthy sites like majorgeeks.com or something if you are going to download free stuff.

btw where did you download that winbrush program? i'll make a note to stay away from there.

 

[me(who else?)]

Download.com is good for downloading too...if a program includes malware or adware (like Kazaa) then the download page will list all the packages you're getting.

 

[Masque]

If I were you I'd take a look around HERE to see if your problem is described. They've pretty much got all the tools necessary to get yourself cleaned up. Good luck.

 

[ptitterington]

Thanks for the replies, Ill work through this weekend
I have also downloaded spywareblaster as recommended in the spybot/adaware post

thanks:grinthumb

 

[ptitterington]

Well, all appears ok, spybot and adaware and spyware blaster and norton all come back fine, but try as I might I cannot remove 'my web search (smiley central)' . Ad and remove locks and regedit does not do the job.

Masque, I looked at your link, it was good but the programmes that located any nasties want $$$ before they will remove it.

Only thing I have to remember to do is manually enable Norton internet security each time I reboot.

Thanks

 

[me(who else?)]

Put a reference to the internet security program into the registry under HKEY_LOCAL_MACHINE\SOFTWARE
\Microsoft\Windows\Run
Then the program will run on startup.

 

[BloodRaven]

whats the difference between a virus and a trojan anyways? arnt they both the same thing?

 

[BrownPaper]

Originally posted by BloodRaven
whats the difference between a virus and a trojan anyways? arnt they both the same thing?

bloodraven, the following link should explain the difference between a virus and trojan decently.

http://internet.about.com/cs/whatneedtoknow/a/aa_virus111203.htm

 

[poertner_1274]

The basic difference is that a trojan allows people to gain access to your computer, and can do anything they wish. A virus is usually something that just causes problems to Windows.

 

[PanicX]

Originally posted by ptitterington
All appeared ok but I have now had norton pick up 2 trojans and everytime I reboot norton internet security is disabled even though I enable on startup.

Did you resolve this issue? Like most new features, there's a good and a bad side to System Restore. Obviously, being able to restore your machine to a previously working state is a good thing, unfortunately, System Restore will also restore a virus if you where infected during the time of backup. Windows prevents any programs from writing to the space allocated for System Restore, and this will prevent Anti-Virus's from removing any infected files, hence your situation. To fully remove the virus, you'll have to disable System Restore and then scan your PC.

 

[GuruConsulting]

Internet hijackers

General information:

There are new attacks on your internet experience.

Hijacking programs that redirect you to their sites.

Adware addons that place new programs on your computer.

Google offers a popup blocker that also incorporates several addition programs to pop up or redirect you to sites that pay them for advertising. They do block popup that don't pay to their advertising program. Neat catch!

If you are looking for software that will clean your machine even in the demo mode check out http://www.lavasoft.de/ . Their software demo cleans most of the files, folders and keys out. The software is called Ad-Ware version 6.0

I used this with Pestpatrol and between the two I catch 99.9% of the software. Pestpatrol has both a demo download and an online demo you can try.

 

[ptitterington]

All is generally working fine other than Norton internet security will not enable on startup.

Spybot and adaware come back fine.

Im sure something is somewhere in there.

 

[me(who else?)]

What do you mean, won't enable on startup? Did you run msconfig to make it run on startup, or did you just add the key? I forgot to mention, you may need to use msconfig to enable Internet Scan on startup. Just search the forums for msconfig if you don't have it or don't know how to use it. The guides section also has a guide to altering startup.

 

[ptitterington]

I have done my best to do It,

I use msconfig to do selective startup stuff.

I was unable to add the key as I was too stupid
(Put a reference to the internet security program into the registry under HKEY_LOCAL_MACHINE\SOFTWARE
\Microsoft\Windows\Run
Then the program will run on startup.)

to find out how to put a reference here.

I did find that there was no reference to the above until I enable Norton Internet security.

Sorry for the stupidity but a step by step would be appreciated.

Many thanks

Father Innuendo
churchofchristiankinship.co.uk

 

[me(who else?)]

Go to Run and run regedit . Then, using the navigator at the side, find the correct folder. Double click on the folder. Then right click in the right pane and click ADD-->String Value. As the value put in the path of the .exe file for the internet security program.

There you go, a step-by-step