Virus

[GingerAngles]

Sorry if this is in the wrong place but I wasn't sure where to post it!?!?!

A friend of mine has had an icon appear in his registry called Virusbuster. He already has norton antivirus and spyware software. this thing seams to have downloaded its self onto his machine. We have tried all sorts to get rid of it, to no avail. He can't get on the internet anymore although he can receive and send emails. Is this a virus, spyware? or is it a legitimate program simply conflicting with existing software? Has anyone had any dealings with this before???

Help!!!

 

[burtie]

Virusbuster is a program he must have downloaded it/bought it?go to add remove programs to see if its there if it is remove it!

 

[GingerAngles]

He swears not. So I don't know where it has come from!

Tried add/remove programs, removed it from the start menu, run 'regedit' and removed the obvious from there...

aaaaaarrrrrrrrrrrggggggggghhhhhhhh!!!!!!!!

plus, when you click on the icon it takes you to a web page or advert or whatever it is, telling you there are loads of virus' on you machine and you need to buy their product for $90!!

 

[Monstermunch]

.....He already has norton antivirus .....

Well there you go, thats the problem right there!

Get rid of that crap and use siomething like Avast or NOD32

 

[Duke]

As above - get some half decent antivirus like NOD32 and let rip

 

[GingerAngles]

LOL!!!!

Don't worry I've already told him that!!!! ha ha ha!

Do you think the problem may lie with norton rather than the other?

 

[The_KiD]

I can help if you like.

Can you download a copy of HiJackThis (www.merijn.org) install it into it's own folder i.e. (c:\HJT).

Close all running programs, especially MSN and IE then use HJT to create a log file and paste a copy here that I will go through for you.

However DO NOT USE HJT TO FIX ANYTHING YET. HJT not only shows infected system objects, but also some vital normal system objects and ficing the wrong thing can cause serious problems.

 

[bledd]

btw The_Kid

if you run hijackthis from anywhere, it copies itself to your pc somewhere else (i forget now where it is)

but once its been run once, you can start it again via

start, run, hijackthis

 

[The_KiD]

How odd, just tried this and it seems your half right.

It doesnt copy itself anywhere else on your system, but your right that you can just do START>RUN Hijackthis and it works, which is cool.

However the reason I ask people to move it to dir like C:\hjt\ is because then anything you fix with HiJackThis will be backed up into the the same folder, making it safer and easier to find should we need to restore an item

Cheers though!

 

[bledd]

touche'

should def copy it to c:\hjt then

when i'm fixing someone else's pc, i put it as a hidden subfolder of programfiles, so just incase something breaks from me fixing their pc, the backups are in there and hopefully they won't go delving in there to delete the folder!