Solved

mousebut.exe trojan?

Posted on 2004-03-23
5
446 Views
Last Modified: 2010-04-12
I have had two instances of people with this virus/trojan in the last week.

One on Win 98 was captured by Norton but left a reference to it in the win.ini on start-up. I removed the win.ini reference and all is OK

The other, today on Win 2000 Pro was captured by Norton, but Norton AV keeps picking it up and giving the user a message on the screen that it has found a trojan.

There is hardly any reference to it on the web, nothing on Symantec or MSKB, Sophos or Mcafee.

Anyone know about this?
0
Comment
Question by:gerlis
  • 2
  • 2
5 Comments
 
LVL 11

Accepted Solution

by:
ghana earned 125 total points
ID: 10660827
I just found this URL:
http://www.mcse.ms/message433341.html

I would search the registry for mousebut.exe items and delete them as described.
0
 
LVL 4

Expert Comment

by:hawgpig
ID: 10677427
I have had this problem before....
Check to see if the hard drive is shared...
i.e. do you have a share allowed on the c: drive of the win 98 box...
If you do MAKE SURE YOU HAVE A GOOD PASSWORD.....
Do not allow a NO PASSWORD or SHORT WORD password
Some viruses will try to install themselves using vulnerabilities in the OS....
Make sure you have your OSes updated.......
I had a Client with the exact same problem.....
the issue was that they had shared the win 98 box c: drive without a password...
Check this see what happens...
also norton should note what virus it spots...
what is the name of the virus???

0
 
LVL 1

Author Comment

by:gerlis
ID: 10708121
I was able to see the problem first-hand today at this client

It had simply left the remnants of the virus (ie references to mousebut.exe) in about 3 placres in the registry. Norton's had actually successfully deleted the infected file itself. Once the values were removed from the registry, no more start-up message appeared.

It has nothign to do specifically with shares across a network, it is defined by Nortons as a rare trojan (maybe not so rare now, eh?). All viruses love networks and will rapidly spread across them, if they can.

In this instance I have to give the points to ghana as the soloution was a registry clean to remove the mousebut.exe references.

Thanks to all

Howard Gerlis
0
 
LVL 11

Expert Comment

by:ghana
ID: 10708188
Thanks. Glad we could help you.
0
 
LVL 1

Author Comment

by:gerlis
ID: 10708208
E-E help always appreciated.

I like to think I represent the UK section! I live in London.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Hacking attemps 3 83
Malwarebytes software 16 208
User opened attached zip file - are they infected? 14 111
Google Play app store not being blocked from smartphones 4 31
This article summarizes using a simple matrix to map the different type of phishing attempts and its targeted victims. It also run through many scam scheme scenario with "real" phished emails. There are safeguards highlighted to stay vigilance and h…
SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now