gerlis
asked on
mousebut.exe trojan?
I have had two instances of people with this virus/trojan in the last week.
One on Win 98 was captured by Norton but left a reference to it in the win.ini on start-up. I removed the win.ini reference and all is OK
The other, today on Win 2000 Pro was captured by Norton, but Norton AV keeps picking it up and giving the user a message on the screen that it has found a trojan.
There is hardly any reference to it on the web, nothing on Symantec or MSKB, Sophos or Mcafee.
Anyone know about this?
One on Win 98 was captured by Norton but left a reference to it in the win.ini on start-up. I removed the win.ini reference and all is OK
The other, today on Win 2000 Pro was captured by Norton, but Norton AV keeps picking it up and giving the user a message on the screen that it has found a trojan.
There is hardly any reference to it on the web, nothing on Symantec or MSKB, Sophos or Mcafee.
Anyone know about this?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I was able to see the problem first-hand today at this client
It had simply left the remnants of the virus (ie references to mousebut.exe) in about 3 placres in the registry. Norton's had actually successfully deleted the infected file itself. Once the values were removed from the registry, no more start-up message appeared.
It has nothign to do specifically with shares across a network, it is defined by Nortons as a rare trojan (maybe not so rare now, eh?). All viruses love networks and will rapidly spread across them, if they can.
In this instance I have to give the points to ghana as the soloution was a registry clean to remove the mousebut.exe references.
Thanks to all
Howard Gerlis
It had simply left the remnants of the virus (ie references to mousebut.exe) in about 3 placres in the registry. Norton's had actually successfully deleted the infected file itself. Once the values were removed from the registry, no more start-up message appeared.
It has nothign to do specifically with shares across a network, it is defined by Nortons as a rare trojan (maybe not so rare now, eh?). All viruses love networks and will rapidly spread across them, if they can.
In this instance I have to give the points to ghana as the soloution was a registry clean to remove the mousebut.exe references.
Thanks to all
Howard Gerlis
Thanks. Glad we could help you.
ASKER
E-E help always appreciated.
I like to think I represent the UK section! I live in London.
I like to think I represent the UK section! I live in London.
Check to see if the hard drive is shared...
i.e. do you have a share allowed on the c: drive of the win 98 box...
If you do MAKE SURE YOU HAVE A GOOD PASSWORD.....
Do not allow a NO PASSWORD or SHORT WORD password
Some viruses will try to install themselves using vulnerabilities in the OS....
Make sure you have your OSes updated.......
I had a Client with the exact same problem.....
the issue was that they had shared the win 98 box c: drive without a password...
Check this see what happens...
also norton should note what virus it spots...
what is the name of the virus???