mousebut.exe trojan?

I have had two instances of people with this virus/trojan in the last week.

One on Win 98 was captured by Norton but left a reference to it in the win.ini on start-up. I removed the win.ini reference and all is OK

The other, today on Win 2000 Pro was captured by Norton, but Norton AV keeps picking it up and giving the user a message on the screen that it has found a trojan.

There is hardly any reference to it on the web, nothing on Symantec or MSKB, Sophos or Mcafee.

Anyone know about this?
LVL 1
gerlisAsked:
Who is Participating?
 
ghanaConnect With a Mentor Commented:
I just found this URL:
http://www.mcse.ms/message433341.html

I would search the registry for mousebut.exe items and delete them as described.
0
 
hawgpigCommented:
I have had this problem before....
Check to see if the hard drive is shared...
i.e. do you have a share allowed on the c: drive of the win 98 box...
If you do MAKE SURE YOU HAVE A GOOD PASSWORD.....
Do not allow a NO PASSWORD or SHORT WORD password
Some viruses will try to install themselves using vulnerabilities in the OS....
Make sure you have your OSes updated.......
I had a Client with the exact same problem.....
the issue was that they had shared the win 98 box c: drive without a password...
Check this see what happens...
also norton should note what virus it spots...
what is the name of the virus???

0
 
gerlisAuthor Commented:
I was able to see the problem first-hand today at this client

It had simply left the remnants of the virus (ie references to mousebut.exe) in about 3 placres in the registry. Norton's had actually successfully deleted the infected file itself. Once the values were removed from the registry, no more start-up message appeared.

It has nothign to do specifically with shares across a network, it is defined by Nortons as a rare trojan (maybe not so rare now, eh?). All viruses love networks and will rapidly spread across them, if they can.

In this instance I have to give the points to ghana as the soloution was a registry clean to remove the mousebut.exe references.

Thanks to all

Howard Gerlis
0
 
ghanaCommented:
Thanks. Glad we could help you.
0
 
gerlisAuthor Commented:
E-E help always appreciated.

I like to think I represent the UK section! I live in London.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.