Virus, please help

[UKBob]

From the beginning:

I have Norton (2006, firewall and antivirus)

I was googling for Monty Python, and clicked on a link IN google, and got a "preparing to install microsoft office" or similar message. I clicked cancel several times, norton detected two threats and said that they had been removed.

trojan.textcash
adware.mira (possibly spelt wrong as google turns up nothing)

After rebooting, my dialup icons had changed so I updated norton, ran a full scan, and it found nothing.

I did an AAW (adware) scan, which found and removed 10 items.
I rebooted, ran norton again (found nothing) but adware found 16 items, all of which were deleted.

Each time I reboot, my dialup details are changed.

Also, some new programs were added to the start menu.
winporn
dating
lipgame

Help - Normally I can remove viruses myself. I did disable system restore but unfortunately Norton cant find anything.

Thanks in advance for help chaps. Whilst I appreciate any "norton sucks, use avg" comments, all I need help with right now is getting rid of this malware.

[FunkyGibbon]

info on lipgame here...

www.viruslist.com/en/viruses/encyclopedia?virusid=110065

hope this helps

[UKBob]

FunkyGibbon said:

info on lipgame here... www.viruslist.com/en/viruses/encyclopedia?virusid=110065 hope this helps

Cheers Gibbon. How do I delete it from the registry? run>regedit as I recall, but when the registry editor loads, a windows explorer type interface loads and I dont know what to do next

[FunkyGibbon]

UKBob said:

FunkyGibbon said: info on lipgame here... www.viruslist.com/en/viruses/encyclopedia?virusid=110065 hope this helps Cheers Gibbon. How do I delete it from the registry? run>regedit as I recall, but when the registry editor loads, a windows explorer type interface loads and I dont know what to do next

go to the find option in the top menu bar and search for

itunesff.exe

hopefully this will only find one HKEY - then simply right click on it and delete.

Take a system backup first though in case you kill the registry.

[Plotloss]

Save yourself the hassle and download and install Ewido

[FunkyGibbon]

Plotloss said:

Save yourself the hassle and download and install Ewido

indeed - a good piece of kit

[UKBob]

Im running the online scan now, thanks for the recommendation

www.ewido.net/en/onlinescan/ Do I need to download it, or will an online scan be satisfactory?

[Podie]

Bob, we really should get round to having that chat

[GreenV8S]

Unless you're confident in your ability to fix the registry when you break it, or *very* brave, I suggest you stay away from regedit. Spybot lets you modify the startup sequence in a safer way, I expect there are tons of other similar products that do. If you can't fix it simply using this sort of tool then you have a much harder task to unpick the infection. Be warned that this sort of thing does require a detailed understanding of the internal workings of windows and not the sort of thing that an ordinary user could expect to cope with.

[Jinx]

GreenV8S said:

Spybot lets you modify the startup sequence in a safer way, I expect there are tons of other similar products that do.

Autoruns from sysinternals

Right click and it will google the name of the file as well - helps numpty's like me gain confidence to delete stuff.

>> Edited by Jinx on Tuesday 4th April 13:35

[UKBob]

Podie said:

Bob, we really should get round to having that chat

thats a big 10-4 good buddy, let the boss man finish his channel 9 coms and I'll be home 20 and free for that chat

[UKBob]

Argh... I found a few files when I searched the registry that had "itunesff.exe" and just right clicked and deleted them.

Fingers crossed that nothing bad will happen, then... :gulp: :bitesnails:

[randlemarcus]

Bob, take the unsubtle hints above. STOP MESSING ABOUT WITH THE REGISTRY!!

Go here, load this, do a proper scan, relax. Easy life.

www.microsoft.com/athome/security/spyware/software/default.mspx

PS Norton sucks, use AVG

Edited to add the link that I told Bob to go to in the first place. Muppet.

>> Edited by randlemarcus on Tuesday 4th April 15:43

[UKbob]

randlemarcus said:

Bob, take the unsubtle hints above. STOP MESSING ABOUT WITH THE REGISTRY!! Go here, load this, do a proper scan, relax. Easy life. PS Norton sucks, use AVG

Go where? Im not a bloody mind reader ya know

I stopped messing with the registry after the first post saying not to do so

[UKbob]

Thanks for your help chaps, links and suggestions appreciated