STORM2K

There is this banner on the bottom right (near the clock) of my screen stating I have a worm. When I click on it, it takes me to a site where they do a scan and then want me to buy something to get rid of the worm. I did a scan on Norton and Ad-Aware-se, and niether one found anything. Is it real? How do I get rid of the banner?

Sorry no help from me.... not that much of a computer nerd.

The best thing I found to clear up virus and junk like that is downloading a free program called Avast... You can go to http://www.avast.com or http://www.download.com and type in avast.... This is my fav program for keeping junk out!! and its free... i have used it for years and yet to have a problem.... let me know if that helps!!

Sounds like the banner display has written itself into your registry.

You could click Start then run then type regedit and look in

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Try checking usenet for the name of the product that shanghaied you.

If nothing is recognizable in the registry try looking for a hidden file using this utility.

http://home.mnet-online.de/horst.muc/int/find23.zip

unzip it and click the Xfind to extract xfind.com

drag xfind.com from the find23 folder where you downloaded it to C:\

click start then run then type CMD

type CD\ and press enter

type or copy and paste xfind "nosuchfile" c:\windows\system32\ *.dll and press enter

the program will search

write down any file names that the program had "permission problems" with and let us know there should be none.

Yankeegirl wrote:The best thing I found to clear up virus and junk like that is downloading a free program called Avast... You can go to http://www.avast.com or http://www.download.com and type in avast.... This is my fav program for keeping junk out!! and its free... i have used it for years and yet to have a problem.... let me know if that helps!!

it wont download "avast 4 is probably not yet installed or the instalation is broken. Download the full install package and reinstall" which I did too get the same message.

nimbus: nothing came up.

It is getting very annoying. every 10 seconds now it is poping up. Please help. Norton has been run twice today and hasnt found anything.

fact789 wrote:There is this banner on the bottom right (near the clock) of my screen stating I have a worm. When I click on it, it takes me to a site where they do a scan and then want me to buy something to get rid of the worm. I did a scan on Norton and Ad-Aware-se, and niether one found anything. Is it real? How do I get rid of the banner?

What is the site and name of worm they are saying you are infected with?

Also, d/l and use Spybot http://www.spybot.info/en/index.html to see if it can discover the problem.

I am now thinking that it is a trojan. After the spybot scan a ne message came up stating that my computer is infected with the last version of PSW.x-Vir . The spybot scan did not help

Read about it here I don't know if I would trust the free removal tool though.

edit: You might try the scan link to see what it finds. This site targets many different viruses categorically so it looks legit.

http://anti-spyware-101.com/remove-virusblast/

That download scans but it doesnt remove with out pay.

Thats what I figured I would write down the files that it found in the scan and remove them manually.

Check

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

to see if you bave the virusblaster virus.

You can delete the *single* entry "virusblast" in the run folder by highlighting it and pressing the delete key.

Reboot and see if the pop ups stop.

edit: And if they are really sneaky and rewrite the registry entry when you log off it will be there when you log back on after reboot.

In that case you will need to reboot in safe mode by pressing the F8 key repeatedly just after you turn the computer back on.

Safe mode will show as a menu option thaat you can select with the up and down arrow keys.

The system bypasses the reading of the registry file when booted in safe mode.

when the desktop appears run regedit again and remove the virusblast from the run folder.

loag off and that should fix the problem.

Here is additional info:

http://www.spywareremove.com/removeVirusBlaster.html

There is a link to a program to remove it, but I don't know if it is free or not.


Here is link to the google search:

http://www.google.com/search?sourceid=m ... rusblaster

I think it ran its course and left. I havent had a banner in about an hour now. Thank god! phew. thank for all your help!

I take it you don't have a virus scanner in your computer?
Have you tried "spybot Search and destroy"

http://www.spybot.info/

It can take a long time to do the scan if you have alot on your computer...

TexasSam wrote:I take it you don't have a virus scanner in your computer?
Have you tried "spybot Search and destroy"

http://www.spybot.info/

It can take a long time to do the scan if you have alot on your computer...

He's got Norton. Which I personally despise it because it's resource and system hog. Well, and I've always questioned its ability to catch and remove virii.

As for spyware, back when I was using a PC, I always had three anti-spyware installed -- Adware SE, Spybot and Microsoft's crappy one.

fact789 Do you have Zonealarm (firewall) installed? You probably could have blocked any incoming/outgoing connections from the site using Zonealarm.

ad aware is another good program. i recommend trying it as well.

Ad Aware is good at catching a lot of commercial grade crap.

Generally if you are carefull about what you download, and uninstall trial versions of programs that you do not wish to keep you won't have problems.

A quick look in your registry run folders will usually identify malicious programs for Microsoft dogs.

AD Aware won't catch the hidden files planted by real malicious hackers. For that you need to use the old school tools like Xfind. Recommending old school command line solutions is like casting pearls before swine for typical windows users these days apparantly.

We've had Norton's for years, then they asked me to be a Norton's Beta 360 tester. wll I d/led it, it didn't install properly and I ended up writing zeros to the drive and reinstalling. I reinstalled regular nortons then the hubby told me to try PcCillin. I installed that and it caught some virii that Norton's didn't. Needless to say I chucked Nortons and am using PcCillin.

I also use AdAware also, so far everything is running great (now I just cursed myself )

try updating your anti-virus program. if the thing is a worm, it will pick it up....

also, go to your control panel and look at the list of installed programs and see if anything new is listed there that you didnt install. if so, lose it!