Re: Trojan.ByteVerify

From: Galen Gregory (galen_gregory_at_hotmail.com)
Date: 10/19/03 

Date: Sun, 19 Oct 2003 13:16:56 -0400

Jack,

I'm not sure where to start, there's many places to get various tools to fix
your homepage but I guess the question(s) are:

Have you turned off system restore while you scanned and deleted the
infected computer?

Did you do so while disconnected from the 'net and with the latest updated
definitions?

Searching brought up this link:
http://www.java.com/en/download/help/cache_virus.jsp

The link points to deleting the cache for java files as well - specifically
for your named virus - which I suppose Norton may or may not miss.

The directions on the Symantec site:
http://securityresponse.symantec.com/avcenter/venc/data/trojan.byteverify.html

Those are pretty crisp and fairly straight forward and easy enough to apply.
If your using Sun's JAVA instead of Microsoft's VM then you'll want to make
sure that you clear out the cache there as well.

Reading all of this makes me think that not only should you run Norton and
clean but that you might also want to clean out your temporary files and
your temporary internet files. I'd think that if you were running any third
party backup utilities that you might want to check any of the databases
that they'd kept to insure their integrity as well.

Searching for the same filename and spyware at the same time also brought up
similar items and you might consider cleaning with Spybot Search and Destroy
AND AdAware. I'll paste the links from my chat text for you.

Ad-aware - Download.com - Free downloads, shareware, and more.:
http://download.com.com/3000-2094-10045910.html?legacy=cnet

Spybot - Search & Destroy by PepiMK Software:
http://security.kolla.de/news.php?lang=en

These two tools are NOT anti-virus or anti-trojan applications, but given
the melding of the two (spyware/malware and trojans/viruses) I'd think it
notable enough to warrant their addition to the post at this time. Spybot
has some additional tools - I tend to scan more with AdAware but use the
Spybot tools - such as a hosts file addition, blocking of known sites with
malware content, and other such goodies. 

-- 
Galen Gregory MS MVP Shell/User
Contact: galen_gregory (at) hotmail.com
Put [read] in the topic or it will NEVER be seen.
"Jack G" <anonymous@discussions.microsoft.com> wrote in message
news:416D2551-C86B-4961-93F0-57C036D03882@microsoft.com...
> Recently had my Norton AntiVirus pick up the Trojan.ByteVerify bug on a
scan and quarantined and then deleted the infected files (I'm running
Windows 2000). However the effects of the bug are still there - IE homepage
resets to undesired page, loads porn sites into Favorites, and most
alarmingly, I don't know what else.  When I run another scan of Norton, it
finds nothing.  Also downloaded and ran "Trojan Remover" which finds
nothing.  How/what do I have to reset to get rid of it?

Relevant Pages

  • Re: NIS 05 Causing Screen Freeze/Lockups?
    ... You must be running Spybot in Mode> Advanced mode to have access to ... Residents TeaTimer and SDHelper. ... Don't enable anything in Advanced mode if you're not absolutely certain ... >> Despite the official Symantec line, I'd not install /any/ new Norton ...
    (microsoft.public.security)
  • Re: Folder Options Problem
    ... I do have Ad-Aware, Spybot, and Hijack This. ... Also, Norton ...
    (microsoft.public.windowsxp.general)
  • Re: windows xp slow on amd atlon 3000+
    ... OK, now forget about Norton.. ... You will also need to download Spyware removal software.. ... Spybot and Adaware ... don't forget to check for updates after you have started them.. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Windows Explorer Error
    ... Norton and spybot are on. ... How to configure Windows XP to start in a "clean boot" state ... I see from the Report that you have installed the Windows XP SP3 ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: svchost.exe
    ... You ran spybot but I still suggest also running adaware: ... If you have permanently blocked it from within Norton I am not sure why it ... >> Blaster Security Patch: ...
    (microsoft.public.windowsxp.basics)
Loading