OT Knock, knock who is there...a virus

BillyBoy wrote on 6/27/2004, 10:00 AM

My Norton anti-virus subscription is about to expire and Norton has been nagging me to renew it. I've used it for over a year, have it running in full protection mode and automaticaly have it get and have it install updates. You would think I was "protected".

Not exactly.

With some other threads talking about other programs I decided to give the free version of AVG a try. Did and guess what... it found not one but three versions of the rather nasty Trojan called Bispy.B sitting in my C:/windows folder.

So Norton totally blew it.

This is not so much a knock at Norton, rather confirmation that no program can find everything. So unless you're willing to install and run multiple anti-virus packages be aware something might get through.

Comments

stepfour wrote on 6/27/2004, 10:33 AM

I'm not suprised. I've found AVG to be great at detecting viruses. Just seeing what I've seen in the past few weeks with viruses, I really feel sorry for the truly green portion of the general public out there buying a spiffy new computer and connecting it up to the Web. Hopefully they will buy solid protection and learn to use it right, but, many will be in for hours and hours on the phone with tech support trying to regain control of their systems.

JJKizak wrote on 6/27/2004, 10:40 AM

BillyBoy:
Do you have the anti virus and the firewall protection from Norton?
Just wondering as the firewall seems aimed at the worms and trojans.

JJK

VegasVidKid wrote on 6/27/2004, 11:01 AM

It's getting out of control.

I also have Norton running.

For 3 out of the last 4 or 5 days, my browser has gotten hijacked, so when I start Internet Explorer, I'm taken to a "search" page, with a pop up that says I have spyware, and a link to where I can buy some anti-spyware software. All the links on the searcg page gout to a URL containing "count.cc". AdAware and Spybot have a hard time getting rid of it. The only way I'm able to do it is by looking in mw Windows/System32 folder and deleting the most recent dlll file in there. Basically, I think it's downloading some app called about:blank which takes over your browser, and will reinstall itself from that dlll even after the antispyware apps detect it. The dlll file is randomly named wach time, so it's hard for these products to zap it.

They really should have one product that deals with all security, virus, and spyware problems, and Microsoft needs to tghten things up a bit. I definitely didn't install any .exes or notice any software getting downloaded. Visiting a Website should not allow your whole computer to become compromised.

BillyBoy wrote on 6/27/2004, 11:01 AM

Yep, I got the full package from Norton. What kind of bothers me is I see the Norton automated update warning popping up (little yellow box in lower right of your desktop) sometimes several times a day installing what they claim is a "current virus profile" and it misses what according to a quick web search is a fairly nasty trojan other anti-software finds. And it isn't just AVG that finds it, I saw at least two others that report it, so the question is how come Norton, which is suppose to be the most frequently used doesn't find it?

Like I said no software can be expected to find everything but what I find alarming is according to a quick web search, the Bispy.B was first discovered in early April of this year with a earlier version, Bispy.A sometime before that. I was "infected" with both.

The 'good news' for me while the trojan was sitting on the system my firewall (Outpost) protected me. So since the purpose of this kind of a trojan is there to allow some hacker to take control of my PC, that didn't happen.

For newbies having only Norton or some other anti-virus that don't see this trojan or others and not having a firewall they could have their system compromised and never know it.

stepfour wrote on 6/27/2004, 11:23 AM

VegasVidKid, you might want to also search your whole drive for any new or recent .exe files that don't look familiar to you. The key will be the dates on the file. You should easily be able to recall if you installed anything recently that should have put a new .exe on your drive.

Also, I suggest you look at your add/remove programs section on your system and see if there are any oddball programs there. That one that is directing you to a particular site sounds like its being driven by a program. Sometimes, Task Manager will have some process running that will clue you in to programs running that you had no idea were even on your system.

Sadly, broadband is doing exactly what it was projected to do; opening a whole new world of internet surfing opportunities for users and even bigger worlds of opportunities for thieves and hackers.

Grazie wrote on 6/27/2004, 11:41 AM

.. ooo this is sounding rather familiar . . . Grazie

John_Cline wrote on 6/27/2004, 1:43 PM

The new Zone Alarm Security Suite, which combines their firewall with an anti-virus package, has been generating a lot of good reviews lately. According to a lot of the reviews, it is the "suite to beat" these days. I've been running it for a few weeks now and, so far, I'm pleased. I had been running Norton.

I also installed it on a clients computer. She had been running Norton and keeping it updated regularly. After installing Zone Alarm's suite, it discovered that her machine was infected with the "Sobig" virus, Norton had completely missed it.

John

Zulqar-Cheema wrote on 6/27/2004, 2:14 PM

I still do not have any virus checker stuff on the PC apart from running adware ocasionally.

I also sometimes use this free on-line virus checkker...
http://housecall.trendmicro.com/

emeli wrote on 6/27/2004, 10:48 PM

If you get a nasty virus that your virus protection can only contain it (rather than remove it), one program that works well is CWShredder:

http://www.spywareinfo.com/~merijn/downloads.html

It worked well when my sister's computer has hit by a virus that AVG could isolate but not remove.

Matt

clearvu wrote on 6/28/2004, 4:04 AM

Hey, zcheema,

I went to that site and ran the "scan now". Well, it found to adware viruses on my system!

I too have Norton and it did not find anything. I then pointed to the exact files that "trendmicro" claimed to be infected and then Norton agreed that it was a "risk" file. What the heck is THAT supposed to mean? Anyhow, according to Symantec's site, it said that removal of the file may cause other problems when and if another program tries to run the file. I wasn't sure exactly what to do.

I then went back to "trendmicro" and took the chance and told it to delete the two infected files. So far I haven't had any problems.

Were my two files really infected? I have no idea. Talk about difficult decisions to make.

Jay Gladwell wrote on 6/28/2004, 4:13 AM

Brian, I could be mistaken, but I don't think "adware" qualifies as a "virus." Adware is simply a little application hidden on hard drives to track a person's browsing habits so marketers can "target" you when surfing the world wide web.

Jay

Erk wrote on 6/28/2004, 5:05 AM

BB,

do you have a filename to search for? I'm running Norton and now Im a bit nevous. I searched for "bis" and found nothing.

Greg

craftech wrote on 6/28/2004, 5:08 AM

The VB 100 Virus Bulletins are generally considered the current benchmarks in antivirus software testing. Check it out.
Eset seems the most consistent.

John

cbrillow wrote on 6/28/2004, 5:40 AM

zcheema said:

"I still do not have any virus checker stuff on the PC apart from running adware ocasionally."

Interesting. Most of us assiduously avoid running adware...

Grazie wrote on 6/28/2004, 5:52 AM

Exactly clearvu - something that Symantec didn't give me . . . a clear view? !? !

I found the reams of "support" pages I needed to access to determine if/what/whic/how was or not a virus; it's variations; the complexioty of all of it AND then to be told that remopviong it would possibly make my pc . . . er .. illitereate . . was just too much . .. .

Grazie

Jay Gladwell wrote on 6/28/2004, 5:53 AM

Chuck, I took that to mean he is running a program that checks for adware. I could be wrong, tho!

Jay

craftech wrote on 6/28/2004, 5:59 AM

Billyboy,
"... it found not one but three versions of the rather nasty Trojan called Bispy.B sitting in my C:/windows folder."

Are you sure it is removed? Usually with that trojan you have to boot into safe mode and delete the file/s it infected. Sometimes Spybot Search & Destroy does a good job of removing that one as well.

John

JJKizak wrote on 6/28/2004, 7:02 AM

I have noticed that with Dial-up (I still have it) I get a lot less action
than people with DSL. Wonder if this is true or just my fantasy.

JJK

jetdv wrote on 6/28/2004, 7:22 AM

I have noticed that with Dial-up (I still have it) I get a lot less action

I still have dial-up too :-(
(Fortunately have access to DSL for downloading) :-)

This would be true because you are connected for a much shorter length of time (maybe 1 - 6 hours a day as compared to 24 hours a day for DSL). Plus, each time you dial in you will get a different IP number.