Norton Security Scan

Viruses and worms
1

I downloaded “RealPlayer SP” a plug-in and a DivX player, so I’m not sure which one I got it from. Norton
Security Scan opens a window and wants to scan my system for virus, trojan’s etc. When I saw it I got a bad
feeling and sure enough, it seems to be some type of virus/malware. I scan with Avast and it came up with nothing.
The one window is the only thing that’s come up, but I can’t close the window, I can only minimize it. It doesn’t come
on Task Mgr and I can’t remove the program because it’s open.

I would appreciate so guidance. Many thanks. ;D

Oh, yeah, I’m running Vista

2

I somehow doubt this is Norton Security Scan (you haven’t got it installed ?) but some piece of scum/scam/rogueware trying to trick you into running a scan and then you are likely to be properly infected.

If you haven’t already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).

Don’t worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.

3

Here’s the logs

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/14/2010 at 03:08 AM

Application Version : 4.33.1000

Core Rules Database Version : 4476
Trace Rules Database Version: 2294

Scan type : Complete Scan
Total Scan Time : 03:48:51

Memory items scanned : 761
Memory threats detected : 0
Registry items scanned : 6328
Registry threats detected : 0
File items scanned : 26536
File threats detected : 5

Adware.Tracking Cookie
C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@www.windowsmedia[1].txt
C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@tracking.realtor[1].txt
C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@apmebf[1].txt
C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@videoegg.adbureau[2].txt
C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@ads.cnn[1].txt

and

Malwarebytes’ Anti-Malware 1.44
Database version: 3556
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18865

1/13/2010 8:50:35 PM
mbam-log-2010-01-13 (20-50-35).txt

Scan type: Full Scan (C:|)
Objects scanned: 247783
Time elapsed: 1 hour(s), 0 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) → Bad: (0) Good: (1) → Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

The virus was hijack.startmenu HKEY_CURRENT_USER_SOFTWARE…and currently in the virus chest

4

SUPERAntiSpyware just detected ad tracking cookies and they are not bad just like DavidR said.

Also the following is not bad and reflects a difference in the way Malwarebytes detects a possible infection:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) → Bad: (0) Good: (1) → Quarantined and deleted successfully.

You should remove it from Malwarebytes Quarantine and put it in Ignore next time it is detected.

Please read from:
http://www.malwarebytes.org/forums/index.php?s=&showtopic=7653&view=findpost&p=177025

5

@DavidR
I think Norton Security Scan comes with a toolbar or google pack
http://www.ghacks.net/2009/03/25/norton-security-scan/

6

What makes you sure your infected ? What problems are you having ?

7

The “Norton Security Scan” window stayed open all the time and installed a shortcut on the desktop. A similar ad popped up on my sons computer awhile back and it downloaded a whole world of hurt on his computer. I’m just trying to prevent the problem before it takes over. It piggybacked in on something I downloaded to play torrents is what I’m thinking. I’ve restarted my computer and it seems to be completely gone now that I’ve run the programs the Dave suggested.

Not sure if this is the best place to ask but figured we already touched the subject. What programs do U guys recommend for playing mkv, avi, DivX files? I’ve got the avi file running but have no sound. Any thoughts?

Thanks to Dave, Micky, Pondus and Kenny for their assistance and helpful links.

8

Lots of programs

Filehippo: http://filehippo.com/

List of lists: http://lists.thedatalist.com/

9

I very rarely use media players, curently I use WinAmp and that is relatively light un-bloated and plays MKV, AVI you mentioned but not .divx as far as I’m aware.

10
Not sure if this is the best place to ask but figured we already touched the subject. What programs do U guys recommend for playing mkv, avi, DivX files? I've got the avi file running but have no sound. Any thoughts?

VLC player will do well with all of the formats you have listed. http://www.videolan.org/vlc/

11

This is not what I had on my computer. The appearance was completely different and the only action/option was to scan. It appeared to be what Dave mentioned, an attempt to infect the computer.

12

This maybe? http://norton-security-scan4.software.informer.com/screenshot/80079/
Norton can be almost as bad as a rogue when it comes to removing it, anyway now it is gone… :smiley: