Virusburst

[Lil' Abner]

http://mewnlite.com/vburst.gif
Shown are what SAS finds and the popup that points to virusburster.com
SAS seemed to fix it but customer says it reappeared after about an hour
after he got it home and got online. All he did online was email. He ran
SAS again but said it came back again after a short time.
Looking at his IE history, we have a pretty good idea where he picked it
up, but it's a little late for that to help now.
While the popup was present, I ran Process Explorer and didn't see any
abnormal processes running. Also I didn't see anything with HijackThis that
I didn't recognize as safe.
The media-codec was also a return item after being zapped once before, but
I don't think they're related. Or are they?
Any ideas, suggestions? Where is virusburst hiding?

--
--- A dyslexic man walks into a bra ---

[Nick Skrepetos]

Lil' Abner wrote:
> http://mewnlite.com/vburst.gif
> Shown are what SAS finds and the popup that points to virusburster.com
> SAS seemed to fix it but customer says it reappeared after about an hour
> after he got it home and got online. All he did online was email. He ran
> SAS again but said it came back again after a short time.
> Looking at his IE history, we have a pretty good idea where he picked it
> up, but it's a little late for that to help now.
> While the popup was present, I ran Process Explorer and didn't see any
> abnormal processes running. Also I didn't see anything with HijackThis that
> I didn't recognize as safe.
> The media-codec was also a return item after being zapped once before, but
> I don't think they're related. Or are they?
> Any ideas, suggestions? Where is virusburst hiding?
>
> --
> --- A dyslexic man walks into a bra ---

Did they update to our latest definitions before scanning? If they did,
and still have the problem, please have them submit a support ticket
here:
http://www.superantispyware.com/support.html

I will have them run a diagnostic and we can see what was missed.

Nick Skrepetos
SUPERAntiSpyware.com
http://www.superantispyware.com

[Lil' Abner]

"Nick Skrepetos" <nskrepetos@yahoo.com> wrote in
news:1166242978.125222.4110@f1g2000cwa.googlegroup s.com:

>
> Lil' Abner wrote:
>> http://mewnlite.com/vburst.gif
>> Shown are what SAS finds and the popup that points to
>> virusburster.com SAS seemed to fix it but customer says it reappeared
>> after about an hour after he got it home and got online. All he did
>> online was email. He ran SAS again but said it came back again after
>> a short time. Looking at his IE history, we have a pretty good idea
>> where he picked it up, but it's a little late for that to help now.
>> While the popup was present, I ran Process Explorer and didn't see
>> any abnormal processes running. Also I didn't see anything with
>> HijackThis that I didn't recognize as safe.
>> The media-codec was also a return item after being zapped once
>> before, but I don't think they're related. Or are they?
>> Any ideas, suggestions? Where is virusburst hiding?
>>
>> --
>> --- A dyslexic man walks into a bra ---
>
> Did they update to our latest definitions before scanning? If they
> did, and still have the problem, please have them submit a support
> ticket here:
> http://www.superantispyware.com/support.html
>
> I will have them run a diagnostic and we can see what was missed.

I updated it Wednesday when I installed it. He was rerunning it with the
same update. However, I was over there this evening (Friday) and got new
updates and ran it again (where I got the screen shot). I ran it again
immediately and it found nothing, but tomorrow we'll know for sure. I
have found manual uninstallation instructions for it at
http://www.bleepingcomputer.com/forums/topic63896.html but that process
looks pretty time consuming. Here's hoping YOU got it for us... :-)
Thanks for your reply.

--
--- A dyslexic man walks into a bra ---

[Nick Skrepetos]

Lil' Abner wrote:
> "Nick Skrepetos" <nskrepetos@yahoo.com> wrote in
> news:1166242978.125222.4110@f1g2000cwa.googlegroup s.com:
>
> >
> > Lil' Abner wrote:
> >> http://mewnlite.com/vburst.gif
> >> Shown are what SAS finds and the popup that points to
> >> virusburster.com SAS seemed to fix it but customer says it reappeared
> >> after about an hour after he got it home and got online. All he did
> >> online was email. He ran SAS again but said it came back again after
> >> a short time. Looking at his IE history, we have a pretty good idea
> >> where he picked it up, but it's a little late for that to help now.
> >> While the popup was present, I ran Process Explorer and didn't see
> >> any abnormal processes running. Also I didn't see anything with
> >> HijackThis that I didn't recognize as safe.
> >> The media-codec was also a return item after being zapped once
> >> before, but I don't think they're related. Or are they?
> >> Any ideas, suggestions? Where is virusburst hiding?
> >>
> >> --
> >> --- A dyslexic man walks into a bra ---
> >
> > Did they update to our latest definitions before scanning? If they
> > did, and still have the problem, please have them submit a support
> > ticket here:
> > http://www.superantispyware.com/support.html
> >
> > I will have them run a diagnostic and we can see what was missed.
>
> I updated it Wednesday when I installed it. He was rerunning it with the
> same update. However, I was over there this evening (Friday) and got new
> updates and ran it again (where I got the screen shot). I ran it again
> immediately and it found nothing, but tomorrow we'll know for sure. I
> have found manual uninstallation instructions for it at
> http://www.bleepingcomputer.com/forums/topic63896.html but that process
> looks pretty time consuming. Here's hoping YOU got it for us... :-)
> Thanks for your reply.
>
> --
> --- A dyslexic man walks into a bra ---

If we didn't, use this link (from his machine) and I'll diagnose what
we missed and update our definitions.
http://www.superantispyware.com/diag....html?id=nicks

Nick Skrepetos
SUPERAntiSpyware.com
http://www.superantispyware.com