Virusbuster
support
F.A.Q.
Free tools
User's manual
Contact
site search

login
  User login name: 
  Password: 
Registration
legújabb adatbázis
Our most recent downloadable database:
version:
9.144.61

date:
05. january 2009
F.A.Q.

General question
What shall I do, if my applications don't run after having removed Swen virus?
The error is caused by modified registry entries. The virus redirects the pointer of EXE, COM, BAT, PIF, REG and SCR files to itself to inhibit the run of the files with the specified extensions (see also: here).

Copy our antiswen.reg repair file to your computer (use My Computer for copy) and try rewriting the wrong registry entries with the content of this file to restore standard operation.

Make double click on the antiswen.reg icon or use the right mouse button on it and select the Merge option to activate the file.

If this doesn't work, please choose one of the following possibilities:

(The regedit.exe can be found in the directory of Windows, the antiswen.reg file should be copied into this directory, as well)

On Win9x systems:
Restart the computer in 'Command line' mode and execute the regedit.exe file with the antiswen.reg file as parameter.
Use the regedit antiswen.reg command.

On WinMe system:
Restart the computer with a system disk and execute the regedit.exe file with the antiswen.reg file as parameter.
Use the regedit antiswen.reg command.

On NT based systems:
You have to copy the antiswen.reg file to your computer and rename its extension to an unknown one not defined in Windows (for example: antiswen.ttt). Then double click on My computer, find the Tools menu and select the Folder options of that. Pick the File types panel and add the new extension (in this instace: ttt) with the New button. Then select the Advanced button and choose the "Registry Entries" option from the list. Click OK and Close buttons, find the antiswen.ttt file and execute it.

What should I do with an infected PC if I have NTFS file system & I can't delete the infected file?
Rename the infected file, so that it can be deleted.

Deleteing the infected file in Windows NT Recovery console mode can also be a solution.

Another solution is to take your infected hard drive out of your PC, put it into a clean, virus free computer with NTFS file system, (so that, you can see the NTFS particion of this hard drive from the other PC), and remove or delete the virus with the help of the virus protection runing on the other machine.

How can I send virus samples for analysis?
If you would like to send us virus samples for analysis, then you can do this with compressing the infected file in a password protected zip file and send it by e-mail to the virus@vbuster.hu address. In the e-mail Write down the password and also the name which was shown when the program has detected the virus.
If the virus was moved to the quarantine then you can use the send option from the quarantine module to send the infected file to us.

Important!!! You have to set the SMTP client settings in the Mailer component to be able to send the letter and the attached file from the program.

How to test the virus scanning engine?
In order to see what happens, when our virus scanning engine finds an infected file you can use the EICAR (European Institute of Computer Anti-virus Research) Standard Anti-virus Test file which naturally is not a virus, but is detected by our engine as if it were. To create a file which contains the EICAR sequence, type the following string and save it in a file having a *.COM extension (like EICAR.COM):

X5O!P%@AP[4\PZX54(P^)7CC)7}-STANDARD-ANTIVIRUS-TEST-FILE!+H*


Keyword:
Top of page