Boot up problem

[myron]

Can't say it's caused any problems I know of but do get an error message every time my computer reboots: "cannot find windows script file: ttfload.vbs in the c:\Windows\fonts directory". This has happened ever since my Norton antivirus quaranteed this file and a couple other data files. I did delete all three of these infected files because they could not be repaired. Probably should not have done that. Is there a way to get this file back without wiping out my hard drive by reinstalling windows?

 

[Davey7549]

myron
Welcome to TSG!
Sometimes when a virus is removed by Norton or other Virus scanners there may be further work to do in the registry.
Here are two articles from Symantec that address the virus you probably had. You did not say which one it was so I gave articles for both types. Down the page of each article you will see instructions to remove the references to ttfload.vbs.
Make sure you back up your registry before you make these changes. Once you remove the reference the message should disappear at stratup.
<a href=http://www.sarc.com/avcenter/venc/data/vbs.sorry.a.html>Click here for Sorry.a Virus</a>
<a href=http://www.symantec.com/avcenter/venc/data/pf/vbs.sorry.b.html>Click here for Sorry.b Virus</a>
Let us know haw it went.
Dave

 

[myron]

The name of the virus was Bulldog. I don't know if that is a VBS.Sorry.A type or B type. Maybe Norton keeps a record and will tell me?? ... or regardless ... the instructions for fixing either look the same; perhaps it will loom obvious when I go to fix it. Does anyone happen to know offhand what type of virus Bulldog is?

 

[Rollin' Rog]

Can't really find anything under the name "Bulldog", but the key here is the .vbs extension which doesn't belong on a font. For this, the links Davey gave should be correct.

You are lucky to have gotten this. Vbs worms can be very destructive and this is a "headsup" to disable Windows Scripting Host and update your IE security patches..

http://www.google.com/search?hl=en&q=ttfload.vbs+&btnG=Google+Search

http://www.sarc.com/avcenter/venc/data/win.script.hosting.html

 

[myron]

Thanks for the help. I received another message on this thread from Rollin Rog: "headsup" to disable Windows Scripting Host and update your IE security patches.." I don't understand all this but assume that the links he provided will help prevent future similiar viruses from editing the registry. Is that correct?

 

[Rollin' Rog]

Yes, I've had it disabled for months just using symantec's noscript.exe and haven't had any need to enable it. There are other, fancier ways of doing it, but this is the simplest and most convenient in my opinion.