Little red X?

[Guest]

I have a little red 'X' in my sys tray that pops up a help bubble every 30
seconds or so stating this:

"Your computer is infected!
Windows has detected spyware infection!

It is recommended to use special antispyware tools to prevent data loss.
Windows will now download and install the most up-to-dateantispyware for you.

Click here to protect your computer from spyware."

If I click on the bubble for info, it installs something called SpySherrif
without asking and starts running a scan that I had a hell of a time
stopping. I went into add remove hardware and removed the program, and if I
right click the little red X it pops a shortened version of the message in a
help bubble.

Also, the desktop background image change to an ugly little picture (big red
letters saying "SPYWARE INFECTION" and a lot of smaller writing describing
what it thinks I should do. The BG image can't be changed anymore.

I have a screenshot of all this, if it helps.

 

[Guest]

Excellent.... This answered and solved my whole problem. Perfect fix.

Now, is there any special stuff I should do to prevent this thing from
happening again? How does this thing spread?

Any help would be greatly appreciated, again.

Adam

 

[Dave M]

Hi Say.Bitter:
Here's a link for you... So how did I get infected in the first place?
http://boards.cexx.org/viewtopic.php?t=957

and more light reading, yet interesting stats:

http://www.usatoday.com/tech/news/computersecurity/hacking/2004-11-29-honeypot_x.htm

 

[Guest]

Hi Again Adam

Glad it solved your problem, Its very difficult to know exactly how you got
infected. This infection has been around for a long time and its still as
busy as ever, Ive seen it install from various sites and its causing alot of
problems, Dave's links are well worth reading as they may make it clearer
where you picked up the infection,

Making sure your security patches are up to date and you have the latest
service packs for your OS is important to close alot of the holes which
attackers will use to get onto your system, Also having a strong Firewall and
Antivirus installed would help make you aware of suspicious activity and in
many cases block the trojans before they can get onto your system and cause
the damage,

Consider installing SpywareBlaster from Javacool software as that will add
hundreds of malicious sites to your restricted zone which would prevent them
downloading files to your system if you visit them, Spyware Blaster will also
block alot of malicious ActiveX components so again it would prevent the site
downloading malicious files to your pc, Its free and doesnt need to run on
your system, it just needs updating every couple of weeks,

http://www.javacoolsoftware.com/spywareblaster.html

Another option would be MVPS hosts file which adds malicious sites to your
hosts file with a 127.0.0.1 entry.

http://www.mvps.org/winhelp2002/hosts.htm

This means if you try to visit one of the sites on the list it will loop
back to your own system and display a error page showing the page cannot be
found. The 127.0.0.1 refers to your own machine so any site that has this
beside it will no longer be available. I like to keep my hosts file clear so
I can easily notice changes as malware sometimes adds security sites to the
hosts file to block access and sometimes even creates a new hosts file in a
different location so I prefer to use the Spyware Blaster restricted zone
method but I know the Hosts file works great and is recommended by many
users.

There's alot of free protection products available including Firewall,
Antispy & Antivirus software so let us know if you need any links and I will
post them.

All The Best

Andy