I need computer help

I don't know exactly how it happened but I suspect that I have some sort of bug in my computer. Almost every time I open a new page in IE, and occasionally when opening other windows such as "my computer", I get this message


System Error!

Your system is infected with a dangerous virus!
Note: Strongly recommend to install antispyware program and avoid a total crash of your computer

Click ok to download antispyware(recommended)
Followed by OK CANCEL buttons.

It also seems to affect google searches and throws in some sort of porn related result. I have not clicked on the "ok" button because I suspected something right away and I always click cancel, and I know this message is not from my virus/malware protection. I have updated and run both a McAfee virus scan program and Spybot Search and Destroy and neither have found anything.

I need help! Thanks guys.

Definitely spyware. Try booting into safe mode and scan while in safe mode.

To enter safe mode press the "F8" key right after the BIOS screen when you power up your PC. Some of these viruses/spyware nasties can claok from antivirus. Hopefully safe mode will stop it from loading.

nbp said:

I don't know exactly how it happened but I suspect that I have some sort of bug in my computer. Almost every time I open a new page in IE, and occasionally when opening other windows such as "my computer", I get this message


System Error!

Your system is infected with a dangerous virus!
Note: Strongly recommend to install antispyware program and avoid a total crash of your computer

Click ok to download antispyware(recommended)
Followed by OK CANCEL buttons.

It also seems to affect google searches and throws in some sort of porn related result. I have not clicked on the "ok" button because I suspected something right away and I always click cancel, and I know this message is not from my virus/malware protection. I have updated and run both a McAfee virus scan program and Spybot Search and Destroy and neither have found anything.

I need help! Thanks guys.

Click to expand...

If Spybot can't find it after you boot into safe mode, you have to reinstall windows, before the spyware reads all your passwords and bank account information (I hope you haven't been doing online financial stuff with this thing installed).

I highly recommend that you get a knowledgeable person to lock down your next install of windows... and that you don't download anything from the internet unless you check with them first.

You may even think about getting rid of Windows, if this is a recurrent problem. There are plenty of options, if all you do is write letters, surf the internet and use general multimedia.

If you choose to keep windows, please stop using Internet Explorer. Use Firefox... and use a software firewall (Komodo makes a decent one).

Yes that is likely a big flaming piece of spyware that you've caught.

Click ok to download antispyware(recommended) Followed by OK CANCEL buttons.

Click to expand...

Whatever you do, DO NOT click on that OK. That is probably the spyware trying to install more crud, onto your system. As mentioned above you can download spybot search and destroy for free and that may be able to clean you up.
But if you use windows internet explorer you're just going to end up with stuff like this again and again. I second the vote for firefox.
There are good, free anti-virus and firewall programs out there as well. And those are generally necessary to use the internet safely nowadays.

nbp said:

and I always click cancel

Click to expand...

First off, never click cancel. That message is put up by the program you don't want. What makes you think that 'cancel' will actually cancel it. It usually makes things worse.
Get a message like this and you need to either close the window using right click on the toolbar at the bottom or, if you can't do that, ctrl/alt/delete and close it from the task manager.

I'll say it again to drill home my point.

NEVER CLICK CANCEL on malware.

I've read about this one before. I don't recall which particular malware program generates that message (there are probably many that use similar fake warnings). If you do a Google search for the first sentence or two you are seeing when you get that message, you'll probably be able to find a few webpages that describe removal steps.

However... I have to agree with many of the posts here: it really would be safest to reformat, reinstall Windows, and lock the machine down. Depending on your experience level and how well you've backed up important data, it may actually be faster and/or less frustrating to wipe everything. The only exception I would make is if you never transmit any financial or sensitive personal information. Then I might consider cleaning the machine and planning to have weird problems later.

I sincerely wish you the best of luck. Fixing computer malfunctions is enough of a hassle without these lowlife vermin intentionally spreading malware.

Ok, I restarted in safe mode and ran my spybot and mcafee scans again and I got nothing. I assume its still in there. I am not thrilled about the idea of sweeping the computer clean, but it may be the only option.

I have had only maybe one other virus problem ever, so I am definitely at the wrong end of the learning curve here. Fortunately this isnt my home pc, just my laptop for school, and there isnt too much important stuff in there. I probably wouldnt lose too much if I just cleared it all out.

I don't use this computer for any online banking or anything, but I have placed a few orders online with it. Not since this popped up though. I periodically use the the internet options panel to wipe all the cookies/files/forms/passwords etc, so I'm hoping that does its job and there wasn't anything useful in there anyway.

I have a few friends much more computer savvy than me, so I may have to enlist their help in clearing it out and starting over if that becomes the only option.

Uggh. I hate this crap.

PhantomPhoton said:

But if you use windows internet explorer you're just going to end up with stuff like this again and again.

Click to expand...

I'm sorry, but what ignorant talk. :thumbsdow Prevention strategy needs to start elsewhere in today's security landscape, so here's a battle-tested suggestion that actually works: http://www.mechbgon.com/build/security2.html

Removal guide: http://www.elitekiller.com/malware.htm courtesy of my bro John. If you'd prefer some in-person assistance, either post or PM me and we can work on it.

BTW, McAfee is singularly bad at detecting this type of malware, and I would know, after heaving hundreds of samples at their see-no-evil submission portal (Webimmune.net) and being steadfastly ignored. If you're buying antivirus software, Kaspersky is the king at killing this stuff (although still not infallible). If you'd like to give them a try, uninstall McAfee and install a 30-day trial of Kaspersky AntiVirus 7. If nothing else, it will probably help you with the removal, and it uninstalls cleanly when it runs out (right-click the "K" icon, choose Exit, and uninstall from Add/Remove Programs).

Thanks Mbg. After looking at your site, I am doing a number of those steps to prevent attack, though I didn't know about a few of the others. I keep windows up to date, I have engaged the windows firewall, and I do run the Spybot/Resident and McAfee. Maybe I will look into a better antivirus though. I will give Kaspersky a try, and hopefully it will take care of the bug I have without me having to sweep it all. That would be a bummer! If I can get rid of this one, I'll be that much more prepared to fight the next one--:touche:

Try using lavasoft Adware. It's free for personal use. If your system locks onto the file (i.e., cannot remove it), it will remember to delete it next time you reboot your system.

mechBgon said:

I'm sorry, but what ignorant talk. :thumbsdow Prevention strategy needs to start elsewhere...

Click to expand...

Your link speaks of a layered defense. Firefox offers far better script security that IE and that right there is a great start.
On #5 in red type it says keep your software up to date. IE has been terrible about fixing exploits in a timely manner in the past.
It isn't about the core browser, but what you are allowed to do with it.

I never suggested that this was the only thing needed for security, but is a piece of the process. Allowing scripts to do whatever they want is just asking for trouble. Quit the name calling.

Agreed, I believe we can keep it respectful and on topic eh?! There's a lot of different ways to say things without the sharp edge.

I use Spy Bot,Ad Aware,SpywareBlaster,SpywareGuard, & SuperAntispyware. I just added A-Squared Anti-Malware and A-squared Anti dialer.The A-Squared apps found some things the others didn't. You can get it at downloads.com or at http://www.emsisoft.com/en/


And thanks mechBgon I checked out your site.

PhantomPhoton said:

Your link speaks of a layered defense. Firefox offers far better script security that IE and that right there is a great start.

Click to expand...

Care to elaborate?

On #5 in red type it says keep your software up to date. IE has been terrible about fixing exploits in a timely manner in the past.

Click to expand...

I don't know if you read the Symantec biannual security reports, but Microsoft's time-to-patch is actually very low, lower than RedHat, Apple, Sun Solaris and HP.

I never suggested that this was the only thing needed for security, but is a piece of the process. Allowing scripts to do whatever they want is just asking for trouble. Quit the name calling.

Click to expand...

You used a very misleading generalization, stating that unless he drops IE, he will have this stuff again and again. I'm sorry, but that needs a retraction before I make any apologies for "name-calling." And as a person who's seen plenty of FF-equipped systems successfully infected in the course of my malware research, and is quite familiar with the actual modus operandi of the bad guys, I don't view FireFox as a security improvement unless you intend to use NoScript, at which point you've had the same option for about 10 years now with IE using the security Zones feature to differentially block scripts and Java on sites you haven't explicitly trusted. :shrug: Use FF to your heart's content, of course, but if you want your system secure, my first recommendation is to run it (and any browser) at non-Admin privilege.

Touching on the modus operandi, nbp, one angle of attack used by the bad guys is to plant bogus search results for innocent-sounding stuff like "wood stoves" (and not-so-innocent stuff is often used as bait too, of course), and then tell visitors that they need a Flash Player Update or an ActiveX Object to view the page. And how convenient, they have the necessary download right there in your face... except it's really something else. There are even versions for Mac now. So be skeptical; the IntarWeb is not all safe :tinfoil:

Another angle of attack is attack suites such as IcePack and MPack, which will take a shotgun approach to find vulnerabilities on your system (vulnerable versions of QuickTime Player, Sun Java, Real Player, Flash Player, Adobe Reader, WinZip, WinAmp) that can be reached through your web browser. Antivirus software may detect the exploit, keeping software up-to-date may eliminate the targets, trying to control scripting may preempt the attack... but when everything else has fallen through, using a non-Administrator user account (and optionally an anti-execution layer such as Software Restriction Policy) is a huge final defense. When I was a sysadmin, my fleet racked up something like 400,000 machine-hours without an infection (yes, equipped with Internet Explorer) using the strategy I'm proposing, using non-Admin accounts as the cornerstone. So consider trying that. I know it can be a hassle if you're accustomed to using an Admin account all the time, but consider it.

Tangentially, regarding system lockdown, another option for WinXP systems is Windows SteadyState, a free download.

FYI, in a very similar situation, superantispyware worked for me where others did not. It seems like on many of the viruses, malware, etc., sometimes one removal tool might work better on a particular one while another might work better on another one.