Well, I thought I was extra careful but eventually it happened to me too. Yesterday, out of the blue, a pop-up of the IE browser showed on the screen all by itself (no copies of IE were running at the time).
Here are the symptoms:
- When I'm online and open Internet Explorer, or even Firefox, some pop-up windows show up. They are set up to have "topmost" style, so that they cover the rest of the windows and are impossible to manipulate. Once you close them, they reopen again after some time;
- When I run msconfig to check the startup programs, I get this strange dll added there. It has the name, something like cb2761821.dll. When I uncheck it and reboot, it reappears again under some different random name after some while.
- I get a notification from the Windows Security Alerts that Automatic Updates are turned off. If I try to turn them on, nothing happens. If I go the Start -> Windows Update, the IE dispays this message:
"The site cannot continue because one or more of these Windows services is not running".
- All my previous Restore Points were erased, thus I cannot revert back to the previous working state.
The interesting thing is that I had this annoying COMODO firewall program, that was constantly blocking my "good" programs, but now when I got a real virus, it sat quietly like if nothing happened. I ripped it out right after that and downloaded Free AVG edition. I ran the scan couple times and every time it keeps finding a bunch of "something" - their description is quite misleading (it is mostly cookies, but cookies would not show pop-ups, right?). After each scan, I click a button to remove infected files, but it doesn't help much with the pop-up issue.
Once AVG reported that svchost.exe, or one of its processes was infected. If it was, then it explains why none of those would-be anti-virus programs could remove it.
What I also did, hoping to recover the state of the OS system files, I uninstalled Windows XP SP2 and later on installed it again. Unfortunately, it didn't totally solve the problem - there were less pop-ups after that, but they still show up once in awhile.
Now I don't trust any of those so-called anti-virus programs, and I want to rip this virus out myself. I know quite a bit about Windows programming, so all the technical stuff should not be an issue.
Can someone suggest me the right direction to go next?