I turned on my computer today and after i loaded my profile i encountered a Blank white page with pixelated shortcut icons.

After this the computer began displaying many messages such as "Your computer has been infected with malicious viruses". (These messages varied and whenever i clicked on them it would take me to different security software pages) and "cannot find file :///c:/windows/privacy_danger/index.htm make sure address is correct"

All these messages are consistent and my homepage has also changed to a security software website (www.udefender.com i think it was)

i scanned my computer using software that came with the computer. Spyware doctor And AVG were used to run complete system scans although AVG came up with "no threat found" the sypware doctor found many infections, these were mainly tracking infections.

After i quarantined and deleted the infections i restarted the computer only to be met with the same messages again (still very consistent) so i scanned it again and yet again spyware doctor found infections which were then deleted.

the problem has not been solved so here i am hoping somebody can actually help.

please guy's the computer's never done this before.

any help would be greatly appreciated. Thanks.

1-What is your AV?
2-NEVER click on anything strange that you don't know what it is or where it came from...that will cause the infection to spread rapidly
3-I would suggest downloading Avast Free, then disabling your present AV and then installing Avast and let it do a bootscan on reboot. Move everything you find to the chest. See if your PC problem is fixed.

You can find Avast and some other great FREE cleaners, just click on the link in my signature, they are all listed on one page so you don't have to hunt them down, also there are basic instructions on how to use them.
Post back if you still have problems

Some HELP in posting on Cnet plus free progs and instructions
Hopefully my advice will help you...Please post back your result

My Anti-virus was AVG which i have now removed and i have installed new security software called kaspersky (i was advised to use this software by a xomputer technician).

I ran a scan through this software yesterday and after a mammoth 7 hours, 18 infections were found. (The scan was never completed)

so i restarted the computer and although the probablems have died down a little, my homepage is still different and messages are still appearing every few minutes.

Something i forgot to mention before was there are 3 new desktop icons on the startup page. everytime i uninstall them they just keep coming back everytime i reboot.

I've been told that i may have to completely reboot the computer and lose all my applications and files in order to solve this problem. should i do this or would it be unneccessary to consider this so early?

thanks you for your help.

Hi, the reason your scans took so long....did you clean out your PC using the cleaners on the link I asked you to use?

I also see you didn't try the avast that I mentioned....using that would get rid of all the infections in your boot sector. I would give that a shot.

So-called computer technicians will always suggest a paid AV or security suite....they are not always right. If you are only using your PC at home, the free ones I've listed will work great for you.

Try all the cleaners listed on the link in my signature plus the Avast and see if that cleans up your problem.

Then try this free on-line scan:
http://www.spywareinfo.com/xscan.php
and remove all it finds.

If still no joy after that, you may have to try HJT and post your results into:
http://hijackthis.de/
Then google your results (the questionable ones)

Some HELP in posting on Cnet plus free progs and instructions

i've followed your advice and ran the Avast software along with ATF-Cleaner and also the Ccleaner slim.

The system cleaners detected infections whilst the AV (ATF) did not so i restarted the computer but the problems are still there.

So i decided to run the ATF again and halfway through the computer shutted down and a message came up which said something like "microsoft has had to shutdown to protect the computer from damaging process".

So here i am again after restarting for the 3rd time with the problems still there.

please tell me i don't have to perform a complete reboot of the PC and lose all my data.

i appreciate your assistance

ATF is only a cleaner. I've never seen it give an error message before.

Did you try the on-line scan? or the other suggestion in response 3?

Some HELP in posting on Cnet plus free progs and instructionsPlease Post Results

Sorry, it was the Avast with the error message , not the ATF.

Ive tried the online scan which found about 4 infections, after restarting the computer the problems are still there.

As for HJT, i'm not really sure about exactly what information i need to put in the textbox.

can you help with this?

Thanks

Just tried HJT and have come up with messages such as "filename is invalid" or "100kb only".

Before you remove any malicious software you should always remember to turn off the system recovery in XP. Otherwise you may experience that the system recovery in XP recovers the malicious software.

1. Turn off the system recovery
2. Remove the viruses
3. Restart your computer
4. Run a new virus scan.
5. If everything is fine, turn on system recovery.

You may use online AV scan utilities, e.g. www.trend.com, use the Housecall utility, or one of the other utilities suggested in earlier responses.

Exactly where can the system recovery option be found?.
(Windows XP home edition)

Is it the same as system restore?

Also is it possible any further harm could come from doing this?

Thanks

Hi, i was just checking the events report on my AV when i came up against something very interesting.

I know i'm a beginner and this might not be anything substantial but i thought i'd post it anyway.

this was the message:
intrusion.win.mssql.worm.helkern!
Attackers IP address:221.195.73.84

i typed the IP address into the search engine and came up with this

Check it out:

http://www.dshield.org/ipinfo.html?...

If you got time try read some of the details please.

I just figured it might be substantial to someone who acually knows about this.

Thanks, you're a great help

anything you don't understand can be easily googled for the answer, it may even save you time. What response 8 probably meant was system restore.

Some HELP in posting on Cnet plus free progs and instructionsPlease Post Results

Just trying the above and i've received another message similar to the one in response 10, except this time the IP address was different i'll post up the link of the IP address information.

http://www.dshield.org/ipinfo.html?...

I just need to know what this means. After 4 days non-stop virus attacks this is getting beyond frustrating.

Thanks

Alright, i've got details regarding the attackers so where do i report them to?

I have done a complete system recovery (it's now in the state it was when i first brought it) on my computer and although there is a dramatic improvment, whenever i scan the computer it still scan's files,software and other applications that were deleted by the system restore, furthermore, viruses are STILL being found!

another thing is i now use firefox as my browser and since running it i downloaded spybot (from download.com), which has an EXE. file extension and my Norton AV recognises this as a high-risk threat.

Finally, i don't feel safe using the net anymore because of the various messages i got on my computer( see response 10 )

I found this nasty piece of malware (privacy_danger) on my computer this morning.

Symptoms:

(1) Security check windows would pop up repeatedly
(2) Internet Explorer windows would pop up repeatedly, already opened to hostile sites.
(3) My Explorer would start chewing up 98% of the CPU, so antivirus programs were unable to get enough resources to progress.
(4) Three desktop icons appeared, pointing to their web sites.
(5) The desktop background became an active desktop based on their site.

To clean my machine, I had to boot into safe mode, then download a package called SDFix from
http://downloads.andymanchesta.com/...
Following the instructions to the letter, my system cleared up after three reboots.