"Your System is Infected" blue screen

zipo_z · 11-11-2005, 11:47 AM

Hi, I am running WinXP PRO, I usually don't use IE but a few hours ago I used it and then came back to my system. All the sudden I get two little red circle x's on the system tray area. Every few seconds there is a message saying "You system is infected and that you need to run a Spyware in particular that of Microsoft".
I ran "Hijackthis" and found the web browser was hijacked. After running "Hijackthis" I restarted the system and when I logged back in there is this blue background and in the middle with red letters it says "Your System is Infected" and that Spyware activity has been detected.

I ran Ad-aware, Spybot - Search & Destroy, Spyware Doctor. Nothing seems to be working in stopping IE from been hijacked and getting rid of this blue background as well as the two red circles in the tray. HELPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP

Thanks in advance!!

zipo_z · 11-11-2005, 11:49 AM

i have since been able to remove remove the red circle thing but my backround still cant be changed from the blue screen.

tetonbob · 11-16-2005, 02:55 PM

You likely have a smitfraud variant. Please post a HJT log in our HJT forum, if you still need help.

Download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\PROGRAM FILES\HIJACKTHIS\

Double click on HijackThis.exe to run the program.

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Post the hijackthis.log file in the HijackThis Log Help forum. Do not fix anything in HijackThis since they may be harmless.

harveyk123 · 11-18-2005, 04:27 PM

How did you get rid of the red X?

tetonbob · 11-18-2005, 06:09 PM

Hi harveyk123 -

We'll be glad to help you out. Please follow the same instructions I gave zipo_z and post a HJT log in your own new thread in the HJT forum. It's best to see everything on a system and address it then.

DJ Flip · 11-30-2005, 08:59 PM

I had a similar problem like this a while back. To fix mine, I went into SafeMode then I ran Ad-Aware & an anti-virus, and it cleared things up.

**jnob** · 12-07-2005, 11:37 AM

I just had almost the same exact problem this weekend, I ended up removing the infection with webroot spy sweeper's 20-day free trial software, and Norton Anti-Virus also in Safe Mode.

11-11-2005, 11:47 AM	#1 (permalink)
zipo_z Registered User Join Date: Aug 2005 Posts: 27 OS: xp	"Your System is Infected" blue screen Hi, I am running WinXP PRO, I usually don't use IE but a few hours ago I used it and then came back to my system. All the sudden I get two little red circle x's on the system tray area. Every few seconds there is a message saying "You system is infected and that you need to run a Spyware in particular that of Microsoft". I ran "Hijackthis" and found the web browser was hijacked. After running "Hijackthis" I restarted the system and when I logged back in there is this blue background and in the middle with red letters it says "Your System is Infected" and that Spyware activity has been detected. I ran Ad-aware, Spybot - Search & Destroy, Spyware Doctor. Nothing seems to be working in stopping IE from been hijacked and getting rid of this blue background as well as the two red circles in the tray. HELPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP Thanks in advance!!

11-16-2005, 02:55 PM	#3 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,251 OS: 2000 Pro; XP Pro; XP Home	You likely have a smitfraud variant. Please post a HJT log in our HJT forum, if you still need help. Download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\PROGRAM FILES\HIJACKTHIS\ Double click on HijackThis.exe to run the program. 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file in the HijackThis Log Help forum. Do not fix anything in HijackThis since they may be harmless. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-18-2005, 04:27 PM	#4 (permalink)
harveyk123 Registered User Join Date: Nov 2005 Posts: 1 OS: win2k	How did you get rid of the red X? How did you get rid of the red X?

11-18-2005, 06:09 PM	#5 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,251 OS: 2000 Pro; XP Pro; XP Home	Hi harveyk123 - We'll be glad to help you out. Please follow the same instructions I gave zipo_z and post a HJT log in your own new thread in the HJT forum. It's best to see everything on a system and address it then. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-30-2005, 08:59 PM	#6 (permalink)
DJ Flip Registered User Join Date: Nov 2005 Location: Strongsville, OH Posts: 11 OS: XP Professional	I had a similar problem like this a while back. To fix mine, I went into SafeMode then I ran Ad-Aware & an anti-virus, and it cleared things up. __________________ It Ain't A Game Volume 1

11-11-2005, 11:49 AM	#2 (permalink)
zipo_z Registered User Join Date: Aug 2005 Posts: 27 OS: xp	i have since been able to remove remove the red circle thing but my backround still cant be changed from the blue screen.

12-07-2005, 11:37 AM	#7 (permalink)
jnob TSF Enthusiast Join Date: Nov 2005 Location: CA Valley Posts: 692 OS: XP Pro, SP2 My System	I just had almost the same exact problem this weekend, I ended up removing the infection with webroot spy sweeper's 20-day free trial software, and Norton Anti-Virus also in Safe Mode.