My computer has been acting up the the point that it's pretty hard to say it's not infected.
On Wednesday the 20th, a friend of mine gave me a Game_Maker_7.exe program proclaiming that it was Pro Edition. I foolishly accepted; he downloaded the file from his portable external hard drive onto a school computer. I used that school computer to test the program, which worked. Then, I downloaded it from there onto my USB flash drive. Later, I plugged my flash drive into my personal computer. That .exe program was missing. At that time, I suspected that I had simply forgotten to download it onto the flash drive earlier that day.
The first symptoms of this infection appeared Thursday the 21st, when Internet Explorer unexpectedly gave me a message box telling me I had a virus, and asking me to download a program called Personal Antivirus. I pressed that red [X] in the upper-right corner, presuming that there would be no further attempt on my computer. I opened up Task Manager, ready to kill Internet Explorer's process, but it was already no longer running. I, paranoid, removed my own external hard drive (not the flash drive) from my computer. This hard drive contains a backup of many personal documents, and I didn't want any of them to be infected if there was an infection.
On Friday, I downloaded the program from the same school computer onto my flash drive again. Somehow, the program did not disappear from the school computer, but did from my flash drive. When I returned home, I plugged that flash drive into my computer again, and again found the file missing. I did, however, find a cryptic file called RECYCLER. The files properties reported that it had about 65 KB of data in it, but I found it empty. I used Spybot - Search and Destroy's file shredder to delete the folder. However, the folder appeared again later in the day. I have not used that flash drive since then.
Throughout the three-day weekend, I tried downloading McAfee (the install file wouldn't open), AVG Free 8.5 (found nothing), AdAware (found nothing), and Advanced SystemCare (found nothing). I attempted to use System Restore, but pressing the button labeled [Start] (to start the restore) did nothing. The infection was still very benign, and I doubted its existence. I disregarded it Tuesday to Wednesday.
Today, while using my computer, I minimized Firefox to find the desktop completely changed (I will describe it later). In a fit of panic, I forced the restart of my computer. After doing so, the infection was worse. I unplugged my wireless internet adapter.
As of right now, these are the known symptoms of this infection:
> When I log on into my account, Windows Security Center pops up. The section labeled "Virus Protection" tells me that "WinBlueSoft reports that it is turned off."
> Two pop-ups periodically appear at the bottom corners of my screen telling me that there is an "Infiltration Alert!" It reports that a random IP address is attempting to attack my computer from a random port (even though my internet is disconnected), and gives me a random type of infection (such as spyware or virus).
> Windows Security Center's tray icon tells me that there is a "Spyware Alert!" and asks me to "register your copy of WinBlueSoft and remove spyware threats from your PC."
> A program called "WinBlueSoft" has installed itself on my computer and periodically gives me a window that says it has found ~700 critical infections.
> All of these messages contain something among the lines of "Your computer is infected with spyware. It could damage your critical files or expose your private data on the Internet."
> My desktop has changed to solid black with dark red words at the bottom right corner saying: "WARNING! / Your computer infected"
> When I open Display Properties, the [Desktop] tab is missing.
> My computer periodically logs off or restarts without my consent.
> Whenever I attempt to execute any of these programs, Windows Security Center's tray icon pops up saying: "Process [process name] was terminated / Harmful memory infection was detected," and terminates the said process:
> > Task Manager
> > System Restore
> > Command Prompt
> > Firefox
> > Internet Explorer
> > Spybot - Search and Destroy and its File Shredder
> > Registry Editor
There are probably more processes which will be terminated in the same manner.
A friend of mines claims to have had a similar infection to mines, and removed it with a program called MalwareRemovalBot. The only symptoms I know that his computer had was changing the desktop to "WARNING! / Your're computer is infected!" He claims it is a lot more "domestic" than my infection. I believe my infection is a newer version of his.
Please help - my computer has become completely unusable, and I can't do anything with it. I'm currently borrowing my brother's computer. I am afraid to use any other flash drive I have to transfer files between my infected computer and any other clean computer.
Edited by boopme, 28 May 2009 - 09:21 PM.