Expert: Lorry - 12/15/2005

Question
While browsing the internet a couple of weeks ago I accidently clicked on a link that took me to a "bad" web site whereby my Norton Antivirus suddenyl popped up with about 10-12 different virus alerts. I tried cancelling the page loading by hitting Escape and Alt-F4 but ultimately had to close IE via the Application listing in Task Manager. That's when it started... If I click on My Computer or start IE, my desktop is immediately hijacked and it tells me that I have spyware or adware on my computer with a link and a circular icon with an X thru it appears on my system tray with the only option being "Download Antivirus" from the same web site in the link on the desktop, one that advertises some sort of program. At the same time, another case of iexplore.exe shows up in my Task Manager processes list (around 9028K-9108K in size) and if I cancel that process, the icon in System Tray disappears but I still have to turn off Active Desktop and delete the NoBackground registry key in Current_User/Software/Microsoft/Windows/CurrentControlSet/Policies/System just to change my desktop back for 10 seconds before I do something else on my computer that makes it pop up again and hijack my machine again. I've downloaded and updated Ad-Aware, Spybot, Malware Sweeper and reinstalled Norton Antivirus all without fixing the issue. I've run 6 different online virus scans from Panda to Housecall to MacAfee and nothing is at all better. I've even tried repairing IE and deleting all cases if iexplorer.exe on my computer and them restoring them, System File Checker and even tried deleting ALL files created on my entire computer starting from the moment my computer wandered onto that web site to current time - all with no success. Add/Remove Programs has nothing odd on there, Temporary Internet files and other cache places have been cleaned with both CCleaner and CleanUp and everything has been tried again in Safe mode but nothing seems to help and none of these programs have updates, yet, that fix my current adware or virus. Normally I've been pretty good about getting rid of Spyware/Adware/Grayware/Viruses but I can't find anything about this one on the internet anywhere. One last thing - yesterday, when I went into My Computer, a second explorer.exe showed up in my processes. When I tried ending either, the system froze. I'm running Windows 2000 and my brain hurts from trying to rid this computer of this adware or virus. Can you please help? I'm running out of optins. Thanks!

Answer
Hi Allen,

Have you run the free virus scan from http://sarc.com/ ? Even though you Norton AntiVirus installed, I would suggest running that scan. At the SARC site, click http://sarc.com/  Scroll down and click on,"Free Online Virus and Security Check" and run the virus check. Write down exactly anything it finds, then return to: http://sarc.com/  and do a search for what was found. Symantec usually has a removal tool and/or directions for removing manually.

Did you check for updates on Spybot before running scan?

Let me know what happens,
Lorry