N
null
Everytime I click on the icon to open IE it opens up with a dark blue page
with the following in white writing
Detected SPYware! System error #384
__________________________________________________________________________
Your IP address is 62.254.0.36. Using this address a remote computer has
gained anaccess to your computer and probably is collecting the information
about the sites you've visited and the files contained in the folder
Temporary Internet Files. Attention! Ask for help or install the software
for deleting secret information about the sites you visited.
__________________________________________________________________________
Your computer is full of evidences!
ISP of transmission:NTLI
Your IP address:62.254.0.36
They know you're using:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Your computer is:Windows XP
Risk status for further investigation:VERY HIGH RISK
To protect from the Spyware - click here
To prevent information transmission - click here
To delete the history of your activity, click here
The above three lines are links to
http://www.e-shredder.com/enter.phtml?wm=kamid
The URL showing is C:\WINDOWS\secure.html. I keep deleting the HTML file
called secure.html in the windows folder but everytime I open IE the same
blue page appears and the secure.html file reappears in my windows folder
Everytime I close the window a full page window pops up advertising porn and
I get a red alert from NAV saying Bloodhound.Exploit.10 has been detected in
my local settings and that NAV is unable to repair it
But when I do a full NAV system scan it says there are no viruses on my
computer. What else can be causing this?
Have you read this?:
http://securityresponse.symantec.com/avcenter/venc/data/bloodhound.exploit.10.html
I suggest that you submit the file to Symantec as they suggest. The
"bloodhound" part means a heuristic (or general) detection without the
ability to pinpoint a specific malware.
Meanwhile, you might try renaming your hosts file to hosts.old. And
you haven't mentioned running AdAware and Spybot scanners. See my web
site for links.
Also, you can upload the suspect file for av scanning here:
http://www.kaspersky.com/remoteviruschk.html
See what KAV has to say about it. Maybe you can get a specific malware
name and then with some luck there might be a description available
which would give you enough info to remove the malware.
Keep us posted.
Art
http://www.epix.net/~artnpeg