i think i might have a computer virus.
i was on facebook, and all of a sudden a popup comes up and it says that i have 7 viruses found, it's come up about 5 times tonight, and it's not my regular virus protection software. i tried to open up my regular one, and it wouldnt let me. the popup is called " MS Removal Tool" i tried opening the control panel to see if something got downloaded, and it's not on there. sometimes when i close out of the program, it talks about registration, and when it finally closes, my home screen will be blue. i'll click on the personalize tab, and then the desktop background tap, and it'll go back to normal automatically without me having to change the picture. can anyone help me?
Get Firefox with NoScript and you won't see popups again nor will you never see most ads.
Btw, I use Avast, which is a free antivirus program and it's really strong. I recommend it over Norton and definitely McAfee, for example. Avast will block any page with malware on it before it has a chance to execute. You should have at least two different anti-virus programs on your computer.
scy5 answered Sunday April 3 2011, 10:33 pm: DangerNerd covered it well, but I have had to deal with several species of 'fake antivirus programs' on my families computers. I want to cover a few more things.
It's entirely possible that the virus will prevent you from downloading and running malwarebyte's program, claiming it is infected. If you have a flash drive, I recommend transferring the programs from a non-infected computer through the flash drive, so that it doesn't need to be installed. If it prevents you from using the program you should restart the computer in safe mode and try to fix it from there.
If you are unable to use internet explorer properly, it may have also messed with Internet Explorer's proxy settings. To fix this, go to tools, internet options, connections, lan settings and deselect proxy server. [ scy5's advice column | Ask scy5 A Question ]
DangerNerd answered Sunday April 3 2011, 6:41 am: Hi there,
This is part of the massive web defacement that has been dubbed "lizamoon."
It goes like this: A piece of code is added to a regular webpage by means of a security hole. That code redirects you to a fake anti-virus scam. If you fall for it and download it, then you are actually choosing to install the bad software that you were thinking you would get rid of. :-(
This is an old, old scam that is still going around. This is the largest number of sites to be defaced at one time, which is why it is all over the news:
... and tell him what system you are running. He might have a suggestion. He did a comparison of most of the free AV programs out there, but it was a while back and I don't know if he is doing a new version of his ranking or not.
In the mean time, since you ran the program and installed this fake program on your computer, you may need help getting the machine cleaned.
You should try cleaning your system with the tools I linked above, but if that fails, you may have to have a bit of help.
Some of these bugs install themselves in a way that makes it nearly impossible to boot from the same drive you want to clean.
The usual way this is handled is to remove the hard drive from your machine and hook it up to another machine that already has all the cleaning and repair tools installed on its own hard drive.
Those tools will then be used to repair your drive's operating system.
The drive is then re-installed in your computer and a few more steps are taken to get everything back to the way it was before this all happened.
In case you have any doubts that this thing you were tricked in to installing is related to the lizamoon injection attack against websites, then have a look at this video where someone infects their computer on purpose:
Attention: NOTHING on this site may be reproduced in any fashion whatsoever without explicit consent (in writing) of the owner of said material, unless otherwise stated on the page where the content originated. Search engines are free to index and cache our content. Users who post their account names or personal information in their questions have no expectation of privacy beyond that point for anything they disclose. Questions are otherwise considered anonymous to the general public.