strange virus on machine.

[alidabiri]

hi,
i recently installed win-xp on my machine. after installation (a few days later). i keep getting these strange pop ups that looks like coming from windoes:
"your system is infected. visit registryalert.com" or regfix.com or regfixer.com" the last message says that windows will shut down in 30 seconds, and shuts my system down. is there anyway i can get rid of this? is this coming from windows? or ms-new anti spy? any help would be appreciated.

 

[BillyRayPreachersSon]

is this coming from windows? or ms-new anti spy?

My bet is neither - it sounds more like spyware or those annoying advertising things that pop up via the messenger service to me.

Disable your messenger service (at least I think that is what it is called), and run something like seahc-and-destroy.

For more information, I suggest taking this to the Virus/Spyware discussion forum:

http://www.tek-tips.com/threadminder.cfm?pid=760

Hope this helps,
Dan

[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]

 

[smah]

I agree, but have a couple more questions - what SP level of XP is this & is the native firewall enabled?

 

[electronicsfreak]

I agree with BillyRayPreachersSon, I believe its the messenger service. Now as for your system shutting down that sounds like either sasser or blaster worm.

(msblaster patch)

http://www.microsoft.com/technet/security/Bulletin/MS03-026.mspx

(sasser patch)

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Also as soon as you get these installed and machine back to normal if this helps i reccomend downloading all updates/patches/service packs for the machine.

 

[electronicsfreak]

Also these might help.

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.b.worm.html