my computer is currently under the influence of some sort of malware attack;
symptoms:
seems to be expressed through windows (XPsp3) virus protection notices;
two ‘windows antivirus’ alerts pop up, and the windows VP shield symbol show in the tray until it is full;
then W Internet Explorer is activated and tries to go to the page wwx.porno.orgooo, or wwx.viagra.comooo, or wwx.adult.comooo;
i use Opera exclusively, never IE, and have never visited any of these three sites to the best of my knowledge.
a series of messages showup as notification bubbles and popups: the main Popup says:
“Infiltration Alert, virus attack, your computer is being attacked by an internet virus, it could be a password-stealing attack, a
trojan-dropper or similar attack from 228.185.174.192, port 22152 OR a different ip, and port.”
generally i am instructed to activate my “antivirus software” which turns out to be an antivirus brand being offered for sale.
attempting to “buy” it (while disconnected from the internet) send me to “info-defender.com” via IE.
whatever it is is not noticed by Avast which was updated and running all this time and subsequent boot and hd scans turn up nothing.
most windows functions seem to not be working and my clock is now incorrect (this is obviously from another computer).
The scum/scam/rogueware displays fake alerts and may well be responsible for the other connection attempts.
Don’t visit the antivirus site or run its scan or pay for anything.
If you haven’t already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).
MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later. - 2. SUPERantispyware On-Demand only in free version.
Don’t worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.
When your programs fail to start due to a rogue/fake anti-malware infection, just download Hitman Pro and start it while holding down the left Ctrl-key until its window appears. This will instruct Hitman Pro to terminate all non essential processes in the user’s context, including the malicious application that terminates any program you want to run.
In this example Hitman Pro is started in Force Breach mode to take out the rogue Security Tool infection.
I raced Antivirus Soft by trying to open Task manager first. Although it blocked it twice (I was slow), on the third re-boot, I actually opened Task manager and turned off suspicious .exe files. This worked! I then ran Malwarebyte and it removed Antivirus Soft (and some other stuff).
Problem solved.
Thanks for your help (and prompts to go through bleepingcomputer.