Greetings,
I am running Windows XP Pro sp3. Here is what happened. I received a email from a friend who asked if I was the subject of a picture in the attached link. I clicked the link and downloaded a file called Photo.exe. I clicked the downloaded file and nothing happened, except the desktop background had changed to a black page with red lettering that said my computer had been infected and I needed to run antivirus software. Also, the desktop icons were visible with boxes around them. I went to the control panel and noted that the background was set to critical_warning.html and I could not change it. I then ran Norton antivirus ( I had run it earlier in the day as it was scheduled). NAV found 1 cookie and 2 files that were risks and fixed them. I then turned the machine off.
Next time I started up, I get to the Welcome screen, something I normally skip as I am the only user. On the screen I see only my account. I click it and windows starts to load, the desktop shows for a moment without any icons and then the startup screen comes back. At this point, just under my account, I see that windows is closing and saving my settings. Then I am back to the welcome screen.
I tried a safe boot and got the same results.
I then booted the computer off of the Norton NAV disk and ran a full system scan. The scan found nothing.
I searched the web and found some similar things around this system hijack.
I then booted off of the XP install disk and opened the recovery console. Beliving that Norton had removed the files but the registry was still pointing to them I did copy userinit.exe wsaupdater.exe, exited and then rebooted from the HD. I got the same results.
Anyone know how to remove the damage this virus has caused? I searched this forum , however, earlier posts all seemed to let the computer reboot.
Thanks for your help!