Warning! You’re In Danger! Desktop Wallpaper Hijack
“Warning! Your’re in Danger!” is a desktop wallpaper hijacked coming from rogue programs that belongs to single root. Fake antivirus program changes background images in determination to attract user’s attention on current security condition of computer.
Presence of Warning! Your’re in Danger! obviously denotes that system is under the influence of malware or frequently tagged as fake antivirus application. It enters the computer while disguising as software update when contracted web site is visited. Unwanted program secretly installs while user interest focuses on program update.
If successfully installed, background is instantly replaces with dark wallpaper containing the message:
WARNING!
YOUR’RE IN DANGER!
YOUR COMPUTER IS INFECTED WITH SPYWARE!ALL YOU DO WITH COMPUTER IS TORED FOREVER IN YOUR HARD DISK. WHEN YOU VISIT SITES, SEND EMAILS… ALL YOUR ACTIONS ARE LOGGED. AND IT IS IMPOSSIBLE TO REMOVE THEM WITH STANDARD TOOLS. YOUR DATA IS STILL AVAILABLE FOR FORENSICS. AND IN SOME CASES.
FOR YOUR BOSS, YOUR FRIENDS, YOUR WIFE, YOUR CHILDREN.
Every site you or someody or even something, like spyware opened in your browsers, with all the images, and all the downloaded and maybe later removed movies or mp3 songs – are still there and could break your life!SECURE YOURSELF RIGHT NOW!
REMOVE ALL SPYWARE FROM YOUR PC!
Damage Level: Medium
Systems Affected: Windows
ScreenShot Image:
Removing “Warning! You’re In Danger!”
1. Download Malwarebytes’ Anti-Malware (mbam-setup.exe) and save it on your Desktop.
2. After downloading, double-click on mbam-setup.exe to install the application.
3. Follow the prompts and install as “default” only
4. Before the installation completes, check on the following prompts:
- Update Malwarebytes’ Anti-Malware
- Launch Malwarebytes’ Anti-Malware
5. Click “Finish.” Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
6. Scan your computer thoroughly.
7. When scanning is finished, click on the “Show Results”
8. Make sure that all detected threats are marked, click on Remove Selected.
9. Restart the computer.
Note: Some malware may prevent mbam-setup.exe from downloading and running. You can download and rename this program from a different computer before running it on infected system.
Eduardo Pinzon
Jun 19, 2009 @ 01:44:26
It does not allow to run any exe files. Therefore even though I know Malwarebytes kicks butt. I can’t run it…
GulagGuy
Jun 19, 2009 @ 16:20:41
I got this same exact virus the other day and it took 3 days to get rid of it. I used COMBOFIX.EXE (downloadable from bleepingcomputer.com). Start PC in safe mode. Please note, you still won’t be able to run EXEs off your desktop. You’ll need to run combofix from a command prompt. This will prevent the blockage from kicking in. Hope this helps…
Sandra
Jun 29, 2009 @ 12:24:39
I’m not sure how I got this, but it took me about 4 hours to get it to stop popping up on my machine. I could not run any .exe files, so I was not able to install any software to get rid of it. I believe I disabled it by deleting the program from my start up and program folders and emptying the recycle bin. After that it stopped interfering and actually let me run task manager and my Symantec security which helped me detect/delete the virus files. I am taking it to my work techs to ensure it’s really gone – but this was a night mare. Note that it disables task manager so you can’t “end” the process to delete files – it was tricky.
aa
Jul 13, 2009 @ 00:44:14
How do you open .exe files using command prompt?
precisesecurity
Jul 13, 2009 @ 01:00:05
aa, just proceed to location and type the filename example, C:\mbam.exe
aa
Jul 13, 2009 @ 02:33:44
The program still won’t start and the command prompt doesn’t give any error.
aa
Jul 13, 2009 @ 03:09:55
It is also worth saying that it shows up in task manager under processes.
ucf
Aug 13, 2009 @ 12:02:38
Sandra what was the name(s) of the file(s) you deleted from start up and program folders?
Tung
Feb 19, 2011 @ 00:27:50
Run it on safe mode
divya
Feb 21, 2011 @ 14:36:36
Even i got same desktop background. I just downloaded malwarebytes and run it in safemode. It solved the problem in an hour.
dd
Feb 27, 2011 @ 01:40:41
I restarted my computer and the “WARNING” wallpaper had disappeared and I was able to run programs. I opened task manager, found and killed the virus process, then right click-open location, and deleted it.
Tequila Mockingbird
Feb 28, 2011 @ 23:51:56
I agree. Just download the free version onto your desktop, reboot your computer in safe mode, and install the software. Then make a voodoo doll of the POS that made this program and soak it in laxatives.
mandy
Mar 02, 2011 @ 12:58:59
i found it easier to…turn computer off…switch back on while pressing f8 continuously. then change to safemode…press enter…
It will then bring u onto ur computer desktop, but will be slightly different in apperance.
Then go into start…all programs…accessories…system tools…then system restore.
Restore ur computer to a date when it was safe. it will then automatically turn itself off, so when u start ur computer up again it will be fine and back to normal. hope this helps. xx
Neil
Mar 04, 2011 @ 15:30:32
my computer was infected with this virus yesterday and yes it was a pain!! It stopped any .exe files from working so therefore was unable to run any kind of antivirus or malware scan. The internet connection was still running so I downloaded Rkill (look it up via google). It comes in four versions with four different file extensions and stops malware processes. You just have to run each one individually until one works. Once it has worked then you can use your .exe files again i.e. I managed to run a malware scanner and removal tool which found the offending files and deleted them. NB. the Rkill only works for that session so if you restart your computer the virus will come back – you need to deal with it before restarting!
WBCS-Neo
Mar 08, 2011 @ 07:10:29
People in here who offer advice should be telling the “not so clued up” people that they require to start the system in SAFEMODE in order to gain access to their system so that they can then install MBAM and execute MBAM.EXE…..not everyone is technically minded!!! :P
Start the computer, once the POST screen (first logo screen or black POST info screen has passed, repeatedly press F8 to try to enter the Windows BOOT Menu, some PC’s use F8 to select a boot device, if this the case for you select your Hard Drive and press ENTER, then instantly press F8 straight afterwards to get the Windows BOOT Menu. If you don’t get it, restart and keep trying, speed a and timing is required to get to the BOOT Menu on a lot of newer PC’s as they are so quick at starting up!
When you get to the Boot Menu, select “Safe Mode with Networking”, this will usually allow you to gain access to the internet through your LAN port (if you use wireless you will require to conenct via the LAN cable), this means when you install Malware Bytes, you’ll be able to do an update straight away.
Do a full scan, destroy the sucker, restart the PC and have a nice day :)
Jim
Mar 14, 2011 @ 00:57:24
Run exe file in safe mode. f8 on startup.
Pradeep
Mar 16, 2011 @ 07:10:28
after downloading i m unable to execute it what yo do please help me ASAP
Kelly
Mar 18, 2011 @ 11:41:19
I’ve tried running in safemode, but can’t get it to work (tried pressing F8 continuously). Can anyone help?
Bob
Mar 22, 2011 @ 20:58:49
Kelly, wait until the first screen that pops up when the computer starts goes blank (black). Then hold down f8