Is this dangerous?

[thebigdishman]

I am puzzled - baffled even. An icon has appeared on my desktop - not your standard link to a program or directory, just a small square icon - not quite always on top. I can drag it around the screen, but it does not have a link and I can't right mouse and delete it. Other than that it appears to be inert. I can best describe it as an orange space invader on a white backgroubnd 17 x 17 pixels. Does anyone have any idea what this could be?

[kgun]

... I can't right mouse and delete it.

But can you right click it and go to the target where you can delelte it?

1. Do you see something new in running processes?
2. What about: start + run + msconfig
3. System restoration, is that an option?

[spiderbait]

Can you see it from the "desktop" folder using Windows Explorer? That might give you more options to inspect its properties.

[RollerBall]

Are you crazy?

If ANYTHING suddenly appears on your PC that you did not put there you MUST nowadays assume that it is some form of malware.

Your 'icon' is a symptom of something far more sinister and if you can't remove whatever put it there you must do a system restore to before the event.

However as you have been foolish enough to click on the 'icon' you have most likely already set in motion what could ultimately end up destroying the records on your PC which is EXACTLY what happened to a colleague/poster on another forum that I am a member of. He also said it started with an innocuous white icon on his desk top that he clicked on.

My advice to you now is while the system is still running you back up all the key/sensitive/unreplaceable data it contains onto an external disk drive.

Then reformat the hard drive, reinstall your OS and apps and copy back the data. You also need to check that you have high quality protection installed against viruses and trojans - my guess is that currently you do not.

Please take this seriously, especially if your PC contains critical/sensitive data and/or is used for you business. There are a large number of brilliant programmers out there, in Asia, eastern Europe and South America predominantly, for whom the only opportunity to capitalise on their talent is to go over to the dark side. They are coming up the whole time with clever new code to take control over and link up large numbers of individual PCs to gather and feed back information to the 'control' without the owners of the PCs ever knowing. They are finding new ways to install their software - your 'Icon' is such a way - after which an individual infected PC becomes part of such a net. One clever angle is that the software is timed - it doesn't start runing immediately so when you do the checks as advised by the other posters you find nothing suspicious and are lulled into a false sense of security. Then it starts up, days or even weeks later.

My advice is not scare tactics - all this is fully documented on the Web if you care to look.

[kgun]

A fast question. Which web browser do you use?

[thebigdishman]

Hi

Various answers -

Mozilla Firefox v 2.0.0.18 (I downgraded from v.3.) -
Trend Micro PCcillin 2007 current and up to date - and it hasn't spotted anything wrong.
Everything is backed up (it always is).
It isn't visible in my Desktop directory.
I run Evidence Eliminator as a clean out once a week.
Everything I delete is done with the Evidence Eliminator secure deleter, and if that doesn't work I have PGP and Move on Boot as backups.

And finally thanks for all the interest.

[thebigdishman]

... and I only feformatted the drive and reinstalled everything two weeks ago.

[littlegiant]

Yeah I would have to agree with Rollerball... I would have a litter of kittens if I ever saw something like that on one of my computers. Stop everything that you're doing and run a full scan with all your antivirus and antispyware programs. Take a scattershot approach and run several of each. Also make sure your network status icon is displayed in your system tray and watch it for activity unrelated to your browsing/downloading activities. Also you could try downloading and installing Process Explorer and then run it and look for any process running that looks suspicious and doesn't have a description which might help you zero in on what that icon is. Although be careful.. don't just start deleting stuff willy-nilly trying to get rid of it. If you see a process running that is suspicous, google it and read up. e.g. "what is xxxx.exe" And yes, immediately back up everything and prepare for the worst, i.e., wiping out your hard drive and reinstalling Windows.

[claybutler]

Could you do a screen shot for us to see. Don't follow rollerballs advice (yet). That is way over the top. First just find out what it is. Most viruses and malware programs don't really do all that much damage. Most just slow things to a crawl. I'd do a sceenshot and post it on a virus/malware forum.

[pingram3541]

I would also suggest checking your network connections to see if anything suspicious is going on.

netstat -a

Then look for any suspicious ports or connections open.

Good luck.