I tried but can't remove smitfraud.

Comments

• Trogan London, UK

  December 2005 edited December 2005

  Hi,
  
  

  • Download, install, update, configure, and run Ad-Aware SE Personal 1.05.
    1. Download Ad-Aware SE Personal 1.06
       • Download Ad-Aware SE Personal 1.06.
       • Save aawsepersonal.exe to a convenient location.
    2. Install Ad-Aware SE Personal 1.05:
       • Double-click on aawsepersonal.exe to install the program.
       • Follow the default settings for installation.
       • After the program has finished installing uncheck the "Perform a full system scan now", "Update definition file now", and "Open the help file now" boxes.
    3. Update Ad-Aware SE Personal 1.05:
       • Double-click the Ad-Aware SE Personal icon on your desktop.
       • Click "Check for updates now" then click "Connect".
       • It will check for any updates. If any are found click "OK" to download and install the updates. Once it has finished click "Finish".
    4. Configure Ad-Aware SE Personal 1.05:
       • Click on the Gear button at the top of the window.
       • Click "General" on the left hand side to display the General Settings box.
         • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
           • "Automatically save logfile"
           • "Automatically quarantine objects prior to removal"
           • "Safe Mode (always request confirmation)"
           • "Prompt to update outdated definitions" - change to 7 days from the default 14.
       • Click "Scanning" on the left hand side to display the Scan Settings box.
         • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
           • "Scan within archives"
           • "Select drives & folders to scan" - select your hard drive(s).
           • "Scan active processes"
           • "Scan registry"
           • "Deep-scan registry"
           • "Scan my IE favorites for banned URLs"
           • "Scan my Hosts file"
       • Click "Advanced" on the left hand side to display the Advanced Settings box.
         • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
           • "Move deleted files to Recycle Bin"
           • "Include additional object information"
           • "Include negligible objects information"
           • "Include environment information"
       • Click "Defaults" on the left hand side to display the Default Settings box.
         • Make sure these items have your preferred settings in them.:
           • "Default homepage"
           • "Default searchpage"
       • Click "Tweak" on the left hand side to display the Tweak Settings box.
         • Click the + (plus) sign next to the Log Files section. This will expand the section.
         • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
           • "Include basic Ad-Aware settings in log file"
           • "Include additional Ad-Aware settings in log file"
           • "Include reference summary in log file"
           • "Include alternate data stream details in log file"
         • Click the + (plus) sign next to the Scanning Engine section. This will expand the section.
         • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
           • "Unload recognized processes & modules during scan"
           • "Scan registry for all users instead of current user only"
           • "Obtain command line of scanned processes"
         • Click the + (plus) sign next to the Cleaning Engine section. This will expand the section.
         • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
           • "Always try to unload modules before deletion"
           • "During removal, unload Explorer and IE if necessary"
           • "Let Windows remove files in use at next reboot"
           • "Delete quarantined objects after restoring"
       • Once you are done with these settings, click "Proceed" to save them.
       • This will take you back to the main screen.
    5. Run Ad-Aware SE Personal 1.05:
       • Click the "Start" button.
       • Uncheck the "Search for negligible risk entries" entry.
       • Choose the "Use custom scanning options" scan mode.
       • Click the "Next" button.
       • Ad-Aware will begin to scan for malware residing on your computer.
       • Allow the scan to finish.
       • Right-click on any entry in the list and click "Select All" to select the whole list.
       • Click "Next" and choose "OK" at the prompt to quarantine and remove the objects.

  
  
  
  Download Spybot S & D from here.
  

  1. Download and Install Spybot S&D (if you haven't already), accept the Default Settings
     
  2. In the Menu Bar at the top of the Spybot window you will see 'Mode'.
     Make certain that 'default mode' has a check mark beside it.
     
  3. Close ALL windows except Spybot S&D
     
  4. Click the button to ‘Search for Updates’ then download and install the updates.
     
  5. Next click the button ‘Check for Problems'
     
  6. When Spybot is complete, it will be showing ‘RED’ entries bold 'BLACK' entries and ‘GREEN’ entries in the window
     
  7. Make certain there is a check mark beside all of the RED entries ONLY.
     
  8. Choose ‘Fix Selected Problems’ and allow Spybot to fix the RED entries.
     
  9. REBOOT normally to complete the scan and clear memory.

  
  
  Post a new HJT log after

  0
• MoederTheresa

  December 2005 edited December 2005

  I'll do this at once and post the log. Fingers crossed.
  
  ManU will be considered the best by me if your solution helps me out
  
  
  Suddenly spyaxe popped up during the ad-aware scan. What the hell is that???
  
  Euh. Ad-aware didn't find anything and S&D alo didn't detect any spyware.

  0
• Trogan London, UK

  December 2005 edited December 2005

  You should have posted about SpyAxe in a new reply because I would have been notified. I would have missed this thread otherwise...:)
  --
  
  
  In order to clean your PC from infections related to Spyware Axe product, please follow the instructions below:
  
  1) Save Uninstallers.zip from http://www.spyaxe.net/uninstall/uninstallers.zip to your desktop or HDD.
  
  2) Extract 2 files "illegal_adv_uninstall1.exe" and "illegal_adv_uninstall2.exe" to your desktop or your HDD using WinZip.
  
  3) Execute both of them one by one by double-clicking with your mouse.
  *note: they will run instantly in the background. So don't be concerned when you don't visually see anything happening.
  
  4) Reboot your PC
  
  5) Your PC is now clean from the infections.
  
  If you haven't done so already, delete the entire spyaxe directory from your drive under program files.
  
  
  After that, close ALL open browsers and programs and complete the scans with Ad-Aware and SpyBot. Post a new HJT log after

  0
• MoederTheresa

  December 2005 edited December 2005

  Only illegal_adv_uninstall.exe is in the zip file.

  0
• Trogan London, UK

  December 2005 edited December 2005

  Run that file for now then
  
  
  Its late here and I need to get to bed. After you have finished with the SpyAxe fix, run both Ad-Aware and SpyBot. Post a new HJT log after.
  
  
  Let me know how things go and I'l check this thread soon

  0
• MoederTheresa

  December 2005 edited December 2005

  Sorry for keeping you up. I'm from Belgium so I know how late is allready is, lol.
  
  S&D wasn't able to remove smitfraud-c. What I was pretty happy about though is that it allready recognised it I also don't have any pop-up for now, there where pop-ups popped immediately after booting my PC. Well, here's the log file.
  
  Logfile of HijackThis v1.99.1
  Scan saved at 3:33:40, on 5/12/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\ewido\security suite\ewidoctrl.exe
  C:\WINDOWS\system32\gearsec.exe
  C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\RunDll32.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\WINDOWS\Dit.exe
  C:\WINDOWS\CNYHKey.exe
  C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
  C:\WINDOWS\system32\GSICON.EXE
  C:\WINDOWS\system32\dslagent.exe
  C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~3\OESpamTest.ExE
  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
  C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Hacker\KAVPF.exe
  C:\Program Files\Folding@Home\winFAH.exe
  C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Folding@Home\FahCore_7a.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Documents and Settings\Lobfra\Bureaublad\HijackThis-1\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
  O2 - BHO: (no name) - {3e9b951e-6f72-431b-82cf-4a9fbf2f53bc} - (no file)
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [Snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAudPropShortcut.exe
  O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [Dit] Dit.exe
  O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
  O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
  O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
  O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
  O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kav.exe" /minimize
  O4 - HKLM\..\Run: [OESpamTest] C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~3\OESpamTest.ExE
  O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
  O4 - HKCU\..\Run: [Utopia Angel] "C:\Utopia\Angel\Angel.exe"
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Startup: Folding@Home 5.03.lnk = ?
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
  O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Hacker\KAVPF.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
  O8 - Extra context menu item: Add to &Teleport - C:\Program Files\Teleport Pro\teleport.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
  O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O17 - HKLM\System\CCS\Services\Tcpip\..\{AB7C0561-DD17-4E2A-924A-2FC20595BFF4}: NameServer = 195.238.2.21 195.238.2.22
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
  O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
  O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
  O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
  O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kavsvc.exe
  O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
  
  
  
  I'll do a scan with panda also (it won't hurt I guess).

  0
• Trogan London, UK

  December 2005 edited December 2005

  Please move HJT to its own folder on your C: so backups can be created. Do this before continuing.
  --
  
  
  Check the following in HJT and click 'Fix Checked'
  
  O2 - BHO: (no name) - {3e9b951e-6f72-431b-82cf-4a9fbf2f53bc} - (no file)
  --
  
  
  Your log is clean. How are things?

  0
• MoederTheresa

  December 2005 edited December 2005

  Sorry for the late reply!
  I moved HJT to a separate folder and fixed the line.
  
  Well, everything is fine, first off all thx to you!!!
  Second, Royal Sporting Club Anderlecht has won for the first time this season in the champions league (and they didn't win last year eighter ) . Well, I hope for you that ManU pulls up a win against Benfica tomorrow!

  0
• Trogan London, UK

  December 2005 edited December 2005

  Glad your computer is back to normal
  
  
  Anderlecht I hope Man UTD win tomorrow...WHEN they do then come back and celebrate
  ---
  
  
  Follow these steps in order to keep your computer clean and secure:

  1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable
     and reenable system restore to make sure there are no infected files found in a restore point.
     
     You can find instructions on how to enable and reenable system restore here:
     
     Managing Windows Millenium System Restore
     
     or
     
     Windows XP System Restore Guide
     
     Re-enable system restore with instructions from tutorial above
     
     
  2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
     1. From within Internet Explorer click on the Tools menu and then click on Options.
     2. Click once on the Security tab
     3. Click once on the Internet icon so it becomes highlighted.
     4. Click once on the Custom Level button.
        1. Change the Download signed ActiveX controls to Prompt
           
        2. Change the Download unsigned ActiveX controls to Disable
           
        3. Change the Initialize and script ActiveX controls not marked as safe to Disable
           
        4. Change the Installation of desktop items to Prompt
           
        5. Change the Launching programs and files in an IFRAME to Prompt
           
        6. Change the Navigate sub-frames across different domains to Prompt
           
        7. When all these settings have been made, click on the OK button.
           
        8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
     5. Next press the Apply button and then the OK to exit the Internet Properties page.
     
     
  3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine.
     This alone can save you a lot of trouble with malware in the future.
     
     See this link for a listing of some online & their stand-alone antivirus programs:
     
     Virus, Spyware, and Malware Protection and Removal Resources
     
     
  4. Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
     (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
     
     
  5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
     Without a firewall your computer is succeptible to being hacked and taken over.
     I am very serious about this and see it happen almost every day with my clients.
     Simply using a Firewall in its default configuration can lower your risk greatly.
     
     For a tutorial on Firewalls and a listing of some available ones see the link below:
     
     Understanding and Using Firewalls
     
     
  6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
     This will ensure your computer has always the latest security updates available installed on your computer.
     If there are new updates to install, install them immediately, reboot your computer, and revisit the site
     until there are no more critical updates.
     
     
  7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
     This will provide realtime spyware & hijacker protection on your computer alongside your virus protection.
     You should also scan your computer with this program on a regular basis just as you would an antivirus software.
     
     A tutorial on installing & using this product can be found here:
     
     Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
     
     
  8. Install Ad-Aware - Download and install Ad-Aware.
     You should also scan your computer with this program on a regular basis
     just as you would an antivirus software in conjunction with Spybot.
     
     A tutorial on installing & using this product can be found here:
     
     Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
     
     
  9. Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
     settings that will protect you from running and downloading known malicious programs.
     
     A tutorial on installing & using this product can be found here:
     
     Using SpywareBlaster to protect your computer from Spyware and Malware
     
     
  10. IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
      
      Using IE-SPYAD to help block unwanted sites and activities
      
      
  11. Update all these programs regularly - Make sure you update all the programs I have listed regularly.
      Without regular updates you WILL NOT be protected when new malicious programs are released.

  
  Follow this list and your potential for being infected again will reduce dramatically.
  
  Glad I was able to help.

  0
• MoederTheresa

  December 2005 edited December 2005

  Woohoo, I now have a huge to-do list thx to you! I'll follow up, and I'm sure you'll celebrate tomorrow!!!

  0
• Trogan London, UK

  December 2005 edited December 2005

  Can I mark this resolved?

  0
• MoederTheresa

  December 2005 edited December 2005

  Yes, without any doubt!

  0