Help with W32.Myzor.FK@yf

Comments

• Nuppi South Ostrobothnia (Finland)

  May 2006 edited May 2006

  Hi jrseybert
  
  Download SmitfraudFix.zip to your desktop -> http://siri.urz.free.fr/Fix/SmitfraudFix.zip
  
  Unzip it (folder named SmitFraudFix) to your desktop:
  
  Open the folder SmitfraudFix and doubleclick smitfraudfix.cmd
  Choose option #1 - Search by typing 1 and pressing "Enter"; a textfile opens and lists the infected files (if those exist)
  
  Post the contents of this textfile to here.
  
  (Some antiviruses recognises process.exe as a malware. It is not malware, it is a program that stops processes)

  0
• jrseybert

  May 2006 edited May 2006

  Thanks for the help. Here is what came up.
  
  
  
  SmitFraudFix v2.40
  
  Scan done at 17:47:39.76, Sun 05/07/2006
  Run from C:\Documents and Settings\Sloppy\Desktop\SmitfraudFix
  OS: Microsoft Windows XP [Version 5.1.2600]
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
  
  C:\WINDOWS\system32\atmclk.exe FOUND !
  C:\WINDOWS\system32\dcomcfg.exe FOUND !
  C:\WINDOWS\system32\hp????.tmp FOUND !
  C:\WINDOWS\system32\ld????.tmp FOUND !
  C:\WINDOWS\system32\ot.ico FOUND !
  C:\WINDOWS\system32\stdole3.tlb FOUND !
  C:\WINDOWS\system32\1024\ FOUND !
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sloppy\Application Data
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Start Menu
  
  C:\DOCUME~1\Sloppy\STARTM~1\MalwareWipe 4.1.lnk FOUND !
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Sloppy\FAVORI~1
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
  
  C:\Program Files\Security Toolbar\ FOUND !
  
  »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
  "Source"="About:Home"
  "SubscribedURL"="About:Home"
  "FriendlyName"="My Current Home Page"
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
  !!!Attention, following keys are not inevitably infected!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» End

  0
• Nuppi South Ostrobothnia (Finland)

  May 2006 edited May 2006

  Boot your computer in safe mode.
  
  Open the folder SmitfraudFix and doubleclick smitfraudfix.cmd
  
  Choose option #2 - Clean by typing 2 and pressing "Enter" in order to remove the infected files.
  
  You are asked: "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove your desktop wallpaper and the infected registry keys.
  
  The tool checks if wininet.dll file is infected. You might be asked to replace the infected .dll (if found); answer "Yes" by typing Y and press "Enter".
  
  The tool might have to restart your computer; if it won't do it, restart your computer back to normal mode.
  A textfile will appear after the cleaning process, copy this file and paste it to here.
  That log is saved to your local diskdrive, usually C:\rapport.txt.
  
  Send a fresh hijack log too.

  0
• jrseybert

  May 2006 edited May 2006

  Thanks so much. It looks like it worked so far. My home page is back to normal. Here are the two logs, just in case. Once again, THANKS!!
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 6:23:37 PM, on 5/8/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\wltrysvc.exe
  C:\WINDOWS\System32\bcmwltry.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\ewido anti-malware\ewidoctrl.exe
  c:\program files\mcafee.com\agent\mcdetect.exe
  c:\PROGRA~1\mcafee.com\vso\mcshield.exe
  c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
  C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
  C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
  C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
  C:\WINDOWS\system32\WLTRAY.exe
  C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
  C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
  C:\Program Files\Real\RealPlayer\RealPlay.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\PROGRA~1\mcafee.com\agent\mcagent.exe
  C:\Program Files\McAfee.com\VSO\mcvsshld.exe
  C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
  C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
  C:\Program Files\McAfee.com\VSO\oasclnt.exe
  C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
  C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
  C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
  c:\progra~1\mcafee.com\vso\mcvsescn.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\PROGRA~1\Dell\QuickSet\quickset.exe
  C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
  C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\PROGRA~1\DELLSU~1\DSAgnt.exe
  C:\Program Files\AIM\aim.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\WINDOWS\system32\igfxsrvc.exe
  C:\Program Files\Digital Line Detect\DLG.exe
  C:\Program Files\FinePixViewer\QuickDCF.exe
  C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
  C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe
  C:\WINDOWS\System32\svchost.exe
  C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
  C:\WINDOWS\system32\wuauclt.exe
  c:\progra~1\mcafee.com\vso\mcvsftsn.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Documents and Settings\Sloppy\Desktop\Desktop\Virus Protection\HijackThis.exe
  
  R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
  O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
  O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
  O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
  O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
  O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
  O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
  O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
  O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
  O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
  O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
  O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
  O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
  O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
  O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [Dell QuickSet] C:\PROGRA~1\Dell\QuickSet\quickset.exe
  O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
  O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
  O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKCU\..\Run: [DellSupport] "C:\PROGRA~1\DELLSU~1\DSAgnt.exe" /startup
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
  O4 - Global Startup: Digital Line Detect.lnk = ?
  O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
  O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
  O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
  O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
  O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
  O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
  O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1132810817390
  O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
  O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
  O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
  O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
  O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
  O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
  O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
  O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
  O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
  O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
  O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
  O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
  
  
  
  SmitFraudFix v2.41
  
  Scan done at 18:15:47.39, Mon 05/08/2006
  Run from C:\Documents and Settings\Sloppy\Desktop\SmitfraudFix\SmitfraudFix
  OS: Microsoft Windows XP [Version 5.1.2600]
  
  »»»»»»»»»»»»»»»»»»»»»»»» Killing process
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
  
  C:\WINDOWS\system32\atmclk.exe Deleted
  C:\WINDOWS\system32\dcomcfg.exe Deleted
  C:\WINDOWS\system32\hp????.tmp Deleted
  C:\WINDOWS\system32\ld????.tmp Deleted
  C:\WINDOWS\system32\ot.ico Deleted
  C:\WINDOWS\system32\regperf.exe Deleted
  C:\WINDOWS\system32\stdole3.tlb Deleted
  C:\WINDOWS\system32\1024\ Deleted
  C:\Program Files\Security Toolbar\ Deleted
  
  »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
  
  Registry Cleaning done.
  
  »»»»»»»»»»»»»»»»»»»»»»»» End

  0
• bloggerous

  May 2006 edited May 2006

  W32.Myzor.Fk is quite a new adware/worm so most Antivirus and AntiSpyware would not be able to cure it as of the moment. But Spysweeper can detect and delete it. Be sure to have it updated and scan while on safemode.
  
  W32.Myzor Removal Procedure. Just follow the instructions and you'll get it off your system

  0
• cujo197706

  July 2006 edited July 2006

  SmitFraudFix v2.76
  
  Scan done at 19:09:04.78, 31/07/2006
  Run from C:\Documents and Settings\Brian P\Local Settings\Temporary Internet Files\Content.IE5\GT07EN4Z\SmitfraudFix[1]\SmitfraudFix
  OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
  Fix ran in normal mode
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Brian P\Application Data
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Start Menu
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\BRIANP~1\FAVORI~1
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
  
  C:\Program Files\IntCodec\ FOUND !
  
  »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
  "Source"="About:Home"
  "SubscribedURL"="About:Home"
  "FriendlyName"="My Current Home Page"
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
  !!!Attention, following keys are not inevitably infected!!!
  
  SrchSTS.exe by S!Ri
  Search SharedTaskScheduler's .dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "cholecyst"="{ee2975b6-e8d5-405e-8448-8fe9590f6cfb}"
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
  
  
  »»»»»»»»»»»»»»»»»»»»»»»» End

  0