Specialty Forums Security and Virus
General Hardware
CPUs/Overclocking
Networking
Digital Photo/Video
Office Software
PC Gaming
Console Gaming
Programming
Database
Web Development
Digital Home
General Forums Windows XP
Windows Vista
Windows 95/98
Windows Me
Windows NT
Windows 2000
Win Server 2008
Win Server 2003
Windows 3.1
Linux
PDAs
BeOS
Novell Netware
OpenVMS
Solaris
Disk Op. System
Unix
Mac
OS/2
Drivers Driver Scan
Driver Forum
Software Automatic Updates
BIOS Updates My Computing.Net Solution Center Free IT eBook Howtos Site Search Message Find RSS Feeds Install Guides Data Recovery About Home
HELP Smithfraud core
Original Message
Name: jumpinjohn Date: May 10, 2007 at 13:53:51 PacificSubject: HELP Smithfraud coreOS: Win XP SP2CPU/Ram: AMD 3200/1024
Comment: I'm getting many popups, need help to remove. Some pop up in new IE windows, some in what appears to be a mini-browserRan AVG antivirus-nothing found.
3 could not be removed, in-use
Report Offensive Message For Removal
Response Number 1
Name: jabuck Date: May 10, 2007 at 14:09:28 PacificSubject: HELP Smithfraud core
Reply: (edit )Post your Hijack This log.
Please download SmitFraudFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop.
!!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!!
Report Offensive Follow Up For Removal
Response Number 2
Name: jumpinjohn Date: May 10, 2007 at 14:15:38 PacificSubject: HELP Smithfraud core
Reply: (edit )Thank You for the quick reply.Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.netzero.net/s/sp http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://g.msn.com/0SEENUS/SAOS01?FOR... http://messenger.zone.msn.com/binar... http://www.fileplanet.com/fpdlmgr/c... http://cdn.scan.onecare.live.com/re... http://update.microsoft.com/microso... http://messenger.zone.msn.com/binar... http://messenger.zone.msn.com/binar... http://fpdownload2.macromedia.com/g...
=============================================
Scan done at 17:13:43.92, Thu 05/10/2007
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
SrchSTS.exe by S!Ri
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport
HKLM\SYSTEM\CCS\Services\Tcpip\..\{DAABEF24-24A3-49E8-B223-DDAE958BE4A0}: DhcpNameServer=68.87.74.162 68.87.68.162
Report Offensive Follow Up For Removal
Response Number 4
Name: jumpinjohn Date: May 10, 2007 at 15:42:10 PacificSubject: HELP Smithfraud core
Reply: (edit )"John S" - 2007-05-10 18:21:33 Service Pack 2
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\easytunev
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\efax 4.2
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jet detection
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\quicktime task
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\roxiodragtodisc
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sunjavaupdatesched
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updatemgr
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updreg
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\xloadnet
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost
Contents of the 'Scheduled Tasks' folder
********************************************************************
catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
Completion time: 2007-05-10 18:30:29 - machine was rebooted
Report Offensive Follow Up For Removal
Response Number 5
Name: jabuck Date: May 10, 2007 at 16:53:07 PacificSubject: HELP Smithfraud core
Reply: (edit )Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install AVG Anti-Spyware We will need this later in safe mode
Be sure to update AVG Anti- Spyware
Download Killbox to your desktop from this link Killbox We will need it later in safe mode
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked":
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
Exit Hijack This but remain in safe mode.
Run Killbox from safe mode. Please double-click Killbox.exe to run it.
C:\WINDOWS\system32\sfsync03.dll
C:\WINDOWS\system32\sfsync02.dll
C:\WINDOWS\system32\sav950231.sys
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\sav970451.sys
C:\WINDOWS\system32\sav80231.sys
C:\WINDOWS\system32\sav87312.sys
C:\Temp\tn3
Return to Killbox, go to the File menu, and choose Paste from Clipboard.
If your computer does not restart automatically, please restart it manually.
Next , navigate to and delete these folders if found:
C:\qoobox
Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.
AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side.
Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).
Reboot to normal mode.
Open notepad (Start Menu > Run > Type notepad and press "ok".
Copy and paste everything into notepad between the x's making regedit4 the top line.
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\xloadnet]
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop.
Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes.
Post the AVG AntiSpyware report please and a new combofix log.
Report Offensive Follow Up For Removal
Response Number 6
Name: jumpinjohn Date: May 10, 2007 at 19:14:48 PacificSubject: HELP Smithfraud core
Reply: (edit )
+ Scan result:
C:\Program Files\DAEMON Tools\SetupDTSB.exe -> Adware.SaveNow : Cleaned.
__________________________________________
"John S" - 2007-05-10 22:09:51 Service Pack 2
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\easytunev
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\efax 4.2
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jet detection
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\quicktime task
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\roxiodragtodisc
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sunjavaupdatesched
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updatemgr
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updreg
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost
Contents of the 'Scheduled Tasks' folder
********************************************************************
catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
scanning hidden files ...
scan completed successfully
Completion time: 2007-05-10 22:11:32
Thank You.
Report Offensive Follow Up For Removal
Response Number 10
Name: dowjones Date: July 5, 2007 at 10:07:34 PacificSubject: HELP Smithfraud core
Reply: (edit )SpyBotS&D will remove this "crud" IF the computer is booted into the safe mode and SpyBotS&D is run.
Report Offensive Follow Up For Removal
Use following form to reply to current message:
