Re: VIRUS -need help

Tech-Archive recommends: Speed Up your PC by fixing your registry

its_my_dime wrote:

Still working on it. We may be dealing with something called
smithfraud-c according to Spybot.

About a week ago, David H. Lipman posted a thorough fix for the very
obtrusive SmitFraud:

From http://tinyurl.com/yen5bz :
Message-ID: <OSJTV7cCHHA.4928@xxxxxxxxxxxxxxxxxxxx>

Two part reply..

Perform Part 1 then perform Part 2.

If the first two parts don't work, perform the alternate section.

It is suggested that you execute each tool in Normal Mode then in
Safe Mode.



Part 1
-----------

Use noahdfear's SmitFraud, SpyAxe, SpyFalcon, et. al., removal tool
-- SmitRem.exe
http://noahdfear.geekstogo.com/click%20counter/click.php?id=1

http://www.bleepingcomputer.com/forums/topic43659.html


Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of
C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow
WGET.EXE to go through your FireWall to enable WGET.EXE to download
the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML
or C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of
the scan, it will be displayed in your browser (Opera, FireFox or
Internet Explorer). However, if you are using WinXP, Win2K or
Win2003 your system will be left in a state where you will have to
manually shutdown/reboot the PC. On Win9x/ME platforms the report
will not be shown in your bowser but your PC will automatically be
shutdown. It is suggested that you move the report out of c:\mcafee
before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and
save a copy of the HTML report for each session.


ALTERNATE:

S!ri's SmitfraudFix
http://siri.urz.free.fr/Fix/SmitfraudFix_En.php



Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in
your reply.

* * * Please report back your results * * *


.

Relevant Pages

  • Re: I Have a weird Virus?
    ... On Win9x/ME platforms the report will not be shown in your bowser ... It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML ... Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Computer Hijack
    ... On Win9x/ME platforms the report will not be shown in your bowser ... It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML ... Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool. ...
    (microsoft.public.security)
  • Re: Virus Alert Malware
    ... On Win9x/ME platforms the report will not be shown in your bowser ... It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML ... Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool. ...
    (microsoft.public.security)
  • Re: spyware threat detected comes on screen
    ... On Win9x/ME platforms the report will not be shown in your bowser ... It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML ... Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: I worm_attck v122.02a
    ... It is suggested that you execute each tool in Normal Mode then in Safe ... Use noahdfear's SmitFraud, SpyAxe, SpyFalcon, et. al., removal tool -- ... On Win9x/ME platforms the report will not be ... a copy of the HTML ...
    (microsoft.public.windowsxp.help_and_support)