6 replies to this topic

[Jim786]

Hello, I recently got keylogged and looked for the problem using Mcafee and found a program called Smitfraud, I was told by a friend this is where the problem is and was redirected to this forum, Im following the instructions on the removal and it says to post my rapport.txt file here for further assistance. I was hoping someone here could help me. Thank you. SmitFraudFix v2.424 Scan done at 20:30:58.06, Wed 09/23/2009 Run from F:\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\AstSrv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\UPHClean\uphclean.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS C:\WINDOWS\privacy_danger FOUND ! C:\WINDOWS\inet20001\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\adobepnl.dll FOUND ! C:\WINDOWS\system32\atmclk.exe FOUND ! C:\WINDOWS\system32\dcomcfg.exe FOUND ! C:\WINDOWS\system32\ioctrl.dll FOUND ! C:\WINDOWS\system32\kernels64.exe FOUND ! C:\WINDOWS\system32\mscornet.exe FOUND ! C:\WINDOWS\system32\msdrives\ FOUND ! C:\WINDOWS\system32\mssearchnet.exe FOUND ! C:\WINDOWS\system32\netwrap.dll FOUND ! C:\WINDOWS\system32\nvctrl.exe FOUND ! C:\WINDOWS\system32\paytime.exe FOUND ! C:\WINDOWS\system32\svchosts.dll FOUND ! C:\WINDOWS\system32\wbeconm.dll FOUND ! C:\WINDOWS\system32\wiatwain.dll FOUND ! C:\WINDOWS\system32\1024\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Farhan »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Farhan\LOCALS~1\Temp »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Farhan\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Farhan\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="" "SubscribedURL"="" "FriendlyName"="" »»»»»»»»»»»»»»»»»»»»»»»» o4Patch !!!Attention, following keys are not inevitably infected!!! o4Patch Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, following keys are not inevitably infected!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix !!!Attention, following keys are not inevitably infected!!! Agent.OMZ.Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, following keys are not inevitably infected!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix !!!Attention, following keys are not inevitably infected!!! 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=" tuttkn.dll ,C:\\DOCUME~1\\Farhan\\LOCALS~1\\Temp\\11911750614mxx.dll" "LoadAppInit_DLLs"=dword:00000001 »»»»»»»»»»»»»»»»»»»»»»»» Winlogon !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe" »»»»»»»»»»»»»»»»»»»»»»»» RK [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport DNS Server Search Order: 192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 HKLM\SYSTEM\CS1\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 HKLM\SYSTEM\CS2\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 HKLM\SYSTEM\CS3\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End (This post was already sent in but a mod closed it thinking I posted it twice when it was only once.

[LDTate]

Running the Clean

Warning: running option #2 on a non infected computer will remove your Desktop background.


Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer in Safe Mode.

• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe Mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.

______________________________

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.




The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
______________________________

Clean out your Temporary Internet files. Proceed like this:

• Quit Internet Explorer and quit any instances of Windows Explorer.
• Click Start, click Control Panel, and then double-click Internet Options.
• On the General tab, click Delete Files under Temporary Internet Files.
• In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
• On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
• Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
• Click OK.

Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #5 - Search and Clean DNS Hijack by typing 5 and press Enter
Answer Yes to the question by typing Y and hit Enter.



Please post:
1.c:\rapport.txt


Your may need several replies to post the requested logs, otherwise they might get cut off.

[Jim786]

Hello, The problem is my computer is unable to go into safe mode. Ive tried everything, even a System restore but nothing is working. Another thing is, Mcafee is marking Smitfraudfix.exe a "potentially unwanted program" any reason why?

Edited by Jim786, 28 September 2009 - 11:45 PM.

[LDTate]

Run it in Normal Mode then.

[Jim786]

Program has been run, here is the Rapport.txt file: SmitFraudFix v2.424 Scan done at 15:50:59.76, Tue 09/29/2009 Run from F:\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com ... »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files Problem while deleting C:\WINDOWS\privacy_danger Problem while deleting C:\WINDOWS\inet20001 Problem while deleting C:\WINDOWS\system32\adobepnl.dll Problem while deleting C:\WINDOWS\system32\atmclk.exe Problem while deleting C:\WINDOWS\system32\dcomcfg.exe Problem while deleting C:\WINDOWS\system32\ioctrl.dll Problem while deleting C:\WINDOWS\system32\kernels64.exe Problem while deleting C:\WINDOWS\system32\mscornet.exe Problem while deleting C:\WINDOWS\system32\mssearchnet.exe Problem while deleting C:\WINDOWS\system32\netwrap.dll Problem while deleting C:\WINDOWS\system32\nvctrl.exe Problem while deleting C:\WINDOWS\system32\paytime.exe Problem while deleting C:\WINDOWS\system32\svchosts.dll Problem while deleting C:\WINDOWS\system32\wbeconm.dll Problem while deleting C:\WINDOWS\system32\wiatwain.dll Problem while deleting C:\WINDOWS\system32\1024 Problem while deleting C:\WINDOWS\system32\msdrives C:\Program Files\Common Files\VCClient Deleted »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix Agent.OMZ.Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» RK »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport DNS Server Search Order: 192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 HKLM\SYSTEM\CS1\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 HKLM\SYSTEM\CS2\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 HKLM\SYSTEM\CS3\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! "System"="" »»»»»»»»»»»»»»»»»»»»»»»» RK.2 »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Reboot Problem while deleting C:\Program Files\Common Files\VCClient\ Problem while deleting C:\WINDOWS\inet20001 Problem while deleting C:\WINDOWS\system32\adobepnl.dll Problem while deleting C:\WINDOWS\system32\atmclk.exe Problem while deleting C:\WINDOWS\system32\dcomcfg.exe Problem while deleting C:\WINDOWS\system32\ioctrl.dll Problem while deleting C:\WINDOWS\system32\mscornet.exe Problem while deleting C:\WINDOWS\system32\mssearchnet.exe Problem while deleting C:\WINDOWS\system32\netwrap.dll Problem while deleting C:\WINDOWS\system32\nvctrl.exe Problem while deleting C:\WINDOWS\system32\svchosts.dll Problem while deleting C:\WINDOWS\system32\wbeconm.dll Problem while deleting C:\WINDOWS\system32\wiatwain.dll »»»»»»»»»»»»»»»»»»»»»»»» End

[Jim786]

Hello Whatthetech,

I am currently receiving help from Malware Removal and have been instructed to close this topic as I am already being helped there.

Sorry for any inconvenience.

Thank you.

[LDTate]

Hello Whatthetech,

I am currently receiving help from Malware Removal and have been instructed to close this topic as I am already being helped there.

Sorry for any inconvenience.

Thank you.

No problem. WTT and MWR work together.