Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 91818 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

Smitfraud problem, scanned with Smitfraudfix


  • This topic is locked This topic is locked
6 replies to this topic

#1 Jim786

Jim786

    Authentic Member

  • Authentic Member
  • PipPip
  • 28 posts

Posted 27 September 2009 - 05:18 PM

Hello, I recently got keylogged and looked for the problem using Mcafee and found a program called Smitfraud, I was told by a friend this is where the problem is and was redirected to this forum, Im following the instructions on the removal and it says to post my rapport.txt file here for further assistance. I was hoping someone here could help me. Thank you. SmitFraudFix v2.424 Scan done at 20:30:58.06, Wed 09/23/2009 Run from F:\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\AstSrv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\UPHClean\uphclean.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE C:\WINDOWS\system32\cmd.exe hosts C:\ C:\WINDOWS C:\WINDOWS\privacy_danger FOUND ! C:\WINDOWS\inet20001\ FOUND ! C:\WINDOWS\system C:\WINDOWS\Web C:\WINDOWS\system32 C:\WINDOWS\system32\adobepnl.dll FOUND ! C:\WINDOWS\system32\atmclk.exe FOUND ! C:\WINDOWS\system32\dcomcfg.exe FOUND ! C:\WINDOWS\system32\ioctrl.dll FOUND ! C:\WINDOWS\system32\kernels64.exe FOUND ! C:\WINDOWS\system32\mscornet.exe FOUND ! C:\WINDOWS\system32\msdrives\ FOUND ! C:\WINDOWS\system32\mssearchnet.exe FOUND ! C:\WINDOWS\system32\netwrap.dll FOUND ! C:\WINDOWS\system32\nvctrl.exe FOUND ! C:\WINDOWS\system32\paytime.exe FOUND ! C:\WINDOWS\system32\svchosts.dll FOUND ! C:\WINDOWS\system32\wbeconm.dll FOUND ! C:\WINDOWS\system32\wiatwain.dll FOUND ! C:\WINDOWS\system32\1024\ FOUND ! C:\WINDOWS\system32\LogFiles C:\Documents and Settings\Farhan C:\DOCUME~1\Farhan\LOCALS~1\Temp C:\Documents and Settings\Farhan\Application Data Start Menu C:\DOCUME~1\Farhan\FAVORI~1 Desktop C:\Program Files Corrupted keys Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="" "SubscribedURL"="" "FriendlyName"="" o4Patch !!!Attention, following keys are not inevitably infected!!! o4Patch Credits: Malware Analysis & Diagnostic Code: S!Ri IEDFix !!!Attention, following keys are not inevitably infected!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri Agent.OMZ.Fix !!!Attention, following keys are not inevitably infected!!! Agent.OMZ.Fix Credits: Malware Analysis & Diagnostic Code: S!Ri VACFix !!!Attention, following keys are not inevitably infected!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri 404Fix !!!Attention, following keys are not inevitably infected!!! 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=" tuttkn.dll ,C:\\DOCUME~1\\Farhan\\LOCALS~1\\Temp\\11911750614mxx.dll" "LoadAppInit_DLLs"=dword:00000001 Winlogon !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe" RK [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" DNS Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport DNS Server Search Order: 192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 HKLM\SYSTEM\CS1\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 HKLM\SYSTEM\CS2\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 HKLM\SYSTEM\CS3\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 Scanning for wininet.dll infection End (This post was already sent in but a mod closed it thinking I posted it twice when it was only once.

    Advertisements

Register to Remove


#2 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,171 posts

Posted 28 September 2009 - 10:17 AM

Running the Clean

Warning: running option #2 on a non infected computer will remove your Desktop background.


Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
______________________________

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

Posted Image


The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
______________________________

Clean out your Temporary Internet files. Proceed like this:
  • Quit Internet Explorer and quit any instances of Windows Explorer.
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.
Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #5 - Search and Clean DNS Hijack by typing 5 and press Enter
Answer Yes to the question by typing Y and hit Enter.



Please post:
1.c:\rapport.txt


Your may need several replies to post the requested logs, otherwise they might get cut off.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#3 Jim786

Jim786

    Authentic Member

  • Authentic Member
  • PipPip
  • 28 posts

Posted 28 September 2009 - 11:45 PM

Hello, The problem is my computer is unable to go into safe mode. Ive tried everything, even a System restore but nothing is working. Another thing is, Mcafee is marking Smitfraudfix.exe a "potentially unwanted program" any reason why?

Edited by Jim786, 28 September 2009 - 11:45 PM.


#4 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,171 posts

Posted 29 September 2009 - 05:40 AM

Run it in Normal Mode then.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#5 Jim786

Jim786

    Authentic Member

  • Authentic Member
  • PipPip
  • 28 posts

Posted 29 September 2009 - 05:34 PM

Program has been run, here is the Rapport.txt file: SmitFraudFix v2.424 Scan done at 15:50:59.76, Tue 09/29/2009 Run from F:\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll Killing process hosts 127.0.0.1 localhost 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com ... VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri Winsock2 Fix S!Ri's WS2Fix: LSP not Found. Generic Renos Fix GenericRenosFix by S!Ri Deleting infected files Problem while deleting C:\WINDOWS\privacy_danger Problem while deleting C:\WINDOWS\inet20001 Problem while deleting C:\WINDOWS\system32\adobepnl.dll Problem while deleting C:\WINDOWS\system32\atmclk.exe Problem while deleting C:\WINDOWS\system32\dcomcfg.exe Problem while deleting C:\WINDOWS\system32\ioctrl.dll Problem while deleting C:\WINDOWS\system32\kernels64.exe Problem while deleting C:\WINDOWS\system32\mscornet.exe Problem while deleting C:\WINDOWS\system32\mssearchnet.exe Problem while deleting C:\WINDOWS\system32\netwrap.dll Problem while deleting C:\WINDOWS\system32\nvctrl.exe Problem while deleting C:\WINDOWS\system32\paytime.exe Problem while deleting C:\WINDOWS\system32\svchosts.dll Problem while deleting C:\WINDOWS\system32\wbeconm.dll Problem while deleting C:\WINDOWS\system32\wiatwain.dll Problem while deleting C:\WINDOWS\system32\1024 Problem while deleting C:\WINDOWS\system32\msdrives C:\Program Files\Common Files\VCClient Deleted IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri Agent.OMZ.Fix Agent.OMZ.Fix Credits: Malware Analysis & Diagnostic Code: S!Ri 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri RK DNS Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport DNS Server Search Order: 192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 HKLM\SYSTEM\CS1\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 HKLM\SYSTEM\CS2\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 HKLM\SYSTEM\CS3\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer=192.168.0.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{F4B6D2A1-CE59-4394-8EDC-1F137D9EC5B5}: DhcpNameServer=68.87.85.98 68.87.69.146 Deleting Temp Files Winlogon.System !!!Attention, following keys are not inevitably infected!!! "System"="" RK.2 Registry Cleaning Registry Cleaning done. SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll Reboot Problem while deleting C:\Program Files\Common Files\VCClient\ Problem while deleting C:\WINDOWS\inet20001 Problem while deleting C:\WINDOWS\system32\adobepnl.dll Problem while deleting C:\WINDOWS\system32\atmclk.exe Problem while deleting C:\WINDOWS\system32\dcomcfg.exe Problem while deleting C:\WINDOWS\system32\ioctrl.dll Problem while deleting C:\WINDOWS\system32\mscornet.exe Problem while deleting C:\WINDOWS\system32\mssearchnet.exe Problem while deleting C:\WINDOWS\system32\netwrap.dll Problem while deleting C:\WINDOWS\system32\nvctrl.exe Problem while deleting C:\WINDOWS\system32\svchosts.dll Problem while deleting C:\WINDOWS\system32\wbeconm.dll Problem while deleting C:\WINDOWS\system32\wiatwain.dll End

#6 Jim786

Jim786

    Authentic Member

  • Authentic Member
  • PipPip
  • 28 posts

Posted 01 October 2009 - 10:19 AM

Hello Whatthetech,

I am currently receiving help from Malware Removal and have been instructed to close this topic as I am already being helped there.

Sorry for any inconvenience.

Thank you.

#7 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,171 posts

Posted 01 October 2009 - 01:00 PM

Hello Whatthetech,

I am currently receiving help from Malware Removal and have been instructed to close this topic as I am already being helped there.

Sorry for any inconvenience.

Thank you.

No problem. WTT and MWR work together. :thumbup:

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users