What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

smithfraud.c and disappearing icons

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have just encountered the smithfraud.c virus (trojan). I have been able to remove the virus (wp.exe. wp.bmp, wp.exe - in the prefetch folder). I am assuming that these files are the culprits. I have run AV software on the system (winXP pro) and it does not find any more viruses. I encountered the problem described below before removing the suspected virus files. I am able to log onto my system as two different users. As one user (the one who got the virus) my screen is black with no desktop or icons visible. I am unable to do anything while logged on in normal mode. I cannot logon with this user in safe mode because of how my network is set up. As the second user, I am able to logon in safe mode (no network) and see the desktop and icons - however the background is still black. I am able to access desktop properties and set the background - but it does not seem to do anything once selected. If I login in normal mode I do not see anything other than a plain blue screen with nothing on it. I can use cntrl-alt-del and get the 'windows security' box to show but that is about it. So, my question is what can I do to get back my desktop and icons? I can't do a 'restore' either - that's a long story… I have searched the forum and have tried a few suggestions on removing the virus but have not succeeded in fixing the problem. I do not see anything in my HJT scan that seems out of the ordinary for my machine. Thanks for any suggestions you might have…..
Post #2
I am also having the same problem as you I have been on this forum almost all day and to no avail I have found no help at all I have tried the suggestions also and nothing helps it seems other people's post have been answered but mine has not yet been answered if you find anything let me know or If I find anything I will let you know thanks Chastity
Post #3
Hello rbeales, Welcome to the forum.

This is what I suggest you do.

Download CWShredder from my signature below. Unzip it on the desktop.
Open CWShredder and with ALL other windows closed, click fix.


Go here and run at least one of the online scans, allow them to delete whatever they find:

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan
Note any thing that can't be fixed
Reboot when done.

Next:

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.3 and Ad-aware SE Build 1.05 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode check Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #4
LDTate,

Thank you for your suggestions. I have run e-trust locally on my machine which was updated this morning - I can no longer connect to the internet with the PC that is having problems. I have run ad-aware, spy-bot, and CWshredder as directed (all updated). None of them found anything - as I had previously run them earlier today.

Here is a copy of the HJT log. Please note that the gpl.dll file I have renamed since I did not know what it was for - the the 'file is missing' error;

Logfile of HijackThis v1.98.2
Scan saved at 8:35:22 PM, on 5/3/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
D:\Hijack\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: GetPostLog module - {C9B0D3DC-DC2B-4a17-8E34-02CD4C1E573F} - C:\WINDOWS\gpl.dll (file missing)
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrust\Antivirus\realmon.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PopUpKiller] C:\Program Files\PopUp Killer\PopUpKiller.EXE
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\Integrity Client\iclient.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe
O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [SRFirstRun] rundll32 srclient.dll,CreateFirstRunRp
O4 - HKLM\..\Run: [DXDllRegExe] C:\WINDOWS\RegisteredPackages\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}\dxdllreg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: DriveMapper.lnk = C:\Program Files\Netlogon\DriveMapper.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: TrueMobile 1150 Client Manager.lnk = ?
O4 - Global Startup: VPN Dialer (OnStartup).lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1110223910060
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll



I have also done an XP OS repair(not a restore) with no noticeable improvement.

System description; Win XP Pro. Two users- one local admin, the other logs onto a domain(the virus was loaded whiled logged on to the domain).

The system now has the following symptoms:

The local admin user can only logon in safe mode(network) and have things work. The desktop appears as one would expect - however the background is totaly black. On the desktop properties I see all the 'setup' tabs as one would expect - although the background settings have no affect when changed. I am able to access the internet as well.

If I log on normally as the local admin I see nothing but a solid blue (not black) screen with the arrow pointer. Pressing crtl-alt-del does bring up the expected dialog box. I can get to the task manager and view things - however it is very slow.

The domain user can logon in safe mode as well. However. the screen remains totally black (except for the 'safe mode' text). I am able to get to the desktop by pressing ctrl-alt-del and enter, spacebar….. which pops up an error box saying you are in safe mode. Proceeding from there the desktop will appear. The background is totally black. On the destop properties box, only two tabs are visible - the 'screensaver' and 'settings'. The internet has only worked for me once while in this mode. Logging off and logging back in as the local admin allows the internet to start working again.

If I logon as the domain user - as I normally would everything appears normal until the the local settings are loaded. After that the screen goes black. The only thing showing is the white arrow pointer. It is not possible to do anything at all once at this point. I can only physically turn off the power.

Any ideas how to fix the registry to get the desktop to show - I assume that some registry entries have been altered by the trojan.


Thanks again for your suggestions
Post #5
An update; It appears that I was premature in assuming nothing was happening when I logged in normally either as the local admin or as the 'domain user'. I happened to leave on the computer on after logging in. 45 minutes later the desktop finished loading. From there I was able to determine that the slow response was due to the antivirus software that was loaded. I removed the program and things load up much quicker - though still a bit slow. So, now only the problems of the background being black (missing) and the tabs missing on the desktop properties dialog box remain. Any further suggestions are welcome.
Post #6
Things are back to 'normal' now !!!! Thanks everybody for your help!

In summary this is how I got things back to normal:

Removed the wp.exe and wp.bmp files from c:\

Removed the wp.exe-xxxxxx.pf file from c:\windows\prefetch

Ran spybot, adaware, CWshredder, HJT, e-trust AV and got rid of anything suspicious

Uninstalled kasperky's AV program (installed based on other input - this is what caused desktop to not 'appear')

Ran RackTracker's script to fix the background and desktop properties problem - his script is in the thread "ipassist & smitfraud problems, help needed with my HijackThis log file" —-Thank's RackTracker!
Post #7
Great Job :thumbup:
Glad you got it fixed. :wavey:


If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI