Help!

Hi cyberarts and welcome to the TomCoyote forums.
My name is Vino Rosso - if it helps, you can call me Vino for short. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a little time to research and, while I complete my training, all my recommended fixes will be checked by an expert.

Please be patient and I'd be grateful if you would note the following:

• I will working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Finally, please reply to this thread. Do not start a new topic.

I'll be back soon once I've checked out your log.
Thanks
Vino

Hi cyberarts

I've had a chance to look through your log and these are the first steps we need to take. Please read through the following and ask any questions for anything you're not sure of.

1 - Move HijackThis
You are running HJT from an unsafe location. An easy way to correct this is to do the following:

Download a copy of HJTsetup.exe from >here< and save it to your Desktop.

• Double click HJTsetup.exe to begin installation.
• By default it will install to C:\Program Files\Hijack This.
• Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
• Put a check by Create a desktop icon then click Next again.
• Continue to follow the prompts from there.
• At the final dialogue box uncheck the box to the left of "Launch Hijackthis" and then click Finish

2 - Uninstall List
Run HijackThis then click on Open the Misc Tools section
Click on Open Uninstall Manager…
Click on Save list…
Leave the default filename as uninstall_list.txt and save the file, noting where it has been saved
Close HijackThis.

3 - Download Smitfraud

Only for Windows XP and Windows 2000

Download SmitfraudFix (by S!Ri) from >here< to your Desktop
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

[external image: Posted Image]

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter

[external image: Posted Image]

This program will scan large amounts of files on your computer for known patterns so please be patient while it works. It will create a file named: c:\rapport.txt

IMPORTANT: Do NOT run any other options until you are asked to do so!

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

4 - Check on status
After you have completed the above, please run HijackThis and generate a new HijackThis log then reply with:
- uninstall_list.txt
- C:\rapport.txt
- a new HijackThis log
If necessary, please post these logs in separate replies.

Remember, it's worth printing these instructions out before you start.

Good Luck
Vino