Perfectcodec ISN'T: Please help a BOZO!

These:

C:\Documents and Settings\G018215\Desktop\SmitfraudFix\SmitfraudFix\Process.exe detected: Riskware.RiskTool.Win32.Processor.20
C:\Documents and Settings\G018215\Desktop\SmitfraudFix\SmitfraudFix\Reboot.exe detected: Riskware.RiskTool.Win32.Reboot.f
C:\Documents and Settings\G018215\Desktop\SmitfraudFix.zip/Process.exe detected: Riskware.RiskTool.Win32.Processor.20
C:\Documents and Settings\G018215\Desktop\SmitfraudFix.zip/Reboot.exe detected: Riskware.RiskTool.Win32.Reboot.f

Are just the tools used to rid yourself of the infection.


Thank you for choosing TomCoyote for your malware removal solutions.

M68

Please read:
Securing Your PC After An Attack

Ok, I get the Smitfraud listings, but what about the first one?: Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run –> WatchDog detected: Trace.Registry.WatchDog v8.5

From your log:

O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

Micah, I'm sorry; are you saying to go into Hijack this, run the scan, and then delete that line? Thanks for the help!

No.

That's what it's finding, and flagging as a "problem" (which it isn't).

It's just a "false positive".

If you're not getting any browser redirects, or pop-ups, you're "good to go".

Thanks Micah! You are not only a Prophet - you are a SAINT! Keith

Hey, a final query - my company uses Symantec AntiVirus for it's network; are any of these fixes going to set off alarms when I reconnect to the network tomorrow? IF so, any ideas on how to minimize the impact?

Well, one final one! -I've still got the a-squared scan results active; should I ignore these false positives, quarantine them, or delete them?

Ignore the false positives. Nothing you have done should set off any "alarms". If in doubt, uninstall anything we've used in fixing this. Then delete anything you've downloaded to beat this that can't be uninstalled. Then empty the recycle bin.

THANKS AGAIN!

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.