I have run everything I know and my computer is still extrememly slow.
cndjoy,
Welcome to the forum, sorry for the delay but this forum gets quite busy most times.
Please download
SmitfraudFix
Extract the content (a folder named
SmitfraudFix ) to your Desktop.
Open the
SmitfraudFix folder and double-click
smitfraudfix.cmd
Select option #1 -
Search by typing
1 and press "
Enter "; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
Post a new HJT log also please
here is the smit log.
Hello cndjoy
When you reply to a post I am notified by email, so there is no need to PM me. Your system is infected with the
Smitfraud trojan, :wtf: this is what we need to do.
You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.
Download and install the 30 day trial of
AVG Anti-Spyware 7.5 to your desktop.
Once you have downloaded AVG Anti-Spyware 7.5 , locate the icon on the desktop and double-click it to launch the set up program. Once the setup is complete you will need run Ewido and update the definition files. On the main screen select the icon Update then select the Update now link. Next select the Start Update button, the update will start and a progress bar will show the updates being installed. Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab. Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this Under Reports Select Automatically generate report after every scan Un-Select Only if threats were found Close AVG Anti-Spyware 7.5 <– Do not run the scan yet. Boot your computer into Safemode Go to Start> Shut Off your Computer> Restart As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly. This will bring up a menu. Use the Up and Down Arrow Keys to scroll up to SAFEMODE Then press the Enter on your Keyboard
Tutorial if you need it
How to boot into Safemode
Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd Select option #2 - Clean by typing 2 and press "Enter " to delete infected files. You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection. The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter". The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart into normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply along with a new HijackThis log. The report can also be found at the root of the system drive, usually at
C:\rapport.txt
Launch AVG Anti-Spyware 7.5 by double-clicking the icon on your desktop. Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan . AVG will now begin the scanning process, be patient this may take a little time. Once the scan is complete do the following: If you have any infections you will prompted, then select Apply all actions Next select the Reports icon at the top. Select the Save report as button in the lower left hand of the screen and save it to a text file on your system make sure to remember where you saved that file, this is important Close AVG Anti-Spyware 7.5 IMPORTANT: Do not open any other windows or programs while AVG is scanning, it may interfere with the scanning process:
Reboot normally.
Open the SmitfraudFix folder and double-click smitfraudfix.cmd Select option #3 - Delete Trusted zone by typing 3 and press Enter Answer Yes to the question "Restore Trusted Zone ?" by typing Y and hit Enter. Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.
Please download
ATF Cleaner by Atribune to your desktop.
This program is for XP and Windows 2000 only Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Post the log from Smitfraud fix, the AVG Spyware log and a New HJT log please
HIJACK LOG
Hello Dan,
Without the AVG report its hard for me to see what was and what was not removed from your system, it also most times will give me tell tale signs of anything else bad that has to be removed. There is a report, you just may not have run it right. You may try opening AVG and click under Reports and see if there is one in there.
Open
HijackThis > Do a System Scan Only, close your browser and all open windows, the only program or window you should have open is
HijackThis , check the following entries and click on
Fix Checked.
O4 - Startup: PowerReg Scheduler.exe
You had Smitfraud , lets do this in lew of not seeing your AVG log.
Go start> Run type cmd and hit OK Type in ipconfig /flushdns then hit enter (that space between g and / is needed) Type exit hit enter Your Java is out of date and leaving your system vulnerable. Go to your Add-Remove Programs in the Control Panel and uninstall any previous versions of Java (J2SE Runtime Environment) It should have an icon next to it: [external image: Posted Image] Remove. Reboot your system. Then go to the Sun Microsystems and install the update Java Runtime Environment Version 6 Update 2 <–This is what you need to download and install.If you chose the online installation, it will prompt you to run the program. If you chose the offline installation, you will be prompted to save the file and you can run it from wherever you saved it. Then after install you can verify your installation here Sun Java Verify I like to to do the offline installation and save the setup file in case I may need it in the future
The rest of your log looks fine, how are things running now??
I'll do that, it is already running a bit better. The only thing AVG took was tracking cookies
Dan
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
