What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] smitfraud

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello,

As far as I can tell, the computer is running fine now. I had blocked NT kernal & explorer.exe with sygate because it seemed to stop the popups. Before , about every 30 seconds sygate would warn me that one of those applications was trying to connect. It is not doing that anymore :)

Is it okay to unblock those now ? And also once Im done here should I turn back on Windows firewall and use both, or should I just stick with one of the other ?

Here is the SUPERantispyware log :

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/28/2008 at 06:06 AM

Application Version : 3.9.1008

Core Rules Database Version : 3389
Trace Rules Database Version: 1383

Scan type : Complete Scan
Total Scan Time : 02:12:39

Memory items scanned : 432
Memory threats detected : 0
Registry items scanned : 5312
Registry threats detected : 0
File items scanned : 81348
File threats detected : 135

Adware.Tracking Cookie
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@cbs.112.2o7[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@potpourrigroup.112.2o7[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@adinterax[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@pandasoftware.112.2o7[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@azjmp[2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@ford.112.2o7[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@realmedia[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@2o7[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\[removed]-sys[2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@fastclick[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@atdmt[2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@tacoda[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@findology[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@advertising[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@clickbank[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@nextag[2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@adrevolver[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@serving-sys[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@apmebf[2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@mediaplex[2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@adbrite[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@adlegend[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@statcounter[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@partner2profit[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@revsci[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@charmingshoppes.112.2o7[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@atwola[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@msnportal.112.2o7[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@zedo[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][3].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@tribalfusion[3].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@indiads[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@yadro[2].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@trafficmp[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@valueclick[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@roiservice[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@quickbanner[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@specificclick[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@overture[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@mazda.122.2o7[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@jennycraig.112.2o7[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@shopping.112.2o7[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@indextools[2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@interclick[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@hitbox[2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@doubleclick[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@questionmarket[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@findagrave[2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@dealtime[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@socialmedia[2].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@incentaclick[1].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][2].txt
C:\Documents and Settings\NancyJ\Cookies\[removed][1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@adecn[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@media6degrees[1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@2o7[1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@adecn[2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@adknowledge[2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@admarketplace[2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@atwola[2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@belnk[1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@burstnet[1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@friendfinder[2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@ientry[2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@interclick[2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@nextag[1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@omnistats[1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@partner2profit[2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@qnsr[1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@trafficdashboard[2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@warlog[1].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\[removed][2].txt
C:\Deckard\System Scanner\20080127193411\backup\DOCUME~1\NancyJ\LOCALS~1\Temp\Cookies\nancyj@yieldmanager[1].txt
C:\Documents and Settings\LocalService\Cookies\system@findwhat[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@mediaplex[1].txt
C:\Documents and Settings\NancyJ\Cookies\nancyj@tribalfusion[2].txt

Adware.k8l
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\MESSENGER\CERTEMO.HTML.VIR

Trojan.Unknown Origin
C:\QOOBOX\QUARANTINE\C\WINDOWS\TMFUY3LK\NAIRSA54.VBS.VIR
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP6\A0000261.VBS
Post #17
Hello

Is it okay to unblock those now ? And also once Im done here should I turn back on Windows firewall and use both, or should I just stick with one of the other ?

Yes it is ok to unblock those. You can't have two firewalls running or it causes a lot of problems, so leave the Windows firewall disabled


You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here



Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.



Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.
Post #18
Thank you so much. I will follow your recommendations and get those downloaded. I appreciate your time and help. Once again THANKS !! Nancy
Post #19
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI