Help - Search - Members - Calendar
Full Version: Smitfraud Bsod Error..
BleepingComputer.com > Security > Am I infected? What do I do?
   
jwinathome
I had seen a post elsewhere when I was on a different computer, but cannot find it now.

Smitfraud Fix (the utlility) has caused a BSOD error, the computer cannot boot into normal nor safe mode. The post I saw had a fix for this...can anyone guide me in the right direction.

Thank you.
Papakid
Here ya go: http://www.bleepingcomputer.com/forums/topic89339.html

Unfortunately, recovery options are limited. If you have any questions at all please let us know. I'm moving this over to the appropriate forum.
jwinathome
This is an absurd fix. I will not be using SmitFraud again.

I am very disappointed in this. The directions don't make much sense for someone to fix, and unfortunately I am going to have to now get the computer and work on it myself.
jwinathome
I booted to Windows XP CD, installed windows in a new folder...named "WINDOWS1"...downloaded the file from the Microsoft FTP site, followed the instructions listed, and it did not boot correctly.
Papakid
OK, I've merged your thread back with this one--please stick with this thread till we can get this worked out. I'm not the best at this but will have Grinler take a look.

So after you installed XP into the Windows1 you were able to boot into the new installation and carry out those instructions? And now you can't boot into your normal installation at all? So you have not been able to carry out step 14?
CrisGer
I am very eager to learn about this too, as I had a SmithFraud entry in a SpyBot scan that took three scans to remove, and i have had the BSOD rebooting going on randomly but never completely, i.e. i can still eventually regain full normal ops, but still get the BSOD screen occasionally so I am very interested to learn about this. smile.gif
Papakid
CrisGer, the fix being discussed here is only for people who ran version 2.169 of the SmitFraudFix program and as a result are unable to boot into windows at all. SmitFraudFix is a removal utility. Smitfruad is a common name of a desktop hijacking malware that tries to sell rogue security applications, which SmitFraudFix is designed to remove.

If you haven't run SmitFraudFix version 2.169 and you can still boot into windows, then this fix and discussion doesn't apply to you. The bug in the removal tool has been fixed in newer versions and is safe to run.

No offense, you're just confusing what we're calling a bug, and I'll post to your other thread on this subject and explain it some more.
jwinathome
QUOTE(Papakid @ Apr 22 2007, 09:02 PM) *
OK, I've merged your thread back with this one--please stick with this thread till we can get this worked out. I'm not the best at this but will have Grinler take a look.

So after you installed XP into the Windows1 you were able to boot into the new installation and carry out those instructions? And now you can't boot into your normal installation at all? So you have not been able to carry out step 14?



Actually, to be very clear...
Step 4: Full control was already selected, and there was no selection for "Everyone" as listed in step 5.
Step 8 says to boot to original Windows....did not happen. Got same BSOD after the Autochk missing error.
jwinathome
I still would really appreciate some help with this. smile.gif
Papakid
I'm sorry to say that this is not in my area of expertise at all and probably the best thing to do is to back up important data on the PC and reformat. I would like for the fix to be easier as well, everyone involved has made every effort to make it as simple as possible and we sincerely regret the inconvenience. Just please understand that this is not a typical problem as you're dealing with NTSF file system security features that aren't very well known. As Grinler mentioned here, there aren't many tools available to deal with this: http://www.bleepingcomputer.com/forums/ind...st&p=501786

I don't have a test system to try out that fix to see where the instructions could be better or possibly incomplete or where you may have made an understandable mistake. I could be wrong, but I don't think the origianl installation would work properly even if you were able to recover it.

Best I can tell you is some research I've done indicates that installing into another folder is not recommended and so the least desirable of the three options in the fix. Even tho it is the easiest to accomplish. So you might be better off trying an install on a different hard drive or removing the affected drive and plugging it into another computer.

One thing I've thought of, and have no idea if this will work or not, is to try steps 3 thru 6 on the C:\Windows folder instead of System32.

I also want everyone to know that every effort is made to provide people with safe removal tools. But there is always risk involved in installing and removing any software, whether wanted or not. I dare say thousands of people have successfully removed Smifraud variants with SmitfraudFix with no problems. It's been the easiest to use and kept up to date. New variants of Smitfraud come out nearly every day, so it is a struggle to keep the tool updated. In such circumstances, it's amazing that such small mistakes in code that resulted in this bug haven't happened before or at least are rare.
jwinathome
QUOTE(Papakid @ Apr 24 2007, 12:13 AM) *
I'm sorry to say that this is not in my area of expertise at all and probably the best thing to do is to back up important data on the PC and reformat. I would like for the fix to be easier as well, everyone involved has made every effort to make it as simple as possible and we sincerely regret the inconvenience. Just please understand that this is not a typical problem as you're dealing with NTSF file system security features that aren't very well known. As Grinler mentioned here, there aren't many tools available to deal with this: http://www.bleepingcomputer.com/forums/ind...st&p=501786

I don't have a test system to try out that fix to see where the instructions could be better or possibly incomplete or where you may have made an understandable mistake. I could be wrong, but I don't think the origianl installation would work properly even if you were able to recover it.

Best I can tell you is some research I've done indicates that installing into another folder is not recommended and so the least desirable of the three options in the fix. Even tho it is the easiest to accomplish. So you might be better off trying an install on a different hard drive or removing the affected drive and plugging it into another computer.

One thing I've thought of, and have no idea if this will work or not, is to try steps 3 thru 6 on the C:\Windows folder instead of System32.

I also want everyone to know that every effort is made to provide people with safe removal tools. But there is always risk involved in installing and removing any software, whether wanted or not. I dare say thousands of people have successfully removed Smifraud variants with SmitfraudFix with no problems. It's been the easiest to use and kept up to date. New variants of Smitfraud come out nearly every day, so it is a struggle to keep the tool updated. In such circumstances, it's amazing that such small mistakes in code that resulted in this bug haven't happened before or at least are rare.


Well, I certainly do appreciate the effort. And I am sorry for getting mad at the program. I understand the risk, and it is my own fault for not doing a quick backup. I used Smitfraudfix a dozen times without any issues, and then boom. Oh well. smile.gif Thanks again, and maybe I will try a different way.
Grinler
Hi, I have a fairly good understanding as to what needs to be done to get this working properly again. Give me a second to review the thread and I will get back to you.
jwinathome
Any ideas Grinler?
Grinler
Ok...so the original Windows is in C:\Windows and the new windows is in C:\Windows1 ?

Are you able to successfully boot the computer into the new Windows Installation?
jwinathome
Yes, you are correct.

I was able to boot into Windows1.
Grinler
What is the exact error you are getting when you boot that computer to the old version? Something about not being able to access a file?

Now boot back into the new version of Windows.

Go to the C:\Windows folder and right-click on the System32 folder and select properties.

Click on the security tab.

In the groups and user names box you should see some groups. To see a particular groups permissions, left click once on the group and you should see their permissions under the permissions box.

What are the groups and their permissions?

Does everyone exist in that list? If not, click on Add and select everyone. Depending on the OS you may have to click on Add, then advanced, then find now to see a list of the groups.

Once everyone is added, press ok to get back to the security tab and you should now see the everyone group in the groups field. Left click on the everyone group and then give it full permissions by putting a checkmark in the full access allow field.

Press the Apply and then the OK button.

Try to boot into the old operating system.
jwinathome
I had admittedly not added "everyone" to that group. I will try that.

The exact error after the SmitFraudFix was "autochk not found"
Grinler
Ok lets try adding everyone and see what happens.
jwinathome
Thanks much for the help Grinler. I am not that familiar with Home Edition unfortunately.

The PC is at my house so it will be tonight before I get a chance to try this. Will let you know how it goes though.
Grinler
Ok..I will check in from time to time tonight to see if you reply. What time zone are you in?
jwinathome
Eastern Standard
jwinathome
Didn't work....reformatted.

Oh well. smile.gif
Grinler
Sorry to hear that.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2008 Invision Power Services, Inc.