BleepingComputer.com: Bloodhound Morphine, Smitfraud-c And Dyfuca

This morning NAV was flagging multiple copies of Trojan Horse and one incident of Bloodhound Morphine.

I ran NAV in Safe Mode with System Recovery set to 'off'.

Spybot was also flagging Smitfraud-C and DyFuCA.

I searched the Forum and followed instructions posted by Quietman7. Smitfraud-C and DyFuCA apear to have been successfully removed.

I just wanted to let you know that your instructions still seem to work:

http://www.bleepingcomputer.com/forums/topic54186.html

Thanks again.

Your welcome Ras_Al_Ghul and thanks for the feedback. One thing that has changed in those instructions is that Ewido 3.5 was recently updated to version 4.0 and works even better than ever.

Your welcome Ras_Al_Ghul and thanks for the feedback. One thing that has changed in those instructions is that Ewido 3.5 was recently updated to version 4.0 and works even better than ever.

Thanks, Quietman.

Interesting observation - Smitfraud-C seems to re-infect itself on our PC. Spybot always finds Smitfraud-C and something called Fastclick. It destroys Fastclick but not SmitFraud-C.

It doesn't APPEAR to cause any problems, but I would prefer it not be there be at all!

Would you recommend trying those steps again with the newer version of Ewido?

Should I post a HijackThis log?

Thanks.

Below is what Spybot finds:
==========================================================
FastClick: Tracking cookie (Internet Explorer: Daniel Campana) (Cookie, nothing done)


Smitfraud-C.: User settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-2732071641-624806248-3400032382-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\win-eto.com\*!=W=4

Smitfraud-C.: User settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-2732071641-624806248-3400032382-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\vparivalka.com\*!=W=4

Smitfraud-C.: User settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-2732071641-624806248-3400032382-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\tracktraff.cc\*!=W=4

Smitfraud-C.: User settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-2732071641-624806248-3400032382-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\trackhits.cc\*!=W=4

Smitfraud-C.: User settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-2732071641-624806248-3400032382-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\s13.tempx.cc\*!=W=4

Smitfraud-C.: User settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-2732071641-624806248-3400032382-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-spy-cam.net\*!=W=4


--- Spybot - Search && Destroy version: 1.3 ---
2005-04-26 Includes\Cookies.sbi
2005-07-22 Includes\Dialer.sbi
2005-07-22 Includes\Hijackers.sbi
2005-06-23 Includes\Keyloggers.sbi
2004-05-12 Includes\LSP.sbi
2005-07-22 Includes\Malware.sbi
2005-07-22 Includes\PUPS.sbi
2005-04-27 Includes\Revision.sbi
2005-07-22 Includes\Security.sbi
2005-07-19 Includes\Spybots.sbi
2005-02-17 Includes\Tracks.uti
2005-07-22 Includes\Trojans.sbi

Your Spybot log shows your using an outdated version (v1.3) of the program. You should remove it and download and scan with Spybot S&D 1.4. Be sure to update the definitions first.

As for the Smitfraud-C.: User settings (Registry change, nothing done) entries, are you using IE-Spyad? Read here.

Thanks, Quietman.

That seemed to do it. Smitfraud-c no longer appears on Spybot scan using the with updated version.

RE: IE-Spyad - I am not aware that anyone here uses it.

Thanks again.