Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


My Pc Is Infected With Smitfraud? Tried All I Could Think Of..?

  • Please log in to reply
2 replies to this topic

#1 locachica


  • Members
  • 11 posts
  • Local time:10:28 PM

Posted 17 November 2007 - 02:55 AM

Hello All,

I had just received my Toshiba Satellite A75-s2762 laptop back from repair from Toshiba (the warranty is now out, I had to send it in numerous times because of overheating issues (common to this model) anyways, my sister got a hold of it and was downloading add-ons for Sims so she picked up some malware PSW.x-vir trojan which I've read is a rogue virus which is a yellow triangle which flashes intermittently, so I downloaded Smitfraud fix,hijackthis (and searched the dll files-especially the ones that were suspect and removed them, combofix, spybot s&d, adaware, norton and did scans, everything I had read online to do, it's so stubborn and wont go away...I did scans in safe mode, tried system restore, that didn't do it either. This laptop didn't come with an XP install disk but I think they told my mom that you can restore it from a partition in the HDD, but I'm not sure how to do that.. Soo if anyone can lend me a hand it'd be really appreciated! Earlier today I had thought it was gone but I turn the PC back on and I still have it, the name of it changes, NetWorm-i.Virus@fp also comes up in the balloon. It also flashes pop-up status messages pretending to be system messages, and pop-ups, some bad ones earlier. The bubble also says SYSTEM ALERT:MALWARE THREATS. "Your computer is infected with a black door Trojan that allows..." etc. it just went away again. There are even spelling errors in these pop-ups... You'd think they'd be a little smarter when it comes to tricking people with these PUP viruses, it's really bugging me.

Also, I have spybot protection on and I keep getting popups from that requesting a ALOT of registry changes, CATEGORY: BROWSER HELPER OBJECT..CHANGE KEY DELETED. ALLOW/DENy with a long string of numbers for the key.

So... I'm wondering,
Can anyone help me do a clean install of winxp? Will that help? :thumbsup: I went to Toshiba's website and couldn't find anything on it in the manual...
Anyways, I hope you can help I'd really appreciate it! :flowers: Any idea what else I could do if this isn't a viable option?

Edited by locachica, 17 November 2007 - 03:31 AM.

BC AdBot (Login to Remove)


#2 buddy215


  • Moderator
  • 13,508 posts
  • Gender:Male
  • Location:West Tennessee
  • Local time:09:28 PM

Posted 17 November 2007 - 08:04 AM

Super Antispyware has had success removing Smitfraud malware and will remove the malware that often comes
with it.
Install Super Antispyware free. Run it in safe mode. Allow it to quarantine whatever it finds.

Post a Hijack This Log in the Hijack This Forum by following the directions in the link below if the program above has not removed ALL malware. DO NOT post a log in this forum. http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/
“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#3 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 52,087 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:10:28 PM

Posted 17 November 2007 - 09:01 AM

Did you follow the generic instructions for using SmitfraudFix in BC's self-help tutorial "How to remove the Smitfraud/Generic Zlob"? If not, please do so.

By policy Microsoft no longer allows OEM manufactures to include the original Windows XP CD-ROM on computers sold with Windows preinstalled. Instead, most computers manufactured and sold by OEM vendors come with a vendor-specific recovery disk or recovery partition for performing a clean factory restore.

A Recovery Disk is a CD-ROM or DVD data disc that contains a complete copy/image of the entire contents of the hard drive that will restore the system to its factory default state at a certain time. Essentially, it will reformat your hard drive, remove all data and restore the computer to the state it was in when you first purchased it. You will lose all data and have to reinstall all programs that you added afterwards. This includes all security updates from Microsoft so you will need to download/install them again.

Some factory restore CDs give you all the options of a full Microsoft Windows CD, but with better instructions and the convenience of having all the right hardware drivers. Others can do nothing except reformat your hard drive and restore it to the condition it was in when you bought the computer. Before using a factory recovery disk make sure you back up all your data to another source such as a CD or external hard drive. If you do a Google Search, you will find links to topics on how to obtain a replacement recovery disk from various vendors.

A Recovery Partition is used by some OEM manufacturers (Dell, HP, IBM, Gateway) instead of a recovery disk to store a complete copy of the hard disk's factory default contents for easy restoration. This consists of a hidden bootable partition containing various system recovery tools, including full recovery of the preinstalled Windows XP partition that will allow you to restore the computer to the state it was in when you first purchased it. The recovery software will then re-hide its own partition after creating a new partition and installing the software to it. Before using a recovery partition make sure you back up all your data to another source such as a CD or external hard drive.

Recovery partitions may only work with a start-up floppy disk or the user may be prompted immediately after the "Out Of Box Experience" (OOBE) to create backup CD-R disks for the software on the hard drive image for future use. Once the CD's are made, the Operating System, Drivers, or Applications can be reinstalled using the files on the hard drive or the backup CDs.

Some built in recovery partitions can be accessed by hitting Ctrl+F11, just F11 or F10 during bios startup. Others like those used by IBM Thinkpads will display a message at bootup instructing you to press F11 to boot from the recovery partition. For more information, see Understanding Partition recovery.

I went to Toshiba's website and couldn't find anything on it in the manual...

Because you could not find it, does not mean there isn't one. Try contacting their customer support directly.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users