Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Help Please


  • Please log in to reply
12 replies to this topic

#1 LCE

LCE

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:06:43 PM

Posted 07 April 2008 - 02:00 PM

Hi,
The other day while surfing the net I was told I needed to download Active-X control to view a web site,which I did and the next thing I know my computer is full of spyware,viruses you name it,it seems like I had it.
Using McAfee, Spybot S&D, SuperAntiSpyware, AVG 7.5 and Lavasoft Ad-Awear I believe I was able to get rid of most all the viruses/spyware as I am no longer getting pop-ups saying I am infected or being attacked,all scans using the listed software come back clean except for Spybot S&D which keeps coming up with and wont fix Zlob.Downloader.Vcd so I believe that I still have one infection left and I don't know how to get rid of it...

Can anybody help me get rid of this? I just hope nothing else is hiding in there still either.

I forgot to mention that I did have Smitfraud-C. but I used Smitfraudfix and that work to get it out.

If I can just get rid of this Zlob.Downloader.Vcd (whatever it is?) I believe my computer will be back to normal again.

Any help will be Greatly Appreciated
Thank You
LCE

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,093 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:43 PM

Posted 07 April 2008 - 02:03 PM

Smitfraud.C is Spybot S&D's name for a type of Vundo/Conhook infection. Vundo is a different infection from Smitfraud and SmitfraudFix is not designed to fix it.

Please print out and follow the instructions for using "Vundofix". -- If using Windows Vista be sure to Run As Administrator.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the 'Fix Vundo' button.
  • After running VundoFix, a text file named vundofix.txt will automatically be saved to the root of the system drive, usually at C:\vundofix.txt.
  • Please copy & paste the contents of that text file into your next reply.
Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself.
  • Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Acan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 LCE

LCE
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:06:43 PM

Posted 07 April 2008 - 02:09 PM

Hi,
I believe I got Smitraud-C. removed when I used Smitfraudfix the only thing I have left is Zlob.Downloader.Vcd is this what you are talking about?

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,093 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:43 PM

Posted 07 April 2008 - 02:28 PM

After running SmitFraudFix, a text file named rapport.txt would have automatically been saved to the root of the system drive, usually at C:\rapport.txt. Please copy & paste the contents of that text file into your next reply along with vundofix.txt and the log report from MBAM.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 LCE

LCE
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:06:43 PM

Posted 07 April 2008 - 04:37 PM

Hi quietman7,
ok, I followed your instruction and here are the logs you asked for...

VundoFix V7.0.3

Scan started at 12:27:33 PM 4/7/2008

Listing files found while scanning....

No infected files were found.


Beginning removal...

Malwarebytes' Anti-Malware 1.10
Database version: 598

Scan type: Quick Scan
Objects scanned: 45323
Time elapsed: 44 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 84
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\qdnkewfa.dll (Trojan.FalkeAlert) -> Unloaded module successfully.

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6c51f7e9-8542-4f25-a30f-2060157752e1} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{9d573d0e-663c-435f-bf31-2c4497373c41} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b1e68d42-02c4-465b-8368-5ed9b732e22d} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{90a52f08-64ac-4dc6-9d7d-4516670275d3} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{90a52f08-64ac-4dc6-9d7d-4516670275d3} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{014c9a3c-6536-401c-bb7b-02f216aff67a} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{02513621-13a6-4889-8b8e-6b6740344dfd} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0819549f-d828-4ae0-b42c-840778a8f438} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0ce72ba4-e7e7-4b30-a25a-39308cc000c5} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{167fa30a-614a-492c-babd-c1d0502f6da8} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1ad5e548-55ea-4c53-bbed-dd8f27847e02} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{255cefbf-fb76-461c-ac47-4e213a93f038} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2581ef35-421e-40e9-bd2c-d03fdc728076} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{26927fa6-ec5e-4d2a-925a-522c51e400bf} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2b587c57-be03-48e1-b262-7e45dbd39674} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{30c254ce-f1a1-4738-b60e-ba429e80102a} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3522e25b-8429-4600-9d2c-faa06e73a4a9} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3af9bf3c-5f8c-4aa5-934e-27d1c85cc588} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3b96265a-398d-4477-a4b6-69db93adfe4d} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3d767c0e-02b7-4632-b53a-7e236d916f75} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3e2defa9-c3ad-44cf-bc9a-9510ac03d9e6} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{46e67693-8c8e-4340-a3d3-a57d7f92941f} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4f6faa19-422c-4092-b6a7-788bbb385739} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{51c80f91-8636-4cc5-ade4-82d991285e09} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{544c3216-5c87-4850-9713-1d41c72cfb0b} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5483ba4c-e030-4565-b1fa-4e9abd43b1e2} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5aa8e8b9-ef7c-4069-bd5c-489809abfa89} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c1e0f22-0f71-43a5-bede-872be0d796b3} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5d773d06-a0e6-442e-bf15-0466663dbaba} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5e8a4fbf-a2fd-4b8d-94d8-5ef27e68706f} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{625a735f-ef85-4ac7-8aa8-1fa7108df4e5} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{648528b7-bb08-41cc-93e1-493f912044d8} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{67d711cc-6053-4d47-bc6e-aa31423c0f62} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{682fa83f-f5d6-4767-8702-737f47f966a5} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6c3b98df-bd29-4afc-a6ac-68e694c3873f} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{707c888b-a2b5-4f8a-b9cf-0c9920c30f63} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{743b19a2-02b4-4a7a-ba09-136ae58969db} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7b7ef4e7-696f-4d27-a9db-246286f8ead9} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8bef8c1b-2736-4121-8f79-57707d83c197} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8cf04a66-d2e2-4a67-a528-c28730ef4af7} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8f962603-3429-4e02-9370-f6a3e2ecda1f} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9263adbf-6f55-4582-818e-a4aff4157008} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{929fbcfb-d2a0-42f4-a00b-fd2385bf68c0} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{98ffd8e1-8db0-4f1d-8caf-7723bdafa66c} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9a7c2111-34b5-47a9-93f2-7cd742a1511d} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9db3b736-5903-45cc-a294-fae40a377456} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a1384508-3b08-4a85-93fa-6244fdec6c42} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a5deb117-bad9-4993-af39-ef86776991e7} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7ca4c92-7dc7-4884-ab02-6ae626881b4c} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ad62fa73-afb0-4bd2-a5f4-277e88389b87} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b1cca8d8-e282-4616-b378-254da6fce28f} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b810297a-8320-4c85-9924-8878089c401d} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b94ccc56-9220-4f75-93c8-5f2bd3ddcfd3} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c118eddd-6354-4260-af1e-198d3e57eddf} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c2d09fe0-989c-4a73-889b-def9cf5f651f} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c66d9708-eff4-4061-b5cb-492b55660aca} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c7821671-0d02-43eb-8d3c-a56c94e46f77} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ca4b6e21-c037-4c0c-a2ff-a61278254e1e} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cbf02074-7146-48dd-b5b8-0cf1107a70f7} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d74b6b39-f938-4256-a309-ddb8dcee23bd} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{db8aeee1-cc54-46ea-80db-d1ce39c8f92a} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e46377c3-e910-4773-9594-ff6cf73f8198} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e47aed38-a570-41da-9910-5d717320fb06} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e545203a-feff-449c-91a7-7140cc1556c8} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ed9bbd4d-22b5-4338-a3f0-4984fab4b162} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fb7d13e5-c384-4dbc-9277-1b607e3d5b06} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fcf2e1f8-0eb3-43b6-9084-e4da2e0642ae} (Trojan.FalkeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MiniBugTransporter.MiniBugTransporterX.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vnbptxlf.bedp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\vnbptxlf.ToolBar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchwbbar.settingsplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchwbbar.settingsplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchwbbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchwbbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchwbtoolbar.temperaturebarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchwbtoolbar.temperaturebarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoPlugin (Trojan.Fakealert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\qdnkewfa (Trojan.FalkeAlert) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\mgsvflkw (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\All Users\Application Data\rkfepwzw\rgnmtghi.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ajspcvct.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mratwrsj.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xgzatgzo.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\qdnkewfa.dll (Trojan.FalkeAlert) -> Delete on reboot.
C:\Documents and Settings\Owner\Local Settings\Temp\nyps4.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\rs.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\apoxqwfv.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

SmitFraudFix v2.309

Scan done at 12:26:41.81, Sun 04/06/2008
Run from C:\Documents and Settings\Owner\My Documents\My Pictures\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

#6 LCE

LCE
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:06:43 PM

Posted 07 April 2008 - 05:31 PM

Hi,
I just ran Spybot S&D and it no longer is showing Zlob.Downloader.Vcd(At least for the time being) so I am hoping that your instructions have taken care of it...

Is there anything else I need to do/try to make sure that my computer is totally clean of everything?

Thank You for your help I really Appreciate it.

EDIT: I just ran a quick scan with SuperAntiSpyware it it pulled out 5 more tracking cookies...so I guess I still have a ways to go.

Regards,
LCE

Edited by LCE, 07 April 2008 - 05:59 PM.


#7 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,093 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:43 PM

Posted 08 April 2008 - 08:34 AM

Cookies are text string messages given to a Web browser by a Web server. Whenever you visit a web page or navigate different pages with your browser, the web site generates a unique ID number which your browser stores in a text (cookie) file that is sent back to the server each time the browser requests a page from that server. Cookies allow third-party providers such as ad serving networks, spyware or adware providers to track personal information. The main purpose of cookies is to identify users and prepare customized Web pages for them.

The type of cookie that is a cause for some concern are "tracking cookies" because they can be considered a privacy risk. These types of cookies are used to track your Web browsing habits (your movement from site to site). Ad companies use them to record your activity on all sites where they have placed ads. They can keep count of how many times you visited a web page, store your username and password so you don't have to log in and retain your custom settings. When you visit one of these sites, a cookie is placed on your computer. Each time you visit another site that hosts one of their ads, that same cookie is read, and soon they have assembled a list of which of their sites you have visited and which of their ads that you have clicked on. They are used all over the Internet and advertisement companies often plant them whenever your browser loads one of their banners. Cookies are NOT a "threat". As text files they cannot be executed to cause any damage. Cookies do not cause any pop ups nor do they install malware.

As long as you surf the Internet, you are going to get cookies and some of your security programs will flag them for removal. However, you can minimize this by reading "Blocking & Managing Unwanted Cookies" and "Block Third-Party Cookies in IE7".

If there are no other problems or signs of infection, you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Go to Start > Run and type: Cleanmgr
  • Click "Ok".
  • Click the "More Options" Tab.
  • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#8 LCE

LCE
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:06:43 PM

Posted 08 April 2008 - 11:00 PM

Hi quietman7,
Thanks for the great explanation on cookies.
I have followed your instruction and have created a New Restore point. Everything seems to be back to normal.
How can I be sure though that I am ok and my computer is safe for me to go back to my bank account and other important sites? I'm really worried now to do anything remotely important on this computer.

I Really Appreciate you taking the time to help
Thank You
Best Regards,
LCE

Edited by LCE, 08 April 2008 - 11:01 PM.


#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,093 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:43 PM

Posted 08 April 2008 - 11:08 PM

Your welcome.

To protect yourself against malware and reduce the potential for re-infection, be sure to read:
• "Simple and easy ways to keep your computer safe".
• "How did I get infected?, With steps so it does not happen again!".
• "Best Practices - Internet Safety for 2008".
• "Hardening Windows Security - Part 1 & Part 2".
• "IE Recommended Minimal Security Settings".
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#10 LCE

LCE
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:06:43 PM

Posted 12 May 2008 - 12:57 PM

Hi quietman7,
It has been two weeks since I quit running scans every week to make sure my computer is virus free and everything has been great no viruses detected at all just the normal tracking cookies.

Well today I ran a scan and wouldn't you know it Spybot S&D found Smitfraud-C
I have no idea how I got it again as I have not downloaded anything since before the earlier incident?

I am going to run VundoFix right now but was wondering if there is anything else I should know about this infection and if my computer will be safe after and why it came back?

Thank You for the help

EDIT: I just ran VundoFix and it found nothing I also re-ran Spybot S&D and it came up clean as well.

Edited by LCE, 12 May 2008 - 01:38 PM.


#11 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,093 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:43 PM

Posted 12 May 2008 - 02:07 PM

Smitfraud.C is Spybot S&D's name for a type of Vundo/Conhook infection. Vundo is associated with various rogue applications so be sure to scan again with MBAM.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#12 LCE

LCE
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:06:43 PM

Posted 12 May 2008 - 05:42 PM

Hi,
Well,I scanned with VundoFix,Spybot S&D,MBAM,SuperAntiSpyware and all are now coming up clean so I am assuming that I am now free from SmitFraud,again?
I have read all the links you posted earlier but am unsure of how I could have gotten SmitFraud back when I haven't even downloaded anything,does it come in an email or...?

Thank You

Edited by LCE, 12 May 2008 - 05:43 PM.


#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,093 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:43 PM

Posted 13 May 2008 - 06:51 AM

You had a Vundo infection, not SmitFraud. Although it may appear similar in some aspects, it is a completely different piece of malware.

Vundo/Virtumundo is a Trojan that infects a system with malicious Browser Helper Objects and DLL files attached to Winlogon and Explorer.exe. The infection is responsible for launching annoying pop up advertisements and downloading more malicious files which slows your computer and hampers system performance. Newer variants of Vundo typically use bogus warning messages to indicate that your computer is infected with spyware or has critical errors as a scare tactic to goad you into downloading a rogue security application like WinFixer, WinAntiVirus Pro, or WinAntiSpyware to fix it. The messages can mimic system messages so they appear as if they are generated by the Windows Operating System.

Vundo spreads via Internet Relay Chat (IRC) and peer-to-peer networks, through emails containing links to websites that exploit your web browser’s security holes and by exploiting a vulnerability in older versions of Sun Java. When you click on a link in a Vundo-laced email, Internet Explorer launches a site that stealthy installs the Trojan so that it can run every time you startup Windows.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users