Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Virus Thing

  • Please log in to reply
2 replies to this topic

#1 Harvest


  • Members
  • 13 posts
  • Local time:07:51 PM

Posted 26 June 2006 - 11:00 PM

I got some odd error message thing, my pc is running really slo, and my homepage now takes me to some anti virus site thing and won't let me change it back to my road runner homepage... I brought in my norton, an xoftspy, and ad-aware to try and get rid of whatever it is. Norton deleted some stuff, ad -aware got a bunch more....and xoftspy found a bunch but...I don't have it registered so I could not remove what it found although I did delete two of the files it found manually.

I also tried that highkjack thing on this site and fixed a couple things. After all of this I have fixed a blaring virus warning message, and took off some stuff but the homepage site still takes me to the virus site, the computers still kinda slow, and when I restart my computer like 3 things come up as running in my program thing when I press ctrl alt del. they say ssecurty things and they have been there ever since the virus came. I end them by doing end tree task but they reapppear every time I restart the comp.

The main things that the xsoftspy thing still finds are "WhenUsavenow" registry key things that are located in wusn.1, software\whenu, software\classes\wusn.1,

The other is "smitfraud" which is a registry value thing located in "software\microsoft\windows\currentversion\policies\explorer\run\kernel32.dll" this is the one that I am mostly concerned about and I think this is the main problem...it lists this one as a high risk thing and I had already deleted 2 other ones named smitfraud like this one found in the windows 32 folder thing.

So what I really want to know is how do I remove this smitfraud thing and fix my homepage, and also...but less urgently, how do I removed the whenu stuff?


BC AdBot (Login to Remove)


#2 jgweed


  • Members
  • 28,473 posts
  • Gender:Male
  • Location:Chicago, Il.
  • Local time:07:51 PM

Posted 27 June 2006 - 12:17 AM

I would suggest you do a new HJT log and post it in the HJT log forum where our volunteer team of experts can review it and advise you both what to delete and how to do it safely. Be sure to reference your original post which explains the problems you are having.
Please read the instructions for posting a log here at BC :
Whereof one cannot speak, thereof one should be silent.

#3 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 51,779 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:51 PM

Posted 27 June 2006 - 09:49 AM

I also tried that highkjack thing on this site and fixed a couple things.

HijackThis is an advanced tool that requires advanced knowledge about the Windows Operating System. Most of the log entries are required to run a computer and removing essential ones can potentially cause serious damage such as your Internet no longer working or problems with running Windows itself.

If you do not have advanced knowledge about computers you should NOT fix anything using HijackThis without consulting a expert as to what to fix. If you choose to fix anything by yourself, you do so at your own risk.

I urge you to follow jgweed's instructions for getting assistance.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users