Smitfraud present

Good afternoon. I have a windows XP Professional DVR that shows the presence of Smitfraud when running spybot. I have followed the Readme thread and Special Rmoval threads and am posting the HJT log & Bitdefender. Panda would not run. Please advise. Thank you.

 

Hello, ailicis01.

Your log appears to be from Safe Mode. Please post a HijackThis log from Normal Mode.

Download DelDomains and unzip it to your desktop.

Find the files from deldomains.zip on your Desktop and RightClick on the deldomains.inf file and select Install.

Afterwards run Spybot and make sure you re-Immunize immediately. Then run a full system scan. If you get any reported problems, attach the log from Spybot.

 

Here is another HJT log

 

Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
On the page that opens, scroll down to xadz ... right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.

Next, run HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste the following into the box that opens, and press "OK":

xadz

In HJT Choose Open the Misc Tools Section choose Process Manager, Highlight:

Choose Kill Process

Now scan and have HJT Fix the following:

Download
- Pocket Killbox
- ExplorerXP

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click the RED X.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open ExplorerXP navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh HijackThis log, and the BitDefender and Panda ActiveScan logs.

You really need to update your OS to SP2 and bring it up2date, this will close many security holes in your OS.

 

The DVRNet and the P2P are essential programs. As I had mentioned, this computer is only used as a dedicated Video Surveillance Server. Killing those programs will render the computer useless. Please advise...Also when trying to update the OS, Microsoft is telling me that it cannot authenticate my OS. I purchased the server from a reputable company and I assume that the version of Windows is NOT licensed??????

 

Don't kill the services.

The other two lines are they also associated with the Video Surveillance Server?

If SP2 cannot authenticate your OS than you don't have a properly licensed OS. Get with the company who sold you the computer and have them give you a valid license; or you may be able to get a new Windows Key from Microsoft; provided you have the original Authentic XP installation CD.

Please post the BitDefender and Panda logs.