bho - hotfax - spywaredata.com

somae · Feb 20, 2009

SuperAntiSpyware just brought up something it's calling an undefined browser helper object. I assum it's from a program we purchased called "hotfax". The file is called "smfaxhelper.dll".

A search for the .dll file on google brought up something from spywaredata.com which said that the file is safe.

A search for info on spywaredata.com turned up some pages saying that they are spreading bad info.

Would appreciate any information about the program, file and web site.

Thanks.

chaslang · Feb 20, 2009

Sounds like a false positive. Make sure that you are using not only the detections database for SUPERAntiSpyware, but also the current version of the program which is 4.25.1012. If you have the current version and it is detecting this than use the embedded feature to report false positives.

somae · Mar 2, 2009

I thought to post into this thread rather than starting a new thread since it's looking like we do have some kind of malware. (The computer was hijacked to a commercial web site and other things).

I started going through the "malware removal procedure" and have attached the SAS log. The hotfax "trojans" were the only things found since I had already run the scan recently.

The computer hasn't had any problems so far, since quarantining of the hotfax files.

I did notify the SAS people of a possible false positive but haven't heard back from them yet.

somae · Mar 3, 2009

I wanted to add that the 1st time SAS found these files, it listed them as bhos. Seems that with the updates they're now being listed as trojans.

chaslang · Mar 5, 2009

Still looks like a false positive since HotFax appears to be a legit program. You should still do what I said and report this to SUPERAntiSpyware.

somae said: ↑

I thought to post into this thread rather than starting a new thread since it's looking like we do have some kind of malware. (The computer was hijacked to a commercial web site and other things).
Click to expand...

If you feel you have malware problems, you will need to run the full cleaning procedure and attach the remaining logs from Malwarebytes, ComboFix and MGtools, but do not base your decision of being infected on this lone detection of HotFax by SAS.

somae · Mar 5, 2009

I went ahead and removed the files SAS found for Hotfax and the Hotfax program still functions with no problems. The program came bundled with alot of other programs, (we got it thru ebay). I wonder if that's where the trojans came from, rather than Hotfax itself.

I did report the false positive to SAS and went thru their report procedure, but haven't heard back from them yet.

I'm also going thru the full cleaning procedure and will post the logs when finished.

Thanks.

somae · Mar 7, 2009

These are the logs of the scans.

Not sure whether we're still having problems or not. We still don't have any web sites showing in the ie7 "history". And, so far, the browser hasn't been hijacked again, or snap back to the 1st page when trying to maximize a 2nd page from the task bar.

chaslang · Mar 10, 2009

Your logs are clean.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

somae · Mar 10, 2009

chaslang said: ↑

Your logs are clean.

If you are not having any other malware problems, it is time to do our final steps:
Click to expand...

Thanks.

We seem to be still having malware problems. The screen snaps back to the 1st page when trying to maximize from the task bar. And internet explorer7 is very lagged compared to firefox (which I have now switched to).

I have tried deleting the ie history folder and it recreates but still has no visited web sites.

somae · Mar 11, 2009

I'm not sure what I was doing when I first noticed the problems happening. I did do a reinstall of win xp not that long ago when trying to set up a sata card/rwdvd to be able to boot. (It turned out I wasn't able to boot because the bios wasn't recognizing the card).

somae · Mar 11, 2009

(Wasn't able to edit the message following this one before the expired time - I wanted to add this to it.)

The setup required holding down the F1 key (?) during boot from the xp setup disk and then installing the drivers from a floppy.

I had posted a question to the hardware forum about this on 2/1/09 and posted again on 3/1 because of the problem that was happening with the ie history.

Maybe the problems are coming from the sata card driver.

chaslang · Mar 13, 2009

Your logs were all clean at the point I posted final instructions. And your previous logs did not show anything other than Hotfax. The problems you are mentioning since then do not sound like malware problems. They sound like problems within your Windows OS or with your Hardware. I suggest that you write up the exact details very clearly and explain them in a message in the Software Forum.

We could check your PC for signs of a rootkit, but I don't expect to find any. If you want to do this, then follow the steps in the below and attach the log from GMER:

Running GMER to detect rootkits

Perhaps you should also consider just uninstalling HotFax since it seems your problems have revolved around installingit.

somae · Mar 16, 2009

Just thought to be completely sure there is no malware before going on to software.

This is the gmer log.

chaslang · Mar 18, 2009

somae said: ↑

This is the gmer log.
Click to expand...

Also clean.

Log in or Sign up

bho - hotfax - spywaredata.com

somae Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

somae Private E-2

Attached Files:

sas-log.txt

somae Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

somae Private E-2

somae Private E-2

Attached Files:

ComboFix.txt

mbam-log-2009-03-03 (18-12-21).txt

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

somae Private E-2

somae Private E-2

somae Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

somae Private E-2

Attached Files:

gmer.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member