Smitfraud-C.CoreService

Discussion in 'Malware Help (A Specialist Will Reply)' started by AbbieCG, Nov 6, 2007.

  1. AbbieCG

    AbbieCG Private E-2

    I just started having a problem with popups today, so I ran the normal programs I run every week or so: Ad Aware SE personal, Spybot S&D, and Spyware blaster. I don't know much about this stuff but running those programs always seems to keep my computer clean and moving quickly. However, those programs could not remove Smitfraud C.Coreservice either on the initial scans or on reboot scans. I have read throught a few threads about how to remove this problem but to be honest I am completly out of my comfort zone on this one and don't want to ruin my computer. Can you please guide me through this process?

    I know you are going to want a lot of logs but can you please provide me with links to the downloads because I have never heard of a lot of the programs you need logs from.

    :)
     
    AbbieCG, Nov 6, 2007
    #1
  2. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Welcome to MajorGeeks.com, please follow our standard cleaning procedures:

    http://www.majorgeeks.com/images/grenade.gif Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

    • Make sure you check version numbers and get all updates.
    http://www.majorgeeks.com/images/grenade.gif Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

    http://www.majorgeeks.com/images/grenade.gifAfter doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps in the below thread to properly use HijackThis and attach the log:

    http://www.majorgeeks.com/images/grenade.gif Downloading, Installing, and Running HijackThis
    • Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around..
    http://www.majorgeeks.com/images/grenade.gifWhen you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
    • CounterSpy Log - only for Windows XP, 2K, & NT users
    • AVG Antispyware Log - ONLY IF NEEDED you were not able to run CounterSpy. - only for Windows XP, 2K, & NT users
    • Bitdefender Log - from step 6
    • Panda Scan Log - from step 6
    • runkeys.txt - the log from GetRunKey.bat
    • newfiles.txt - the log from ShowNew.bat
    • HijackThis Log
    NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!
     
    bjgarrick, Nov 6, 2007
    #2
  3. AbbieCG

    AbbieCG Private E-2

    I have run all the scans suggested and will attach the logs in this and the following posts. I had to run counterspy in normal mode but other than that I had no problems. The computer is getting a few pop-ups here and there but there is no mention of Smitfraud anymore in any of the scans. Is the system clean or do I have more work to do?
     

    Attached Files:

    AbbieCG, Nov 12, 2007
    #3
  4. AbbieCG

    AbbieCG Private E-2

    Here are the other scans:
     

    Attached Files:

    AbbieCG, Nov 12, 2007
    #4
  5. AbbieCG

    AbbieCG Private E-2

    "Hijack This" log:
     

    Attached Files:

    AbbieCG, Nov 12, 2007
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Run this Disable/Remove Windows Messenger to remove Windows Messenger.

    Uninstall the below old versions of software:
    Java(TM) SE Runtime Environment 6 Update 1
    Sunbelt CounterSpy <-- we are finished with this trial program now
    Viewpoint Media Player <-- should have been uninstalled in step 0 of the READ ME

    Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
    O2 - BHO: (no name) - {01bb9735-07f2-4834-9a6a-b6cb938691be} - C:\WINDOWS\system32\mfcsrvu.dll (file missing)
    O2 - BHO: (no name) - {2E473DE6-59B2-47C0-977B-7B8CF81CC6AA} - C:\Program Files\Windows Media Player\nipywab4444.dll (file missing)
    O2 - BHO: {06cf81e3-8349-1388-de94-d6d9416dcb74} - {47bcd614-9d6d-49ed-8831-94383e18fc60} - C:\WINDOWS\system32\gooqpvyx.dll
    O2 - BHO: (no name) - {7C9530C7-2C73-4368-BF58-0A0B6F830D82} - C:\Program Files\Windows Media Player\nipywab83122.dll (file missing)
    O2 - BHO: 0 - {96CDF9FF-A53E-4249-7D83-FEA7D7063BB4} - C:\Program Files\Messenger\rybiqocow497.dll (file missing)
    O4 - HKLM\..\Run: [Windows iMessenger Messenger] winimsg.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [0c3c97b9] rundll32.exe "C:\WINDOWS\system32\bwysdidv.dll",b
    O4 - HKLM\..\RunServices: [Windows iMessenger Messenger] winimsg.exe
    O4 - HKCU\..\Run: [Windows iMessenger Messenger] winimsg.exe
    O4 - HKCU\..\RunServices: [Windows iMessenger Messenger] winimsg.exe
    O15 - Trusted Zone: *.doginhispen.com
    O15 - Trusted Zone: *.onerateld.com
    O15 - Trusted Zone: *.whataboutadog.com
    O15 - Trusted Zone: *.whataboutarabit.com
    O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
    O20 - Winlogon Notify: efcyyxw - C:\WINDOWS\SYSTEM32\efcyyxw.dll

    After clicking Fix, exit HJT.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it
    double click it and allow it to merge with the registry.
    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt
    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment
    1. Download this file - combofix.exe
    2. Double click combofix.exe & follow the prompts.
    3. When finished, it will produce a log ( c:\combofix.txt ) for you.
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    Now run Ccleaner!

    Now attach the below new logs and tell me how the above steps went.

    1. Avenger
    2. c:\combofix.txt log
    3. GetRunKey
    4. ShowNew
    5. HJT


    Make sure you tell me how things are working now!
     
    chaslang, Nov 12, 2007
    #6
  7. AbbieCG

    AbbieCG Private E-2

    All scans ran smoothly. Here are all five logs. The system seems to be running smoothly except internet access is extreamly slow all of the sudden (takes almost 10 minutes to log into AIM). Downloading the files you had me scan took an extended period of time as well. I'm not sure if it's the isp or the computer.
     

    Attached Files:

    AbbieCG, Nov 12, 2007
    #7
  8. AbbieCG

    AbbieCG Private E-2

    Here are the other two.
    :)
     

    Attached Files:

    AbbieCG, Nov 12, 2007
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {634BBAB7-3F60-4426-944F-A62B9007F67F} - C:\WINDOWS\system32\efcyyxw.dll (file missing)
    O4 - HKLM\..\Run: [SBRegRebootCleaner] C:\Program Files\Sunbelt Software\CounterSpy\SBRC.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O15 - Trusted Zone: *.doginhispen.com
    O15 - Trusted Zone: *.whataboutadog.com

    After clicking Fix, exit HJT.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it
    double click it and allow it to merge with the registry.
    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt
    Now please download DelDomainsand unzip it to your desktop. Do not run it yet.

    Find the files from deldomains.zip on your Desktop and RightClick on the deldomains.inf file and select Install.

    (Now you will need to "Immunize" with Spybot again because deldomains will remove all of the sites Spybot adds.)


    Now run Ccleaner!

    Now attach the below new logs and tell me how the above steps went.

    1. Avenger
    2. GetRunKey
    3. ShowNew
    4. HJT


    Make sure you tell me how things are working now!
     
    Last edited: Nov 14, 2007
    chaslang, Nov 13, 2007
    #9

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds