Trying to remove Smitfraud-C.gp

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by whn, Sep 23, 2009.

  1. whn

    whn Private E-2

    I am following your procedures for removal in the "Removing Zlog ada SmitFraud, SpySheriff, Insfections" thread. I have attached the SmitFraudFix log.
     

    Attached Files:

    whn, Sep 23, 2009
    #1
  2. whn

    whn Private E-2

    I followed all of the procedures and the fix selection #2 ran but it didn't seem to finish the job. It never asked if I wanted to clean the registry. The screen just went totally black and I had to restart the computer. I have attached the new log.
     

    Attached Files:

    whn, Sep 23, 2009
    #2
  3. whn

    whn Private E-2

    Hello,
    I found your READ & RUN ME FIRST post and followed all of the procedures. All worked fine accept RootRepeal had some errors which I also attached.

    You wanted me to describe my problem - Earlier this week we started getting IE starting automatically and really bad web pages showing up. I downloaded Spybot and ran it and it found something with the title SmitFraud but it didn't stop the problem. So I did a seach and found your forum with the SmitfraudFix and ran that but it didn't help at all. Then, as stated above, I found your malware removal tool.

    At this point the popup windows have not happened again but I am not an expert at this and would like you to look at the logs and let me know if I need to do anything else.

    Thank you very much for the help!
    (note - I included an error log for RR as well as the ones you wanted)
     

    Attached Files:

    whn, Sep 24, 2009
    #3
  4. whn

    whn Private E-2

    more logs
     

    Attached Files:

    whn, Sep 24, 2009
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It looks like the scans took care of most of it, however, RootRepeal is flagging a possible MBR infection.
    Let's do this:

    GMER's MBR.exe

    • Double click on the MBR.exe file to run it.
    • A log will be produced & saved to the desktop, called MBR.log.
    • Attach this log to your next message.


    Now delete the current mbr.log file and then run the below instructions.
    Click Start > Run and copy & paste the following text in the code box into the Run box and then click OK. You must copy and paste or type in this exactly. The quotes must be exactly as shown and there is a space before the -f
    Code:
    
     "%userprofile%\desktop\mbr.exe" -f
    Now double click on the mbr.exe file and attach the new mbr.log
     
    TimW, Sep 29, 2009
    #5
  6. whn

    whn Private E-2

    here is the first mbr log.
     

    Attached Files:

    • mbr.log
      File size:
      195 bytes
      Views:
      3
    whn, Sep 29, 2009
    #6
  7. whn

    whn Private E-2

    here is the second mbr log. Thanks so much for the help!
     
    whn, Sep 29, 2009
    #7
  8. whn

    whn Private E-2

    I am having trouble uploadingt the second log. I tried to rename it and it still didn't allow me to upload.

    here is the log results pasted:

    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

    device: opened successfully
    user: MBR read successfully
    kernel: MBR read successfully
    user & kernel MBR OK
     
    whn, Sep 29, 2009
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It appears as though RootRepeal was wrong. Tell me what issues you are still having.
     
    TimW, Oct 4, 2009
    #9
  10. whn

    whn Private E-2

    That is good news. I guess that means I am all clean. I don't seem to have anymore problems although I haven't really used the machine at all so as not to allow further infection. Thank you so much for your help!

    How do I verify that my flash drives are not infected as well. I used one of them on my work laptop and it infected it almost immediately upon insertion. If it infects a machine that fast how do I test/clean one without spreading the virus? I tossed the infected one away because it was only 700 meg and very old but my others are large and new and I don't want to throw those away. Any help would be great. Thanks again!
     
    whn, Oct 4, 2009
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I would first install this:
    AutoEater.

    Then make sure you security programs are updated. Then you need to scan with your thumb drive installed with your AV program and AS programs.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real-time protection. They are useful as backup scanners.They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore ato create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     
    TimW, Oct 9, 2009
    #11
  12. whn

    whn Private E-2

    Thank you so much Tim.

    I followed all of the procedures and installed Autorun Eater and ended up deciding on SuperAntiSpyware. I also am using Norton Systemworks for Antivirus and Zone Alarm for a firewall both of which I already had. I am thinking of using Comodo instead but have not done this yet because I may still have an issue.

    I have noticed that every now and then the window I am working on goes gray and then I hear a bing sound and then the window returns to normal. Also, the harddrive is always flashing as if something is constantly running and accessing or trying to access my harddrive. What could be causing this? I am not sure if I still have a bug trying to do something or is it one of the scanners still working in the background.

    Also, I no longer have autoplay for the cdrom working. How can I get this working again?

    Thanks for the help!
     
    whn, Oct 13, 2009
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. You other concerns should be addressed in the software forum. Safe surfing. :)
     
    TimW, Oct 18, 2009
    #13

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds