virus

  • Thread starter Thread starter eustaquio
  • Start date Start date
E

eustaquio

hi people,

I got this problem:"TROJAN-SPY.html.SMITFRAUD.C"

Microsoft Windows anti-spyware didn't notice him.

is there someone that had this problem solved?
 
Microsoft AntiSpyware is not a AntiVirus utility, update the definitions for
your AntiVirus software restart in safe mode and do a full scan with it.

Have you tried an online virus scanner?

Run at least 2 of these:

Panda ActiveScan
http://www.pandasoftware.com/activescan

Bitdefender
http://www.bitdefender.com/scan/Msie/index.php

McAfee FreeScan
http://us.mcafee.com/root/mfs/default.asp

Symantec Security Check
http://security.symantec.com/sscv6/

Pc-Cillin (Trend Micro Housecall)
http://housecall.antivirus.com/housecall/start_pcc.asp

PcPitstop
http://pcpitstop.com/antivirus/default.asp

RAV
http://www.ravantivirus.com/scan/
 
1=Submit a Suspected Spyware Report

2=and detail the cleaning issue you are finding.

Have you tried scanning with Microsoft Antispyware in safe
mode?
Run a full system scan, check the 3 boxe
By doing these steps before trying something new, you make
the product better.

3=Get HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe

Save it to C:\hjt (new folder) then Open it and select
Scan and Save Log. Note where you saved the log then send
it to Ron Kinner as an attachment. He can probably
identify the problem and tell you how to get rid of it for
good.

Put Hijack in the subject so I will know it's not spam.

Ron Kinner
(e-mail address removed)

Good luck

Engel
 
Hi André,

It's really a trojan SPY html.SMITFRAUD.C

have u ever eliminate this kind of pest? using your
suggestion? McAfee e Norton didn't work.
 
Thank u Ron, i'll do this.

-----Original Message-----
1=Submit a Suspected Spyware Report

2=and detail the cleaning issue you are finding.

Have you tried scanning with Microsoft Antispyware in safe
mode?
Run a full system scan, check the 3 boxe
By doing these steps before trying something new, you make
the product better.

3=Get HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe

Save it to C:\hjt (new folder) then Open it and select
Scan and Save Log. Note where you saved the log then send
it to Ron Kinner as an attachment. He can probably
identify the problem and tell you how to get rid of it for
good.

Put Hijack in the subject so I will know it's not spam.

Ron Kinner
(e-mail address removed)

Good luck

Engel


.
Click to expand...
 
This bug is caused by a file called wp.exe that was sent
out in spam that looked like it came from SmithBarney. Run
HijackThis

http://tomcoyote.org/hjt/hjt199//HijackThis.exe

and you will see him down in the O4 entries.

O4 - HKCU\..\Run: [WindowsFY] C:\wp.exe

Terminate the process . You can use HijackThis, Config,
Misc Tools, Open Process Manager, find and highlight the
C:\wp.exe and Kill Process then Back and Scan and then
check his box and Fix Checked. That still leaves a problem
in your registry.

Start, Run, regedit, OK to bring up the regedit program.

find HKey_Current_User->Software ->Microsoft->Windows-
CurrentVersion>policies (Hit the + sign in front of each
Click to expand...
Key as you find them. That will open up the subkeys.)

Under Policies is usually an entry named System. If you
find it highlight it and press the Delete key. Then OK.
Close the program and reboot.

Start, Control Panel, Display (Properties). This should
bring up Display Properties/Background. Change the
wallpaper to something else and Apply. You may also need
to select Web and uncheck the box where it says View My
Active Desktop as a web page. OK

He also creates a file C:\wp.bmp which is what you see on
your desktop. Don't get rid of it until you have done all
of the above.

Ron
 
Back
Top