124 replies to this topic

[admin]

Trojan.w32.looksky is another name for the Smitfraud/zlob trojan. SmitFraudFix removes trojan.w32.looksky, but you should also check your system for other malware, and use ATF cleaner to clean your temp files when finished.

Instructions to remove Trojan.w32.looksky using SmitFraudFix (by S!Ri)

SmitFraudFix only works with Windows XP or 2000

Download SmitfraudFix:

Use this URL to download the latest version (the file contains both English and French versions):
http://siri.geekstog...mitfraudFix.exe

Use:

• Search:
  
  • Double-click SmitfraudFix.exe
  • Select 1 and hit Enter to create a report of the infected files. The report can be found at the root of the system drive, usually at C:\rapport.txt
  
  
  
• Clean:
  
  • Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually)
  • Double-click SmitfraudFix.exe
  • Select 2 and hit Enter to delete infect files.
  • You will be prompted: Do you want to clean the registry ? answer Y (yes) and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection.
  • The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? answer Y (yes) and hit Enter to restore a clean file.
  • A reboot may be needed to finish the cleaning process. The report can be found at the root of the system drive, usually at C:\rapport.txt
  
  
  
• Optional:
  
  • To restore Trusted and Restricted site zone, select 3 and hit Enter.
  • You will be prompted: Restore Trusted Zone ? answer Y (yes) and hit Enter to delete trusted zone.

Note:
process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool". It is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlog...processutil.htm

Has SmitFraudFix helped you? A tool like this takes a lot of time to keep updated. Please consider a donation to S!Ri so he can continue his hard work.

Are you still having problems with trojan.w32.looksky, or other malware on your system? Please start a new topic in our Malware Removal Forum, after following these instructions.

Other references:
trojan.w32.looksky activity @ Symantec | SmitFraudFix

[arson982]

I down load software Smitfraudfix. Can I install this prgram from the save mode

[don77]

Right click on the link
http://siri.geekstog...mitfraudFix.exe

choose "save target as " save it to your desktop then proceed with the above instructions

[arson982]

Thank you for your help it fix the problem. I have a question for you. I have have a a dell computer and I do not have the restore Cd how can I make a restore CD?

[roosterCOF]

well i want to thank you guys for the info,it was pure luck that i stumbled upon your site,it was very helpfull. thanks again,God Bless and be Safe!

[don77]

Hello and welcome roosterCOF
Thanks for taking the time to let us know everything worked out for you

[Fourthings]

Well, all seems well. Thank you guys SO much for providing me with much needed help!!!

[don77]

Your very welcome Fourthings
Thanks for taking the time to lets us know

[sirles]

Hi can you please help?

My friend as Windows xp and seems to have this Malware, Spybot recognises it as Smitfraud, and the pop ups mention Looksky, and he has a bright red wallpaper now, with an evil looking logo that looks a bit like the Quake symbol!

Is this the Looksky trojan?

Sorry to be vauge as I have only had a quick look while I was round there going to set about it tomorrow after work

Any help gratefully received!

[MoNsTeReNeRgY22]

Hello and welcome to G2G!

Please have him post a HiJackThis log at the following link and an expert will help him with his problem.

http://www.geekstogo...o-Here-f37.html

[sirles]

Many thanks Mons will do tomorrow when I go round.

[webnetincome]

That's it???? I used the SmitFraudFix for XP, all seems to be working now. If that is all, then all I can say is "THANK YOU VERY MUCH!"
Probably not the place for it , but while I am here, just wondering, do the free programs (anti-virus, firewalls, etc.i signatures of some of you experts) work as well as say something like Norton Internet Security? My trial period is over, it either pay up or do something else.-LOL
Sorry if second part of post in wrong place (if no answer to this --I will post in another part of forum.) It was quick in and a quick fix---I think.--LOL Seems tooooooooo easy.--lol

Thanks,
Glenn

[don77]

but while I am here, just wondering, do the free programs (anti-virus, firewalls, etc.i signatures of some of you experts) work as well as say something like Norton Internet Security? My trial period is over, it either pay up or do something else.-LOL

Yes the free programs suggested work as well they vary in opinion whats best but they are work nicely, There are many topics about it one can be found here
http://www.geekstogo...ftware-t38.html
that needs updating

Glad to hear everything worked out with getting rid of w32.looksky

[aralius]

thankyou. it was extremely easy, and it seems to have worked. don't know if i have other crap in my system, but it got rid of the trojan. thankyou so much. i'm probably not suposed to put this here, but what can i do to keep this from hapenning again?

[don77]

Hello and welcome aralius

Read Here pay close attention to 6. How did I get infected?

Thanks for letting us know it worked out for you

If your concerned that you still have issues have a read Here

Good luck