[Advertisements]

Hi Andy,

Thanks so much for you help!
I thought it looked good.

I have a couple of odds-and-ends, but maybe it's better suited as a Malware removal topic, I'll let you tell me........

- I still have the blue screen with the "Security Warning", reference to the stupid "Trojan-Spy.HTML.Smitfraud.c", and I'm locked out of being able to change the background.

- When I access the internet, I get two seperate messages from Norton Antivirus saying it automatically fixed something, everything should be normal. I didn't do a good job writing down the info, so I'll try and get it to happen again and I will record exactly what it says. It seems to happen after everytime reboot my computer. (maybe something lingering).

Let me know what you think.

Thanks,
Erik

[Batt-Man]

Hi Andy,

Thanks so much for you help!
I thought it looked good.

I have a couple of odds-and-ends, but maybe it's better suited as a Malware removal topic, I'll let you tell me........

- I still have the blue screen with the "Security Warning", reference to the stupid "Trojan-Spy.HTML.Smitfraud.c", and I'm locked out of being able to change the background.

- When I access the internet, I get two seperate messages from Norton Antivirus saying it automatically fixed something, everything should be normal. I didn't do a good job writing down the info, so I'll try and get it to happen again and I will record exactly what it says. It seems to happen after everytime reboot my computer. (maybe something lingering).

Let me know what you think.

Thanks,
Erik

[Batt-Man]

Hi Andy,

That is exactly the message pasted on the blue background.... Any ideas?

I will try and use some of the online scan sites you've listed and let you know how it goes.........

[Batt-Man]

I'm on another computer right now. The infected computer is running the online scan from F-secure right now.....

I wanted to use the recommended TrendMicro, but when I click on the link with the infected computer, it opens a new window and starts to download the TrendMicro homepage and then I get a message like...

"Internet Explorer has encountered a problem and needs to shut down"

There are no details available or no "error in xxxx.dll" message, just an option to restart Explorer.

I didn't have any problems with F-secure homepage. Kind of odd.

[Batt-Man]

Here are the results of the online virus scan using F-secure.
It looks like some of these are tied up with Norton AV? During the scan I received several messages from Norton (one for each of the entries you see) saying:

"Repair Successful
It is now safe to use your computer
Norton Anti-Virus has successfully removed the problem
C:\windows\TEMP\AVP5032.TMP"

For each message the "AVP" would be followed by some 4-char string like 13B3 or 5207, etc.

Here are the results of the F-secure online scan:

Scanned files: 26249 Warning: 22 file(s) still infected!

c:\RECYCLED\Q330995.exe Trojan-Downloader.Win32.Small.amb

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP0.DLL Trojan.Win32.StartPage.ix

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP0.exe Trojan-Downloader.Win32.Small.vq

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP1.exe Trojan-Downloader.Win32.Small.vq

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP2.exe Trojan-Downloader.Win32.Small.vq

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP0.bin Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP1.dll Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP1.bin Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP2.dll Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP2.bin Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP3.bin Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP3.dll Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP4.bin Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP4.dll Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP5.bin Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP5.dll Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP6.bin Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\Incoming\AP6.dll Trojan.Win32.StartPage.vr

c:\Program Files\Norton AntiVirus\Quarantine\4C685668.exe Trojan-Downloader.Win32.Small.vq

c:\Program Files\Norton AntiVirus\Quarantine\3ED153BC Trojan-Downloader.Win32.Domcom.b

c:\Program Files\Norton AntiVirus\Quarantine\40A447BA Trojan.Java.ClassLoader.i

c:\Program Files\Norton AntiVirus\Quarantine\4FA33795 Trojan.Java.ClassLoader.k

[Batt-Man]

Woo Hoo! Success!

Andy_veal is the man!


As a side note to anyone who is using any of the info. here to help with their problem.....

In the instructions provided by Symantec to edit the registers to remove the Joke.Smitfaudoid (some joke, it's taken me a week to get rid of it! :mad: )

The 1'st subkey they have you navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

did not contain the value "WindowsFY" = "[program name]"
it was located under:

My Computer\HKEY_USERS\Default\Software\Microsoft\Windows\Current Version\Run

Maybe it's this way just in my computer or it has something to do with Win98, I'm not sure. I used the find option in the Registry Editor to look for "WindowsFY"

Thanks Geeks To Go!

[Batt-Man]

Another question.....

Now that I've gone through all of this and installed all of these adware and spyware scanners, etc. my start-up configuration is loaded with stuff, half of which, I don't know anything about.

I believe it's eating up my system resources though. When I try to open an MS Word document from a file location, my computer locks up. If I already have MS Word open and then open the document it works o.k.

What's the best way to:
1) Figure out what all the stuff is.
2) Figure out if I need it.
3) Clean the things I don't need out permenantly, instead of just switching them off (I still see referance to the stupid Security iGuard, that magically appeared on my computer along with Trojan-Spy.HTML.Smitfraud.c)

Thanks again!
-Erik