[nicotsu]

I went to watch a video and it asked me to download something to be able to watch it and bam, I have a pop up a minute on my desktop telling me I have trojan viruses and I need to download all these different antivirus crap. I see this happens to alot of people . I scanned with avg and it seems to have removed most of what was causing the major problems, so I decided to download smitfraud fix and make sure everything is ok. The infection seems to have rooted itself in internet explorer for some reason, as when I open that a popup saying I have a virus happens and it has some kind of fake security toolbar I didn't download. I downloaded the thing from firefox though.

When I spybot search and destroy scanned it, It came up with things called smitfraud and that zlob but it wouldn't fix them saying I am not an admin, which I am. It keeps saying that it cannot create this certain file type. This is the error message:

"Unexpected error in fixing problems
(cannot create file "C:\\Windows\wininit.ini". Access is denied"

This has been happening since I sent my computer in for repairs several months ago, as the user name in task manager is "tester" instead of Nicole. I think that has something to do with it. So spybot is finding the problems but can't fix them. But if this other

So I thought I would post the rapport and someone could tell me what is important on it and what I do with it. I read the instruction topic in the guides and tutorial forum, but it wasn't enough info. Thank you


Nicole

SmitFraudFix v2.320

Scan done at 16:21:24.64, 15/05/2008
Run from C:\Users\tester\Desktop\SmitfraudFix
OS: Microsoft Windows [Version 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\cmd.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Aware2007.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

hosts file corrupted !

127.0.0.1 www.legal-at-spybot.info
127.0.0.1 legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\tester


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\tester\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\tester\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\NetProject\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000000


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller
DNS Server Search Order: 64.59.184.13
DNS Server Search Order: 64.59.184.15

HKLM\SYSTEM\CCS\Services\Tcpip\..\{7E8C8712-FF72-4C9F-A14C-1F01978B6B66}: DhcpNameServer=64.59.184.13 64.59.184.15
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7E8C8712-FF72-4C9F-A14C-1F01978B6B66}: DhcpNameServer=64.59.184.13 64.59.184.15
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7E8C8712-FF72-4C9F-A14C-1F01978B6B66}: DhcpNameServer=64.59.184.13 64.59.184.15
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=64.59.184.13 64.59.184.15
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=64.59.184.13 64.59.184.15
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=64.59.184.13 64.59.184.15


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

[Advertisements]

Well I found out that with vista there is a nice program called system restore which allows you to send your computer back in time to a place where it was not yet infected by a virus. It basically resets your registry to a save point you choose which is created each day or after an update. My virus problems were gone! I so heart vista for that feature now!!! It was soo easy. I still haven't figured out why spybot S&D wouldn't remove the stuff before though

[nicotsu]

Well I found out that with vista there is a nice program called system restore which allows you to send your computer back in time to a place where it was not yet infected by a virus. It basically resets your registry to a save point you choose which is created each day or after an update. My virus problems were gone! I so heart vista for that feature now!!! It was soo easy. I still haven't figured out why spybot S&D wouldn't remove the stuff before though