Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

fresh infection: Trojan-Spy.HTML.Smitfraud.c[RESOLVED]


  • This topic is locked This topic is locked

#31
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
OK, I asked others for help (so thanks miekiemoes and bananafanafo :tazz:) and they figured out the problem.

Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now. Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"XMLlibADutid"=-
"XMLlibBnxt"=-
"XMLlibID"=-
"XMLlibiftid"=-
"XMLlibistid"=-
"XMLlibittid"=-


Save the file as "FixExplorer.reg". Make sure to save it with the quotes. Double click on it and choose Yes to merge it. You may delete the file afterwards.

Restart and set your own background (we resetted to a blue background, so if you want to change it - right click on desktop and go to Properties->Desktop tab).

Any problems now?
  • 0

Advertisements


#32
tilby

tilby

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
that was amazing. i got everything back; icons, start menu, and the right click on my desktop. the only thing that's off now, is the background. i can access desktop properties, but when i select a different background, it doesn't change. that's the only thing. i did an avg scan, and found that i had two Java/ByteVerify infections. they were automatically healed, but that was it (compared to the 550 infections when all this started).

Edited by tilby, 18 May 2005 - 03:46 PM.

  • 0

#33
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Run the smitfraud.reg file again and then restart. Try changing it now.

Click on Start->Settings->Control Panel->Java Plug-in and click on the Cache tab. Then click on the Clear button and hit OK.

Any problems now? If not:

Your log is clean.

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. Restart your computer and uncheck the same box to enable System Restore.

Make sure to get the latest updates for Windows and Internet Explorer at http://v5.windowsupd...t.aspx?ln=en-us.

To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If not, you should be set to go.
  • 0

#34
tilby

tilby

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
ok, i figured i should try the smitfraud.reg file again, so i did, and got your e-mail right afterwards. i then followed your java plug-in instructions, restarted, tried it out, and while properties will come up, i can go as far as picking the picture i want on my background, but it won't change. for some reason, i can only pic the pictures that are already given by windows, and i can pic pictures off the web too... i just can't pic pictures of my own. of coarse there has to be one tiny little reason why this isn't all over yet. it's just my luck to be a bother... lol.
  • 0

#35
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
LOL.

Did you have a plain blue background after you ran that smitfraud.reg file? So you can't browse for the pic you want and use it as your wallpaper? Is there a browse button?
  • 0

#36
tilby

tilby

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
when i ran the smitfraud.reg file, i did have the blue background when i restarted. there is a browse button, but i can only get as far as selecting which pic i want as my background; it just doesn't change when i select it. for some reason, i can't choose one of my own pictures.
  • 0

#37
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
You might have done this already, but I must ask just in case you missed it. Did you also hit Apply or OK when you selected that pic?

If it's still not working, try running smitfraud.reg again and then immediately go back and try to change that wallpaper.
  • 0

#38
tilby

tilby

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
when i select my picture to place as my background, the 'apply' button doesn't even become available to click. it stays grayed out. so i did the smitfraud.reg file again, and tried changing the background immediately afterwards, and it still did nothing. the 'apply' key doesn't become available to click.
  • 0

#39
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
OK, try using this file:

Download the following file and unzip it to your desktop. Then doubleclick it and grant permission to merge the registry entries.

restoretool
  • 0

#40
tilby

tilby

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
yes!
it worked!!
it's like magic! you're a superhero, and there's no real way to thank you.

thank you.
  • 0

Advertisements


#41
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP