Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works

Internet Problem / Smitfraud

  • This topic is locked This topic is locked



    New Member

  • Member
  • Pip
  • 5 posts
i recently infected with the "Trojan-Spy.HTML.Smitfraud.c"

i followed the instructions read in similar topics.....

Although, it seems that I removed it, when connected to the company's network, the internet doesn't work for all computers in the network.

Is this caused by "Trojan-Spy.HTML.Smitfraud.c" or is it something else?

Running processes:
C:\Program Files\Borland\InterBase\bin\ibguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Borland\InterBase\bin\ibserver.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\User35\Desktop\HijackThis.exe

O1 - Hosts: d-ru-1f.kaspersky-labs.com
O1 - Hosts: d-ru-1h.kaspersky-labs.com
O1 - Hosts: d-ru-2f.kaspersky-labs.com
O1 - Hosts: d-ru-2h.kaspersky-labs.com
O1 - Hosts: d-eu-2f.kaspersky-labs.com
O1 - Hosts: d-eu-2h.kaspersky-labs.com
O1 - Hosts: d-eu-1f.kaspersky-labs.com
O1 - Hosts: d-eu-1h.kaspersky-labs.com
O1 - Hosts: d-us-1f.kaspersky-labs.com
O1 - Hosts: d-us-1h.kaspersky-labs.com
O1 - Hosts: downloads1.kaspersky.ru
O1 - Hosts: downloads2.kaspersky.ru
O1 - Hosts: downloads3.kaspersky.ru
O1 - Hosts: downloads4.kaspersky.ru
O1 - Hosts: downloads5.kaspersky.ru
O1 - Hosts: www.kaspersky.ru
O1 - Hosts: kaspersky.ru
O1 - Hosts: kaspersky-labs.com
O1 - Hosts: www.kaspersky-labs.com
O1 - Hosts: lloydstsb.co.uk
O1 - Hosts: online.lloydstsb.co.uk
O1 - Hosts: www.lloydstsb.co.uk
O1 - Hosts: www.lloydstsb.com
O1 - Hosts: personal.barclays.co.uk
O1 - Hosts: barclays.co.uk
O1 - Hosts: ibank.barclays.co.uk
O1 - Hosts: www.barclays.co.uk
O1 - Hosts: www.nwolb.com
O1 - Hosts: nwolb.com
O1 - Hosts: hsbc.co.uk
O1 - Hosts: www.hsbc.co.uk
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll
O2 - BHO: (no name) - {A0269420-A638-4509-889C-8FC3CC85DA7E} - C:\WINDOWS\drexinit.dll
O2 - BHO: (no name) - {B652F810-88E1-4602-9587-5DA69AFC379F} - C:\WINDOWS\System32\fclf.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file)
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [Spools Service Controller] C:\WINDOWS\System32\spools.exe
O4 - HKLM\..\Run: [Disk Keeper] C:\WINDOWS\System32\Services\{DAF2E5D1-011F-46BB-936D-9B8A388126C2}\SECURITY.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {BD67D2D0-2DD1-422B-91AE-A449445EF9F0} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {BD67D2D0-2DD1-422B-91AE-A449445EF9F0} - (no file) (HKCU)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9D465AB-C5D0-4692-8429-F40F7A56F543}: NameServer =,
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: drct16 - C:\WINDOWS\SYSTEM32\drct16.dll
O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - C:\Program Files\Borland\InterBase\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - C:\Program Files\Borland\InterBase\bin\ibserver.exe
O23 - Service: Sybase BCKServer _ BDSERVER_BS (SYBBCK_BDSERVER_BS) - Unknown owner - c:\sybase\ASE-12_5\bin\bcksrvr.exe
O23 - Service: Sybase BCKServer _ MACH36_BS (SYBBCK_MACH36_BS) - Unknown owner - c:\sybase\ASE-12_5\bin\bcksrvr.exe
O23 - Service: Sybase MONServer _ BDSERVER_MS (SYBMON_BDSERVER_MS) - Unknown owner - c:\sybase\ASE-12_5\bin\monsrvr.exe
O23 - Service: Sybase MONServer _ MACH36_MS (SYBMON_MACH36_MS) - Unknown owner - c:\sybase\ASE-12_5\bin\monsrvr.exe
O23 - Service: Sybase SQLServer _ BDSERVER (SYBSQL_BDSERVER) - Unknown owner - c:\sybase\ASE-12_5\bin\sqlsrvr.exe
O23 - Service: Sybase SQLServer _ MACH36 (SYBSQL_MACH36) - Unknown owner - c:\sybase\ASE-12_5\bin\sqlsrvr.exe
O23 - Service: Sybase XPServer _ BDSERVER_XP (SYBXPS_BDSERVER_XP) - Unknown owner - c:\sybase\ASE-12_5\bin\xpserver.exe
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing)
  • 0





  • Expert
  • 14,671 posts
  • MVP
Closed duplicate of http://www.geekstogo...val-t42206.html
  • 0

Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP