Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Smitfraud c and PSguard [RESOLVED]


  • This topic is locked This topic is locked

#16
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
I knew that looked familiar. You have Kazaa installed? Is this the paid version or not? If not, we must remove it. It looks like it's not the paid version according to what I see being installed here.

I'll hold off on the fixing for that Panda log until I get a reply to this. Kazaa is notorious (the free download) for installing Gator and a bunch of other junk in your machine. So if it is the free one, please tell us so we can help you remove it. It's spyware and definitely bad.
  • 0

Advertisements


#17
Sick_of_smitty

Sick_of_smitty

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
It is the freeware. However, I know it was not the source of Smitfraud since I haven't used it since my last clean spybot scan several weeks ago. I would like to keep Kazaa in place since I have some components in place that would be very difficult to setup again. I definitely won't run it until we are through with the fixes you have identified. Thanks.
  • 0

#18
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
I'm not sure how I should proceed with this fix then. Kazaa is one of the most nortorious of all spyware out there. It's bundled with so much junk and trust me, a handful of what I'm asking you to remove there are not smitfraud related. I'm sure they originated from Kazaa. As with all other spyware infected programs, removing their so-called sponsor programs might make the program malfunction. You have already removed some of it there, so I'm not sure if it did hinder Kazaa.

OK, I will see how we should approach this....

Fix the below:

Delete these if found:

C:\DOCUMENTS AND SETTINGS\HEATHER\APPLICATION DATA\tvmknwrd.dll
C:\WINDOWS\SYSTEM32\INNERVBINSTALL.LOG
C:\WINDOWS\alchem.ini
C:\WINDOWS\GatorPatch.log
C:\DOCUMENTS AND SETTINGS\HEATHER\APPLICATION DATA\Lycos


Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/CleanUp.exe ) and install it. Run CleanUp! and click on the Options button. Uncheck 'Scan local drives for temporary files'. Also uncheck those two Newsgroup entries if you don't want to delete them. Click OK and then click on the CleanUp! button. Let it run. After it's done, choose Yes to logoff.

You should be better after doing that. But again with Kazaa, I'm not sure if it reinstalls anything back, but I doubt it. If it doesn't work, I could see you reinstalling it right now :tazz: You will get reinfected again once you do that. That's why I highly suggest that you remove this P2P program at all costs.

It's your call....

To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If not, you should be set to go.
  • 0

#19
Sick_of_smitty

Sick_of_smitty

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
First, thanks for proceeding with the assistance. I know there is nothing more frustrating than a student that won't listen. I truly appreciate all your time and efforts.

Spybot still shows it. However, I seemed to remember some mentions of false positives as I was surfing forums before I hooked up with you. While Spybot was running just now I searched on Spybot, Smitfraud, "false positive" and came up with several references discussing why spybot in particular would find a false positive after the files were cleaned. I don't have any more symptoms and I feel I have already taken up too much of your time. Unless you feel there is reason to go on, I am comfortable closing this as "close enough" and hopefully in a future update of one of the scan programs, they will be able to take care of the rest.

Thanks again for all your assistance. :tazz:
  • 0

#20
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP