PDA

View Full Version : Help!!! Infected with Smithfraud-C.CoreService!!! Tryed all I know... Please help???



INEEDHELPWITHTHIS
2008-03-28, 10:21
I've run across some nasty things, but this tops it... This Trojan wont stop. Ive tried spybot, I've tried it on restart too. Ive tried the SmithfraudFix.exe program also. In both normal and safe mode, and followed the instructions given for that. I've tried deleting manually. I've even tried system restore. Nothing works.

This Trojan is trying to change my passwords, uploading spyware and adware, even keylogers. Not to mention the pop ups from hell. If some one can help me with this I'd for ever be in your debt. This is my g/f computer and i managed to get this bull**** on it... So you can imagine how I'm getting it write now....:sad: Not good at all. If you can help me, please post!

I will add the SmithfraudFix report in a little bit but I'm on a different computer, so I can keep that one off line...


This is what Spybot tells me...

Spybot says:

This Trojan horse gets installed as a driver and constantly runs in background and connects to malicious servers without any user consent. removal may require to manually close the file handles of the core.cahce.dsk and core.sys residing in the folder \windows\system32\drivers\. To receive help on this please contact Team Spybot via forums or email.

__RiP_ChAiN_
2008-03-30, 03:40
Hello INEEDHELPWITHTHIS,

Click here (http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe) to download HJTInstall.exe
Save HJTInstall.exe to your desktop.
Doubleclick on the HJTInstall.exe icon on your desktop.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

__RiP_ChAiN_
2008-04-05, 02:53
Due to inactivity, this thread will now be closed.

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me a private message (pm). A valid, working link to the closed topic is required.