Results 1 to 5 of 5

Thread: Another Smitfruad post...

  1. #1
    Junior Member
    Join Date
    May 2007
    Posts
    1

    Default Another Smitfruad post...

    Well i've looked at most smitfruad post and tried to fix it myself but the smitfruad removal isnt seeming to work it just keeps coming back


    Logfile of Trend Micro HijackThis v2.0.0 (BETA)
    Scan saved at 12:16:09 AM, on 5/26/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Opera\Opera.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Andrew Flores\Desktop\HiJackThis_v2\HiJackThis_v2.exe

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: (no name) - {4B646AFB-9341-4330-8FD1-C32485AEE619} - C:\WINDOWS\system32\hkmiycjy.dll
    O2 - BHO: (no name) - {4C9FFF01-2A69-457B-BE7A-B81E1FA5557b} - C:\WINDOWS\system32\ffvakade.dll
    O2 - BHO: (no name) - {A416D604-EAA3-4618-958C-2ECA22414616} - C:\WINDOWS\system32\mljjkjg.dll
    O2 - BHO: (no name) - {C41DADB3-5552-47B4-ACB8-144CA90DBCF7} - C:\WINDOWS\system32\jkhhf.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\xlnsxbyk.dll",realset
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O20 - Winlogon Notify: jkhhf - C:\WINDOWS\system32\jkhhf.dll
    O20 - Winlogon Notify: mljjkjg - C:\WINDOWS\SYSTEM32\mljjkjg.dll
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe (file missing)
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE

    --
    End of file - 3124 bytes

  2. #2
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi sixav

    Please download VundoFix.exe to your desktop.
    • Double-click VundoFix.exe to run it.
    • Click the Scan for Vundo button.
    • Once it's done scanning, click the Remove Vundo button.
    • You will receive a prompt asking if you want to remove the files, click YES
    • Once you click yes, your desktop will go blank as it starts removing Vundo.
    • When completed, it will prompt that it will reboot your computer, click OK.
    • Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.

    Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  3. #3
    Security Expert TonyKlein's Avatar
    Join Date
    Oct 2005
    Location
    The Netherlands
    Posts
    138

    Default

    Also, and my apologies for gatecrashing this thread, there's a Vundo related file we'd like to have a closer look at:

    C:\WINDOWS\system32\hkmiycjy.dll

    We'd like to receive a sample for analysis!

    Could I ask you to please go to this forum

    There's no need to register. Just start a new topic, titled "File for TonyKlein".

    In the topic, simply refer to this forum thread, and use the Attachment box to upload the file.

    In fact there's not even a need to actually browse to the file: just copy the full path to the file, in this case:

    C:\WINDOWS\system32\hkmiycjy.dll

    ... and paste it in in the attachment box, then press the 'Post' button. The file will be found and uploaded.

    NOTE: You will not see the files that have been uploaded (including the ones you upload yourself) as they only show to the authorised users who can download them


    After that I'll be happy to leave you in Shaba's most capable hands!

    Thanks!

  4. #4
    Security Expert TonyKlein's Avatar
    Join Date
    Oct 2005
    Location
    The Netherlands
    Posts
    138

    Default

    OK, no more need to upload the file, as I've just obtained a copy from another source:

    AntiVir 7.4.0.27 05.25.2007 TR/Vundo.Gen
    BitDefender 7.2 05.27.2007 Trojan.Virtumod.ALZ
    Kaspersky 4.0.2.24 05.27.2007 not-a-virus:AdWare.Win32.Virtumonde.kb
    Webwasher-Gateway 6.0.1 05.27.2007 Trojan.Vundo.Gen

    http://www.sophos.com/security/analy...lazyjohna.html

    Thanks!

  5. #5
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Due to the lack of feedback this Topic is closed.

    If you need this topic reopened, please request this by sending the moderating team
    a PM with the address of the thread. This applies only to the original topic starter.

    Everyone else please begin a New Topic.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •