smitfraud-c.generic keeps coming back

**Looking4Info** · 2012-12-22, 17:47

I don't think it worked. Still receiving the same output for attrib /s hosts*

**Blade81** · 2012-12-22, 17:53

Hi,

Following set of instructions contains some steps to be done in recovery environment. I recommend to print it since you won't be able to access internet in RE.

1. Reboot system and press F8 to reach advanced boot options.
2. Select "Repair Your Computer" -option. Follow the wizard to end up into System recovery options window.
3. Select Command Prompt -option. Command prompt window should open up.
4. Type the following commands (press enter after each one and let me know if any gives back any error message):

Code:

cd /d c:\windows\system32\drivers\etc
attrib -r -s -h hosts
del /q hosts

When done, close command prompt window and click restart in system recovery options window. After system has restarted back to normal mode see if attrib /s hosts* still lists C:\Windows\System32\drivers\etc\hosts entry.

**Looking4Info** · 2012-12-22, 18:04

Still listed.

**Blade81** · 2012-12-22, 18:10

You were able to run those three commands, including the del one, in recovery environment without any issues and error messages?

**Looking4Info** · 2012-12-22, 18:14

Yes, no error messages, but no confirmation messages either. It just continued to display the same "c:\windows\system32\drivers\etc" line.

**Blade81** · 2012-12-22, 18:20

Hi,

Please reboot back into recovery environment and run the following commands using Command Prompt option:

Code:

cd /d c:\windows\system32\drivers\etc
attrib -r -s -h hosts*
del /y hosts
del /y hosts*.backup

and then type this command (still in recovery environment):

Code:

attrib /s hosts*

Let me know what entries it lists.

**Looking4Info** · 2012-12-22, 19:07

The commands returned 'invalid switch "y"'

I tried the command leaving out the /y

the command del hosts*.backup returned a message that hosts*.backup does not exist

attrib /s hosts* returns file not found hosts*

**Blade81** · 2012-12-22, 19:37

Sorry, my mistake. The switch should had been /q. Please try these commands:

Code:

cd /d c:\windows\system32\drivers\etc
attrib -r -s -h hosts*
del /q hosts
attrib /s

See what items does the last command list.

**Looking4Info** · 2012-12-22, 22:01

x:\windows\system32\drivers\etc\
services
lmhosts.sam
networks
protocol

**Blade81** · 2012-12-23, 18:56

Hi,

Please run these commands in normal mode and let me know output of the second one:

Code:

cd /d c:\windows\system32\drivers\etc
attrib /s

Thread: smitfraud-c.generic keeps coming back

Thread Tools

Display

Posting Permissions