Re: Urgent problem - Smitfraud.c Trojan

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 04/28/05 

Date: Thu, 28 Apr 2005 08:34:51 -0400

From: "vinu thomas" <vinuthomas@discussions.microsoft.com>

| Hi, any help would be greatly appreciated, i am in trouble with this.
|
| I have the Smitfraud trojan apparently. My Desktop wallpaper is displaying
| blue screen with the following message:
|
| Security warning A fatal error in IE has occured at 0028:C0011E36 in VXD
| VMM(01) + 00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c.
|
| Not only that but my desktop keeps generating desktop icons linking to
| explicit material, and keeps trying to send me to various explicit web sites.
| I immediately disconnected myself from the office network for fear of
| spreading around the office. I have tried everything. Everytime i delete
| these icons they reappear after a few mins or when i restart. I am on Windows
| XP by the way. Non of the anti virus software has worked like sophos or the
| anti spyware software. I am in dire straits and any assistance would be
| greatly appreciated.
|
| There is also a red icon being displayed on my systray which has the same
| icon for a critical error which we have not seen before and we are suspicious
| of. And when i click on that icon it opens a window taking me to a website.
|
| Any help would be greatly appreciated
|
| thanks

Dump the contents of the IE Temporary Internet Folder cache (TIF)
Start --> Settings --> Control Panel --> Internet Options --> Delete Files

Dump the contents of the Mozilla FireFox Cache
Tools --> Options --> Privacy --> Cache --> Clear

1) Download TrendMicro Sysclean by one of the following 2 methods

Trend Sysclean Method 1
---------------------------------------
Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend signature files.
http://www.trendmicro.com/download/pattern.asp

Create a directory.
On drive "C:\"
(e.g., "c:\sysclean")

Download SYSCLEAN.COM and place it in that directory.
Download the signature files (pattern files) by obtaining the ZIP file.
For example; lpt604.zip

Extract the contents of the ZIP file and place the contents in the same directory as
SYSCLEAN.COM.

Trend Sysclean Method 2
---------------------------------------
Download the utility SYSCLEAN_FE at the following URL --
http://www.ik-cs.com/got-a-virus.htm
SYSCLEAN_FE automates the download and execution process of the Trend Sysclean Package.
Direct URL --
http://www.ik-cs.com/programs/virtools/Sysclean_FE.exe

2) Download and install Ad-aware SE (free personal version v1.05)
         http://www.lavasoftusa.com/
3) Update Adaware with the latest definitions then exit the software.
4) Disable System Restore
        http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
5) Reboot your PC into Safe Mode and shutdown as many applications as possible
6) Using the Trend Sysclean and Ad-aware SE utilities, perform a Full Scan of your
        platform and clean/delete any infectors found
7) Restart your PC and perform a "final" Full Scan of your platform using both Trend
        Sysclean and Ad-aware SE
8) Re-enable System Restore and re-apply any System Restore preferences,
        (e.g. HD space to use suggested 400 ~ 600MB),
9) Reboot your PC.
10) Create a new Restore point

* * Please report back your results * * 

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm