This is a cure if anyone is attacked by MS antispyware 2009
Discussion
Hi all,
My laptop was attacked by MS Antispyware 2009 and after taking advice from thos forum, I fond a cure and so thought to post here in case anyone else gets hit with it:
Do the following:
To restart the computer in Safe Mode, please do the following:
1. Click on Start >> Turn Off Computer >> Restart.
2. Keep pressing the F8 key while the system is restarting.
3. You will get a list of starting options.
4. Select "Safe Mode with Networking" by using the up and down arrow keys.
5. Press Enter key to start the system in Safe Mode.
6. Please Follow the steps and Link to run the program and clean the infections:
7. http://siri.urz.free.fr/Fix/SmitfraudFix.exe
1. Click on the link given above,
2. Hit on "RUN" / "OPEN" /"SAVE" the file.
3. Press any key from the keyboard, then Type "2" and press "Enter" on the keyboard
4. It will analyze and delete/KILL the infections.
5. Press "Y" and "Enter" to clean the registry .
6. You can see a "RAPPORT" Notepad LOG File.
7. Close the log file window and the smitfraud Blue colour window.
8. Restart the computer.
This worked for me when my laptop was infected by the above.
Hope this helps.
Regards,
BF
My laptop was attacked by MS Antispyware 2009 and after taking advice from thos forum, I fond a cure and so thought to post here in case anyone else gets hit with it:
Do the following:
To restart the computer in Safe Mode, please do the following:
1. Click on Start >> Turn Off Computer >> Restart.
2. Keep pressing the F8 key while the system is restarting.
3. You will get a list of starting options.
4. Select "Safe Mode with Networking" by using the up and down arrow keys.
5. Press Enter key to start the system in Safe Mode.
6. Please Follow the steps and Link to run the program and clean the infections:
7. http://siri.urz.free.fr/Fix/SmitfraudFix.exe
1. Click on the link given above,
2. Hit on "RUN" / "OPEN" /"SAVE" the file.
3. Press any key from the keyboard, then Type "2" and press "Enter" on the keyboard
4. It will analyze and delete/KILL the infections.
5. Press "Y" and "Enter" to clean the registry .
6. You can see a "RAPPORT" Notepad LOG File.
7. Close the log file window and the smitfraud Blue colour window.
8. Restart the computer.
This worked for me when my laptop was infected by the above.
Hope this helps.
Regards,
BF
I had that b
d on my xp desktop pc.
I tried smitfraud and a few other fixes which didn't work. I managed to edit my registry and delete the program files to get rid of it but I was still unable to update my AVG anti-virus, spybot or adaware.
In the end I gave up and reinstalled windows xp from scratch.
d on my xp desktop pc.I tried smitfraud and a few other fixes which didn't work. I managed to edit my registry and delete the program files to get rid of it but I was still unable to update my AVG anti-virus, spybot or adaware.
In the end I gave up and reinstalled windows xp from scratch.
The_Jackal said:
How do you get this in the first place? Is it an exe thing or a dodgy website?
I think it was a pop-up from a website. It looks very convincing like windows defender or something and it sits in your taskbar and at no time did I ask for anything be installed. Other people use the pc, so I don't know if it was me who got it or not.The advice with all pop-up style stuff is to close down your browser, don't click on it.
http://news.bbc.co.uk/1/hi/technology/7779223.stm
The_Jackal said:
How do you get this in the first place? Is it an exe thing or a dodgy website?
Normaly via email!There's a very interesting disection of an earlier version here -
http://www.theregister.co.uk/2008/08/22/anatomy_of...
buggalugs said:
Very interesting.My AVG free failed to pick it up so I now use Avast instead. Avast has since picked this up once, on my laptop.
LeoSayer said:
buggalugs said:
Very interesting.My AVG free failed to pick it up so I now use Avast instead. Avast has since picked this up once, on my laptop.
to have a totally clear system, i use the following on all my clients machines if infected.
first thing kaspersky is installed , updated and authorised.
install- hijack this, malwarebytes antimalware and install spybot search and destroy, also have combofix ready and cccleaner if need be.
do a full scan with kaspersky as normal, delete everything it finds, boot in safe mode F8 then scan again, you have to manually start kaspersky but it will function as per normal.
after a scan restart.
run and update malwarebytes and scan, delete anything you find, do the same with spybot s&d, then run hijack this and check the registry against the scan results site, delete anything listed as nasty.
restart and boot into safe mode, run the above again and then restart.
when back to desktop run combo fix, you may need a few files from microsoft if you dont have them, it will get them for you.
when using this application follow the instructions carefully if your not sure choose no. it will ask you to do a back up however in most cases this will not be needed. let it run it will take some time, when it restarts it will continue its job and that will be that.
do a quick check with the other apps and that should be that.
check your control panel for an application with the word bonjior in its name, this is a trojan/worm application
also check for anything with homeview in its title.
another way of checking things is to goto the start click on run and enter msconfig, in the startup tab you will see a list of items in the start up routine, check for strange names like qrrtteex.exe or anything that makes no sense or is gibberish, this will be asomething linked in the start up, however hijack this will pick it up in its scan log and the results page will tell you which ones to click and delete.
i havent put links for the apps here as im not sure im allowed to or not, if i am allowed i will put the links here and some screenshots of the procedures. there is aa new rootkit with attatched trojans and worm package that has hit several systems i have had to work on lately. and the only way bar a total wipe down and reformat/install was to follow this procedure.antivirus software is only as good as the people who let it do its job, doesnt help when clients disable it because they think thats whats making thier systems slow. go figure " hey client you got several hundred different problems on here"
first thing kaspersky is installed , updated and authorised.
install- hijack this, malwarebytes antimalware and install spybot search and destroy, also have combofix ready and cccleaner if need be.
do a full scan with kaspersky as normal, delete everything it finds, boot in safe mode F8 then scan again, you have to manually start kaspersky but it will function as per normal.
after a scan restart.
run and update malwarebytes and scan, delete anything you find, do the same with spybot s&d, then run hijack this and check the registry against the scan results site, delete anything listed as nasty.
restart and boot into safe mode, run the above again and then restart.
when back to desktop run combo fix, you may need a few files from microsoft if you dont have them, it will get them for you.
when using this application follow the instructions carefully if your not sure choose no. it will ask you to do a back up however in most cases this will not be needed. let it run it will take some time, when it restarts it will continue its job and that will be that.
do a quick check with the other apps and that should be that.
check your control panel for an application with the word bonjior in its name, this is a trojan/worm application
also check for anything with homeview in its title.
another way of checking things is to goto the start click on run and enter msconfig, in the startup tab you will see a list of items in the start up routine, check for strange names like qrrtteex.exe or anything that makes no sense or is gibberish, this will be asomething linked in the start up, however hijack this will pick it up in its scan log and the results page will tell you which ones to click and delete.
i havent put links for the apps here as im not sure im allowed to or not, if i am allowed i will put the links here and some screenshots of the procedures. there is aa new rootkit with attatched trojans and worm package that has hit several systems i have had to work on lately. and the only way bar a total wipe down and reformat/install was to follow this procedure.antivirus software is only as good as the people who let it do its job, doesnt help when clients disable it because they think thats whats making thier systems slow. go figure " hey client you got several hundred different problems on here"
www.malwarebytes.org removes the infection, or it did last time I used it
sorry bit dyslexic and make mistakes with spelling and what i see on screen, its something i have to live with, even with spell checkers i dont always see things it shows me.
bonjour is how it is, im reffering to pc's though and not macs. macs.. god i love them, but they were so much better in os9, never needed an anti virus application on amac before the intels and osx.
i have a client with a several xserves and a few nodes and several times his systems have been hit, mainly by employees attatching various flash drives or opening up attatchments they shouldnt. like i said a security software works as long as the person behind it doesnt disable it.
bonjour is how it is, im reffering to pc's though and not macs. macs.. god i love them, but they were so much better in os9, never needed an anti virus application on amac before the intels and osx.
i have a client with a several xserves and a few nodes and several times his systems have been hit, mainly by employees attatching various flash drives or opening up attatchments they shouldnt. like i said a security software works as long as the person behind it doesnt disable it.
Panclan said:
www.malwarebytes.org removes the infection, or it did last time I used it
Best fix I've found for the machines I've been asked to remove it from!Funk said:
Panclan said:
www.malwarebytes.org removes the infection, or it did last time I used it
Best fix I've found for the machines I've been asked to remove it from!Panclan said:
www.malwarebytes.org removes the infection, or it did last time I used it
Big
here...many times.mate has avast and was panicking that his wife might find out that he had infected their computer after visting adult sites, spent 3 hours and getting more and more wound up.
rebooted into safe mode, downloaded malwarebytes, could not update it, but it found 26 infections that avast missed, but avast is free he whined...
seems I was checking the same sites he was, nod32 popped up and blocked it, some sort of porntube that needs a "special" codec to play the "films", was unable to close firefox and had to use taskmanager
rebooted into safe mode, downloaded malwarebytes, could not update it, but it found 26 infections that avast missed, but avast is free he whined...
seems I was checking the same sites he was, nod32 popped up and blocked it, some sort of porntube that needs a "special" codec to play the "films", was unable to close firefox and had to use taskmanager
that assumes the person behind the computer is sensible, knows what a host file is and how to edit it, vista is known to slow down if using a large one, so the sites I find to cause me hassles get blocked at the router.
friend in question has a 6 year old computer, does all accounts on paper even though he has office installed, has not gotten round to using it.
suggested he use eset's security suite as it was idiot proof, but no, avast is free and as it is his business PC, he has to skimp on it wherever possible to save less than a few pints of beer a month
friend in question has a 6 year old computer, does all accounts on paper even though he has office installed, has not gotten round to using it.
suggested he use eset's security suite as it was idiot proof, but no, avast is free and as it is his business PC, he has to skimp on it wherever possible to save less than a few pints of beer a month
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff