[es] - Smitfraud-C.generic i Smitfraud-C.gp

DWade
Anonymous

Član broj: 145438
Poruke: 71
93.86.110.*

Profil

Smitfraud-C.generic i Smitfraud-C.gp

^{16.07.2008. u 18:45}

Spybot seach and destroy mi je nasao ovo:
Smitfraud-C.generic
Smitfraud-C.gp
i oni su povezani sa svchost.exe zato me je strah da ih obrisem posto sam pre imao problema sa svchost.exe

Trazio sam po netu svuda neku pomoc ali nista to nije detaljno , postoje neki tutori kako izbrisati ali su dugacki po nekoliko strana i veoma komplikovani
Sta da radim i da li postoji neki laksi nacin za brisanjem ovih malware-a ?

Insecurity is our life

^{16.07.2008. u 18:45}

kristi1

Član broj: 151211
Poruke: 1760
89.110.198.*

Sajt: www.mycity.rs/Ambulanta

Profil

Re: Smitfraud-C.generic i Smitfraud-C.gp

^{16.07.2008. u 18:56}

Evo ti resenje http://www.precisesecurity.com...ces/adware-tools/smitfraudfix/

^{16.07.2008. u 18:56}

DWade
Anonymous

Član broj: 145438
Poruke: 71
93.86.110.*

Profil

Re: Smitfraud-C.generic i Smitfraud-C.gp

^{16.07.2008. u 19:18}

ewo uklonio sam ih ali pazi sad kad startuje Win izbacuje gresku da ne moze da nadje svchost.exe i usporio mi je start racunara

Code:
SmitFraudFix v2.329

Scan done at 20:02:15.64, Wed 07/16/2008
Run from C:\Documents and Settings\IT\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\svchost.exe Deleted
C:\WINDOWS\system32\drivers\svchost.exe Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{319BD422-7A0A-4599-89D3-AB325CAA8B5D}: NameServer=192.168.1.1,192.168.1.2
HKLM\SYSTEM\CCS\Services\Tcpip\..\{3FAEC2EB-8475-4664-BD1E-938A98B4DD3A}: NameServer=208.67.222.222,208.67.220.220
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3FAEC2EB-8475-4664-BD1E-938A98B4DD3A}: DhcpNameServer=192.168.1.2
HKLM\SYSTEM\CS2\Services\Tcpip\..\{319BD422-7A0A-4599-89D3-AB325CAA8B5D}: NameServer=192.168.1.1,192.168.1.2
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3FAEC2EB-8475-4664-BD1E-938A98B4DD3A}: NameServer=208.67.222.222,208.67.220.220
HKLM\SYSTEM\CS3\Services\Tcpip\..\{319BD422-7A0A-4599-89D3-AB325CAA8B5D}: NameServer=192.168.1.1,192.168.1.2
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3FAEC2EB-8475-4664-BD1E-938A98B4DD3A}: NameServer=208.67.222.222,208.67.220.220
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.2

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Insecurity is our life

^{16.07.2008. u 19:18}

kristi1

Član broj: 151211
Poruke: 1760
89.110.198.*

Sajt: www.mycity.rs/Ambulanta

Profil

Re: Smitfraud-C.generic i Smitfraud-C.gp

^{16.07.2008. u 20:19}

Ubaci inst. disk pa idi na start - run - cmd - sfc /scannow - enter. Popravak sistemskih fajlova.

^{16.07.2008. u 20:19}

DWade
Anonymous

Član broj: 145438
Poruke: 71
93.86.110.*

Profil

Re: Smitfraud-C.generic i Smitfraud-C.gp

^{17.07.2008. u 23:18}

nope nista se ne desava opet sve po starom trazi svchost.exe pri pokretanju win-a

Insecurity is our life

^{17.07.2008. u 23:18}

Dr.Web

Član broj: 167977
Poruke: 19
77.46.251.*

Profil

Re: Smitfraud-C.generic i Smitfraud-C.gp

^{18.07.2008. u 12:53}

Probaj ovako:

If you deleted svchost.exe from your system32 folder follow these steps:

Boot from your Windows XP disk and use recovery console, follow the onscreen stuff and put the admin password in that you setup when you installed windows, you should now be at a prompt EXAMPLE: C:\WINDOWS>

At the end of the prompt type: cd F:\I386
F is the letter of the drive where your XP disk is so you will need to change it to your drive letter. The prompt should now be F:\I386>

After the prompt type: Expand svchost.ex_ C:\windows\system32
C is the letter of you HD were windows XP is installed, needs to be changed accordingly. At the prompt type: exit
Your sytem will re-boot and you will now have a copy of svchost.exe in your system32 folder again.

Preuzeto sa: http://forum.pcvsconsole.com/viewthread.php?tid=9852

^{18.07.2008. u 12:53}