Smitfraud-c and problem with XP

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Ian W

Thread Starter
Joined
Jan 5, 2006
Messages
1
Hi,

I have a Dell Dimension PC running XP with SP2 and use AVG Antivirus, ZoneAlarm, SpyBot and AdAware to try and stay safe using broadband internet access. So far so good, but last night a flashing icon suddenly appeared on the system tray saying 'System infected' - I clicked on the X to close it and then my problems started. AVG detected a trojan which I deleted (didn't note the name).

Thinking it was spyware I ran Spybot which came up with Smitfraud-C which it could not delete and asked to run again on restart. Restarted PC and Spybot still could not delete. Ran AdAware and then did a Trend Micro scan to try and fix it but the flashing icon kept flashing, IE was hijacked to various security sites and popups started appearing. I tried a further Pandasoftware scan but the suspicious files it found (e.g. a .tmp file in the system directory) could not be deleted via Windows Explorer.

I then tried to use system restore to go back two days to a point when the machine was running well. All seemed to go fine until the machine restarted and now it comes up with a message that \windows\system32\config\system is missing or corrupted and to put in the XP CD and press r.

Before I dig myself into a deeper hole please let me know how I should restore XP and then finally get rid of Smitfraud and SpyAxe altogether assuming they are responsible for not being able to roll back XP to an earlier point. I gather from reading through the posts this morning that this malware is tricky to get rid of so any help is appreciated!

Thanks

Ian
 

Cheeseball81

Retired Moderator
Joined
Mar 3, 2004
Messages
84,315
Welcome to TSG :)

Click here to download HJTsetup.exe: http://www.thespykiller.co.uk/files/HJTSetup.exe
Save HJTsetup.exe to your desktop.

Double click on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish and it will launch Hijack This.
Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
Click Save to save the log file and then the log will open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top