Red circle with white X (from older thread)

Question

mazzystar 0 Newbie Poster

14 Years Ago

Hi,

I'm running Win XP
I was looking through an old thread (now closed) & found the following recommendation (below). At the end of the recommendation it says to post the log... and... that's the reason for starting this thread...

Recommendation from old thread:
Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Post the C:\rapport.txt log, and a new HJT log, and we will continue the fix
Firefox
Ewido
Tune up windows
Get detailed system information
My Fixes

Member - Alliance of Security Analysis Professionals - Since 2006

My Rapport log #1:
SmitFraudFix v2.423

Scan done at 14:48:00.34, Thu 07/23/2009
Run from C:\Documents and Settings\u295269\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Attachmate\INFOCNEE\ATSSrvc.exe
C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\NALNTSRV.EXE
C:\WINDOWS\system32\SvcRunAs.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\StacSV.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\wm.exe
C:\NOVELL\ZENRC\wuser32.exe
C:\NOVELL\ZENRC\WUOLService.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\braviax.exe
C:\Program Files\Palm\Hotsync.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\u295269\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\u295269\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\u295269\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\u295269\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\u295269\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\u295269\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\u295269\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\u295269\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

hosts file corrupted !

91.206.201.8 private.microsoft.com

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\braviax.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\u295269

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\u295269\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\u295269\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\u295269\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Broadcom NetXtreme 57xx Gigabit Controller #2 - Packet Scheduler Miniport
DNS Server Search Order: 161.215.130.130
DNS Server Search Order: 161.215.130.131

Description: Broadcom NetXtreme 57xx Gigabit Controller #2 - Packet Scheduler Miniport
DNS Server Search Order: 161.215.54.16
DNS Server Search Order: 161.215.153.3

Description: Check Point Virtual Network Adapter For SSL Network Extender - Packet Scheduler Miniport
DNS Server Search Order: 161.215.153.3
DNS Server Search Order: 161.215.54.16

HKLM\SYSTEM\CCS\Services\Tcpip\..\{00A5761E-8C81-4FB2-A30C-AF558D326356}: DhcpNameServer=161.215.130.130 161.215.130.131
HKLM\SYSTEM\CCS\Services\Tcpip\..\{12E31064-F9BC-434F-A9C6-0863CDB461CA}: DhcpNameServer=161.215.153.3 161.215.54.16
HKLM\SYSTEM\CCS\Services\Tcpip\..\{8E9D47BF-00E1-4450-B108-CE9E98B3429E}: DhcpNameServer=161.215.54.16 161.215.153.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{00A5761E-8C81-4FB2-A30C-AF558D326356}: DhcpNameServer=161.215.130.130 161.215.130.131
HKLM\SYSTEM\CS1\Services\Tcpip\..\{12E31064-F9BC-434F-A9C6-0863CDB461CA}: DhcpNameServer=161.215.153.3 161.215.54.16
HKLM\SYSTEM\CS1\Services\Tcpip\..\{8E9D47BF-00E1-4450-B108-CE9E98B3429E}: DhcpNameServer=161.215.54.16 161.215.153.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{00A5761E-8C81-4FB2-A30C-AF558D326356}: DhcpNameServer=161.215.130.130 161.215.130.131
HKLM\SYSTEM\CS3\Services\Tcpip\..\{12E31064-F9BC-434F-A9C6-0863CDB461CA}: DhcpNameServer=161.215.153.3 161.215.54.16
HKLM\SYSTEM\CS3\Services\Tcpip\..\{8E9D47BF-00E1-4450-B108-CE9E98B3429E}: DhcpNameServer=161.215.54.16 161.215.153.3
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=161.215.54.16 161.215.153.3
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=161.215.54.16 161.215.153.3
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=161.215.54.16 161.215.153.3

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

My Rapport log #2:
SmitFraudFix v2.423

Scan done at 15:00:07.15, Thu 07/23/2009
Run from C:\Documents and Settings\u295269\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost
::1 localhost
91.206.201.8 avir-guardian.com
91.206.201.8 www.avir-guardian.com

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\braviax.exe Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{00A5761E-8C81-4FB2-A30C-AF558D326356}: DhcpNameServer=161.215.130.130 161.215.130.131
HKLM\SYSTEM\CCS\Services\Tcpip\..\{12E31064-F9BC-434F-A9C6-0863CDB461CA}: DhcpNameServer=161.215.153.3 161.215.54.16
HKLM\SYSTEM\CCS\Services\Tcpip\..\{8E9D47BF-00E1-4450-B108-CE9E98B3429E}: DhcpNameServer=161.215.54.16 161.215.153.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{00A5761E-8C81-4FB2-A30C-AF558D326356}: DhcpNameServer=161.215.130.130 161.215.130.131
HKLM\SYSTEM\CS1\Services\Tcpip\..\{12E31064-F9BC-434F-A9C6-0863CDB461CA}: DhcpNameServer=161.215.153.3 161.215.54.16
HKLM\SYSTEM\CS1\Services\Tcpip\..\{8E9D47BF-00E1-4450-B108-CE9E98B3429E}: DhcpNameServer=161.215.54.16 161.215.153.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{00A5761E-8C81-4FB2-A30C-AF558D326356}: DhcpNameServer=161.215.130.130 161.215.130.131
HKLM\SYSTEM\CS3\Services\Tcpip\..\{12E31064-F9BC-434F-A9C6-0863CDB461CA}: DhcpNameServer=161.215.153.3 161.215.54.16
HKLM\SYSTEM\CS3\Services\Tcpip\..\{8E9D47BF-00E1-4450-B108-CE9E98B3429E}: DhcpNameServer=161.215.54.16 161.215.153.3
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=161.215.54.16 161.215.153.3
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=161.215.54.16 161.215.153.3
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=161.215.54.16 161.215.153.3

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

»»»»»»»»»»»»»»»»»»»»»»»» RK.2

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Thank you!!
Jeni

windows-virus

2 Contributors
3 Replies
135 Views
11 Hours Discussion Span
Latest Post 14 Years Ago Latest Post by crunchie

All 3 Replies

crunchie 990 Most Valuable Poster

14 Years Ago

And the question is........?

Welcome to Daniweb by the way :).

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

mazzystar 0 Newbie Poster · Answer 1 · 2009-07-24T02:54:07+00:00

Hi Crunchie,

In the previous instructions is says" Post the C:\rapport.txt log, and a new HJT log, and we will continue the fix

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 2 · 2009-07-24T07:35:15+00:00

crunchie 990 Most Valuable Poster

14 Years Ago

Perhaps it does, but what problems are you having?

Red circle with white X (from older thread)

Recommended Answers Collapse Answers

All 3 Replies

Recommended Answers