TechSpot

SmitFraud-C.Toolbar888 *sigh*

By Wauughlord
Jun 6, 2007
  1. As others have experienced i have recently obtained the SmitFraud-C.Toolbar888 virus/whatever. Following instructions from other sufferers i found about 4 of the files through HJT (newest) and got rid of them. So far this has stopped the popups but for some reason (while typing in IE7) the keys will not work. Since this is a relatively new laptop, and i do not experience this in any online game/Word/Notepad/Messenger, i have decided to post the HJT log as well as some SSD info to see if there is anything wrong.

    SSD-
    (Fixable)
    Advertising.com (1)
    Avenue A, Inc. (1)
    DoubleClick (1)
    FastClick (2)
    HitBox (3)
    MediaPlex (1)
    ReliableStats (1)
    WebTrends live (1)
    Zedo (1)
    SmitFraud-C.Toolbar888 (2)
    Settings
    HKEY_USERS\S-1-5-21-78861713-4130592730

    (Unfixable)
    SmitFraud-C.Toolbar888 (2)
    Library
    C:\WINDOWS\system32\awvuv.dll

    HJT is attached

    Thankyou in advance (I hope the popups hold off enough so i can finish some work)
    Wauughlord
     
  2. momok

    momok TS Rookie Posts: 2,265

    Hi Wauughlord and welcome to techspot. =)

    Your system is absolutely riddled with malware.


    Important: Please read this thread HERE before you decide whether to clean or reformat your system.

    Should you decide to clean your computer, please do the following.

    You may wish to copy and paste these instructions on notepad for easier reference later.

    Download Vundofix from HERE.

    Double click the Vundofix.exe to run it.
    Right click in the vundofix window and click add files.

    Enter the following file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button:
    C:\WINDOWS\system32\ljjkijg.dll
    C:\WINDOWS\system32\awvuv.dll


    Click the remove vundo button and let Vundofix do its stuff.

    Once you click yes, your desktop will go blank as it starts removing Vundo.
    When completed, it will prompt that it will shutdown your computer, click OK.
    Turn your computer back on.

    Boot into safe mode under your normal user name. See how HERE

    Next turn on "Show all files and folders, including hidden and system". See how HERE

    Go to start > run and type services.msc. Press the enter key.
    Search for the following services. Double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    user32.dll

    Go to start > Control Panel > Add and Remove Programs.
    Remove anything related to the following:

    Video Access ActiveX Object

    After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
    O2 - BHO: (no name) - {034BCF48-D4E7-4335-8F56-CE9AB44F6961} - C:\WINDOWS\system32\ljjkijg.dll
    O2 - BHO: Nothing - {6ab7158b-4bff-4160-ad7d-4d622df548cf} - (no file)
    O2 - BHO: (no name) - {8B3DB02B-3212-47CE-943B-72997ADE19EB} - C:\WINDOWS\system32\awvuv.dll
    O2 - BHO: (no name) - {CD3447D4-CA39-4377-8084-30E86331D74C} - C:\WINDOWS\system32\itniktfb.dll (file missing)

    O4 - HKLM\..\Policies\Explorer\Run: [user32.dll] C:\Program Files\Video Access ActiveX Object\isamntr.exe
    O14 - IERESET.INF: START_PAGE_URL=http://dsl.optusnet.com.au/

    O16 - DPF: {25EBFA7E-A624-487D-AD62-BD7EE060B2D7} - http://supernatural.ten.com.au/entriq/cab/NetworkTen_3_5_0_7.cab
    O16 - DPF: {3C403675-B43C-410B-BF56-D4D1FB68356C} (ActiveXPortal Control) - http://72.29.84.224/OCX/gwnet.cab
    O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1162

    O20 - Winlogon Notify: awvuv - C:\WINDOWS\system32\awvuv.dll
    O20 - Winlogon Notify: ljjkijg - C:\WINDOWS\SYSTEM32\ljjkijg.dll
    O20 - Winlogon Notify: winprn32 - winprn32.dll (file missing)

    Close HJT.

    Navigate in Windows Explorer and delete the following files and folders in bold.

    C:\WINDOWS\system32\ljjkijg.dll
    C:\WINDOWS\system32\awvuv.dll

    Reboot into normal mode and rehide your protected OS files.

    Next, please go to Viruses/Spyware/Malware, preliminary removal instructions and follow the steps given. Do follow all the instructions exactly.

    Thereafter, please post fresh HijackThis, AVG Antispyware and Combofix logs as well as C:\vundofix.txt as attachments into this thread.

    Also, please let me know the results of the AVG Antirootkit scan


    Regards,
    Your friendly momok =)

    This thread is for the use of Wauughlord only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. Wauughlord

    Wauughlord TS Rookie Topic Starter

    I must get off now and i am up to rebooting my computer to start the linked preliminary instructions, here is the updated HJT log - and i have noticed that IE7 typing is now uniterrupted and there have been zero popups.
     
  4. momok

    momok TS Rookie Posts: 2,265

    Hi,

    Boot into safe mode like previously and unhide your file and folders.

    Go to start > Run. Type services.msc and press enter.
    Disable the following services from running and stop them from starting.
    j1251537
    ApachInc


    Have HijackThis fix these 3 entries:

    O4 - HKLM\..\Run: [j1251537] rundll32 C:\WINDOWS\system32\j1251537.dll sook
    O4 - HKLM\..\Run: [ApachInc] rundll32.exe "C:\WINDOWS\system32\jsdelxnx.dll",realset
    O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab

    Then Navigate in Windows Explorer and delete the following files:
    C:\WINDOWS\system32\jsdelxnx.dll
    C:\WINDOWS\system32\j1251537.dll

    Reboot into normal mode and rehide your OS files.

    Please post all fresh requested logs in your next reply. (ComboFix, AVG antispyware, HijackThis and C:\vundofix.txt)


    Regards,
    Your friendly momok =)

    This thread is for the use of Wauughlord only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. Wauughlord

    Wauughlord TS Rookie Topic Starter

    Okay i've finally had the time to complete all of that so here is the log files (all of them hopefully)

    I did tell combo fix to save a log but i cannot find it now, it did clear up some issues though i believe.

    Regards,
    Wauughlord

    P.S. net is working fastest it has in a long time

    *Found it*
     
  6. momok

    momok TS Rookie Posts: 2,265

    Hi,

    Things may be smoother, but I'm afraid your system is not fully clean yet.

    Please follow these instructions carefully.

    1. Download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

    2. Download the attached "avengerscript.txt" (from my attachment) and save it to your desktop

    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    3. Now, start The Avenger program by double clicking on its icon on your desktop.

    Under "Script file to execute" choose "Load script from file".
    Now click on the folder icon which will open a new window titled "open Script File"
    navigate to the attachment avengerscript.txt you have just downloaded, click on it and press open.
    Now click on the Green Light to begin execution of the script
    Answer "Yes" twice when prompted.

    4. The Avenger will automatically do the following:

    It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    On reboot, it will briefly open a black command window on your desktop, this is normal.
    After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

    5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT and ComboFix log.


    Regards,
    Your friendly momok =)

    This thread is for the use of Wauughlord only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. Wauughlord

    Wauughlord TS Rookie Topic Starter

    Okay here are the updated ComboFix and HJT files as well as the Avenger log file.

    Thankyou again,
    Wauughlord
     
  8. momok

    momok TS Rookie Posts: 2,265

    Hi,

    Your logs are just about clean.
    Let's fix these few registry keys and you should be ready to go.

    Please follow these instructions carefully.

    1. Download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

    2. Download the attached "script2.txt" (from my attachment) and save it to your desktop

    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    3. Now, start The Avenger program by double clicking on its icon on your desktop.

    Under "Script file to execute" choose "Load script from file".
    Now click on the folder icon which will open a new window titled "open Script File"
    navigate to the attachment script2.txt you have just downloaded, click on it and press open.
    Now click on the Green Light to begin execution of the script
    Answer "Yes" twice when prompted.

    4. The Avenger will automatically do the following:

    It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    On reboot, it will briefly open a black command window on your desktop, this is normal.
    After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

    5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh ComboFix and HJT log.


    Regards,
    Your friendly momok =)

    This thread is for the use of Wauughlord only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  9. Wauughlord

    Wauughlord TS Rookie Topic Starter

    Okay, heres the avenger log file/HJT file and ComboFix log file (hoping thats all of it)

    Wauughlord
     
  10. momok

    momok TS Rookie Posts: 2,265

    Hi,

    Your logs look clean now.

    I just realised I left out one registry key though. Go to Start > Run > regedit.
    Navigate manually to the following key and delete it.
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsUpdate < delete Windows Update

    Delete all files in AVG Antispyware Quarantine folder. (located in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Quarantine)

    You may also delete the avenger folder and its contents.

    Turn off system restore (XP/ME only). Learn how to do that HERE.
    This will remove all the remaining nasties from your old restore points.

    After that turn system restore back on.
    This would have created a new safe and clean restore point for your system.

    Often times, an infection can occur again not due to the incompetence of programs, but because of user habits.
    May I recommend you to read this article.
    This can help to prevent future infections.

    Should you have any further problems, please post in this thread.


    Regards,
    Your friendly momok =)

    This thread is for the use of Wauughlord only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  11. Wauughlord

    Wauughlord TS Rookie Topic Starter

    Thankyou very much for all your help even if the name is a little freaky :D hehehe Momok.

    Regards,
    Wauughlord
     
  12. momok

    momok TS Rookie Posts: 2,265

    Haha, no problems. Glad to be of help. =)
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...