Spyware Problems

By Wearhouse51 ยท 7 replies
Jun 28, 2006
  1. Same Problem

    I am having the same problem as piklmeup with the sysprotectionpage.com hijacking my homepage. If I post my hijack this log will someone be able to walk me through the steps on how to fix it?
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Your system is infected with the Smitfraud trojan.

    Go HERE and follow the instructions exactly.

    Then, go HERE and do like wise.

    Finally, post a fresh HJT log as a .txt attachment into this thread. See HERE for instructions on how to do this.

    Regards Howard :wave: :wave:
  3. Wearhouse51

    Wearhouse51 TS Rookie Topic Starter

    ok heres my HJT text file
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    No, thats a zip file.

    Please attach your HJT log as a .txt file. Only after following the above instructions.

    Regards Howard :)
  5. Wearhouse51

    Wearhouse51 TS Rookie Topic Starter

    ok sorry heres the .txt file
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Download the Pocket killbox programme from HERE. Extract it, but do not run it yet.

    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).


    Close task manager.

    Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O16 - DPF: {00000000-0000-0000-0000-100000000003} - http://code.trasferimento.biz/l/b09134cc7aefd4378a8d885b22d634a7_35.exe

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O20 - Winlogon Notify: winhfa32 - C:\WINDOWS\SYSTEM32\winhfa32.dll

    Click on the fix checked button.

    Close HJT.

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.

    This is the filepath you need to enter into killbox.


    Once your system has rebooted, please post a fresh HJT log.

    Regards Howard :)
  7. Wearhouse51

    Wearhouse51 TS Rookie Topic Starter

    New Log

    Alright, sorry this took so long, but here is my new Hijackthis log.
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Have HJT fix the following entries.

    O20 - Winlogon Notify: winhfa32 - winhfa32.dll (file missing)

    O23 - Service: Remote Assistance (RMTASSIST) - Unknown owner - C:\WINDOWS\algr.exe (file missing)

    Other than the above, your HJT log is clean.

    Regards Howard :)
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...