Author Topic: smitfraud trojan  (Read 3494 times)

0 Members and 1 Guest are viewing this topic.

Beerbreath

  • Guest
smitfraud trojan
« on: December 12, 2005, 06:20:02 AM »
My friend has avast 4.6 home (free) edition and was recently infected with Smitfraud Trojan. I've tried to walk him through some removal methods posted on several nerd forums but they require 7-8 tools, logs, safe boots etc. and he barely knows what a desktop is. We've managed to clean out nvctrl.exe but the lingering mssearchnet.exe is still rearing its ugly head. He's too far for me to drive over to help so we're waiting for Avast to develop a cleaner tool for this little gem. Any idea if this is being worked on and when it may become available? His boot time scan seems to identify the Trojan but is unable to delete or clean it up.

galooma

  • Guest
Re: smitfraud trojan
« Reply #1 on: December 12, 2005, 08:42:22 AM »
Hi and welcome,
here,s a link to some history on this problem
http://forum.avast.com/index.php?topic=17172.msg146420#msg146420 pay particular attention to the smitrem.exe reccomended by noahdfear as it appears to be the one click remedy you are searching for.
good luck  :)
« Last Edit: December 12, 2005, 08:56:13 AM by Cloussau »

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: smitfraud trojan
« Reply #2 on: December 12, 2005, 01:22:36 PM »
His boot time scan seems to identify the Trojan but is unable to delete or clean it up.

I don't think a trojan could be cleaned as it, generally, is not an infected file.
To avoid recurring infection, a good thing is disable System Restore, boot, enable it again. If you find a virus keeps coming back after you delete it, it's most probably infected the System Restore folder, the best way to solve this is to disable System Restore, reboot your machine and then enable it again. After all, run a full avast! scanning. Enable/Disable System restore on Windows XP: http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405

Other think is deleting temporary Internet files, caches, recycle bin, etc.
The best things in life are free.

Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
Re: smitfraud trojan
« Reply #3 on: December 12, 2005, 03:39:49 PM »
Tech, there are some things avast! can't remove, even with a boot time scan. The SmitFraud Trojan is one. Also the Look2Me infection, and of course, FU type rootkits. Deleting system restore files and temp files is not going to help, unfortunately.
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog

Spiritsongs

  • Guest
Re: smitfraud trojan
« Reply #4 on: December 12, 2005, 04:50:26 PM »
 :) To rid your friend of Smitfraud & mssearchnet the need of
     advise from antiSPYWARE Experts are needed; I don't
     know what the several "nerd forums" told you, however,
     the experts in the PC Protection forum on
     www.freedomlist.com are ALWAYS using the latest,
     updated "tools" and the least amount necessary, so I
     would encourage you to give them a try .

Beerbreath

  • Guest
Re: smitfraud trojan
« Reply #5 on: December 13, 2005, 05:03:19 PM »
Thanks everyone for the help. I've already had him shut down restore, sent him Noahdfear's smitrem.exe and a walkthrough for how to safe boot and cleanup then I'll run his hijackthis log through the analysis site.
It would be nice if antivirus and anti-malware/adware could combat these infections in a single user friendly piece of software. I know Avast is great for most attacks and I recommend it to everyone. I'll follow up with the results when available and thanks again people.