SmitfraudFix.exe

Copied from SmitFraudFix Homepage: This tool removes Desktop Hijack malware: Advanced Antivirus AdwarePunisher AdwareSheriff AlphaCleaner AntiSpyCheck AntiSpyware Expert Antispyware Soldier AntiVermeans AntiVermins AntiVerminser AntiVirGear Antivirus 2009 Antivirus 2010 Antivirus 360 AntiVirus Lab 2009 Antivirus Master Antivirus Sentry Antivirus XP 2008 AntivirusGolden AVGold Awola BraveSentry IE Defender IE-Security Internet Antivirus Malware Defender 2009 MalwareCrush MalwareWipe MalwareWiped MalwaresWipeds MalwareWipePro MalwareWiper Micro Antivirus 2009 MS AntiSpyware 2009 MS Antivirus PC Protection Center 2008 Personal Defender 2009 PestCapture PestTrap Power Antivirus Power-Antivirus-2009 PSGuard quicknavigate.com RegistryFox Registry Cleaner Renus 2008 Security iGuard Smart Antivirus 2009 Smitfraud SmitFraudFixTool Spy Protector SpyAxe SpyCrush SpyDown SpyFalcon SpyGuard SpyHeal SpyHeals SpyLocked SpyMarshal SpySheriff SpySoldier Spyware Guard 2008 Spyware Protect 2009 Spyware Vanisher Spyware Soft Stop SpywareLocked SpywareQuake SpywareKnight SpywareRemover SpywareSheriff SpywareStrike Startsearches.net System Antivirus 2008 System Guard 2009 TheSpyBot TitanShield Antispyware Total Protect 2009 Total Secure 2009 Trust Cleaner Ultimate Antivirus 2008 UpdateSearches.com Virtual Maid Virus Heat Virus Protect Virus Protect Pro VirusBlast VirusBurst VirusRay Virus Remover 2008 VirusResponse Lab 2009 VirusTrigger Win32.puper WinHound WinPC Defender Vista Antivirus 2008 WinDefender 2009 XLG Security Center XP Security Center XPert Antivirus XP Police Antivirus Brain Codec ChristmasPorn DirectAccess DirectVideo EliteCodec eMedia Codec EZVideo FreeVideo Gold Codec HQ Codec iCodecPack IECodec iMediaCodec Image ActiveX Object Image Add-on IntCodec iVideoCodec JPEG Encoder Key Generator LookForPorn Media-Codec MediaCodec MMediaCodec MovieCommander MPCODEC My Pass Generator NetProject Online Image Add-on Online Video Add-on PCODEC Perfect Codec PowerCodec PornPass Manager PornMag Pass Pornovid PrivateVideo QualityCodec Silver Codec SearchPorn SexVid SiteEntry SiteTicket SoftCodec strCodec Super Codec TrueCodec VideoAccess VideoBox VidCodecs Video Access ActiveX Object Video ActiveX Object Video Add-on VideoCompressionCodec VideoKeyCodec VideosCodec WinAntiSpyPro WinMediaCodec X Password Generator X Password Manager ZipCodec WinCoDecPRO Use: * Search: o Double-click SmitfraudFix.exe o Select 1 and hit Enter to create a report of the infected files. The report can be found at the root of the system drive, usually at C:rapport.txt * Clean: o Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually) o Double-click SmitfraudFix.exe o Select 2 and hit Enter to delete infect files. o You will be prompted: Do you want to clean the registry ? answer Y (yes) and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection. o The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? answer Y (yes) and hit Enter to restore a clean file. o A reboot may be needed to finish the cleaning process. The report can be found at the root of the system drive, usually at C:rapport.txt * Optional: o To restore Trusted and Restricted site zone, select 3 and hit Enter. o You will be prompted: Restore Trusted Zone ? answer Y (yes) and hit Enter to delete trusted zone. Note: process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool". It is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. System requirements: Win2K, WinXP joedanger is NOT involved with Smitfraudfix in any way! This tool was created by S!Ri, and is available for FREE. Changelog: Version 2.405 (March 18, 2009) %WINDIR%ieocx.dll [-HKEY_LOCAL_MACHINESoftwareClassesCLSID{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}] [-HKEY_LOCAL_MACHINESOFTWAREClassesIEocxApp.IEocx] [-HKEY_LOCAL_MACHINESOFTWAREClassesIEocxApp.IEocx.1] [-HKEY_LOCAL_MACHINESOFTWAREClassesInterface{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}] [-HKEY_LOCAL_MACHINESOFTWAREClassesInterface{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}] (Already removed) [-HKEY_LOCAL_MACHINESOFTWAREClassesTypeLib{A54DC52D-7AAD-4D40-A126-337211631EDC}] [-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{96ad72e4-2e2b-4ffc-a5bb-279c2714af12}] %DESKTOP%WinPC Defender.lnk %STARTMENU%WinPC Defender.lnk [-HKEY_CURRENT_USERSoftwareWinPC Defender] %SYSTEM%rs32net.exe [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun] "rs32net"=- [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun] "rs32net"=- [-HKEY_CURRENT_USERSoftwarerenus2008] [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun] "renus2008.exe"=-

udp://tracker.openbittorrent.com:80
udp://open.demonii.com:1337
udp://tracker.coppersurfer.tk:6969
udp://exodus.desync.com:6969