virus

hi people,

I got this problem:"TROJAN-SPY.html.SMITFRAUD.C"

Microsoft Windows anti-spyware didn't notice him.

is there someone that had this problem solved?

Microsoft AntiSpyware is not a AntiVirus utility, update the definitions for
your AntiVirus software restart in safe mode and do a full scan with it.

Have you tried an online virus scanner?

Run at least 2 of these:

Panda ActiveScan
http://www.pandasoftware.com/activescan

Bitdefender
http://www.bitdefender.com/scan/Msie/index.php

McAfee FreeScan
http://us.mcafee.com/root/mfs/default.asp

Symantec Security Check
http://security.symantec.com/sscv6/

Pc-Cillin (Trend Micro Housecall)
http://housecall.antivirus.com/housecall/start_pcc.asp

PcPitstop
http://pcpitstop.com/antivirus/default.asp

RAV
http://www.ravantivirus.com/scan/
--

Andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

"eustaquio" <anonymous@discussions.microsoft.com> wrote in message
news:048b01c549c1$bd4e0590$a501280a@phx.gbl...
> hi people,
>
> I got this problem:"TROJAN-SPY.html.SMITFRAUD.C"
>
> Microsoft Windows anti-spyware didn't notice him.
>
> is there someone that had this problem solved?

1=Submit a Suspected Spyware Report

2=and detail the cleaning issue you are finding.

Have you tried scanning with Microsoft Antispyware in safe
mode?
Run a full system scan, check the 3 boxe
By doing these steps before trying something new, you make
the product better.

3=Get HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe

Save it to C:\hjt (new folder) then Open it and select
Scan and Save Log. Note where you saved the log then send
it to Ron Kinner as an attachment. He can probably
identify the problem and tell you how to get rid of it for
good.

Put Hijack in the subject so I will know it's not spam.

Ron Kinner
rkinner@att.net

Good luck

Engel


>-----Original Message-----
>hi people,
>
>I got this problem:"TROJAN-SPY.html.SMITFRAUD.C"
>
>Microsoft Windows anti-spyware didn't notice him.
>
>is there someone that had this problem solved?
>.
>

Hi André,

It's really a trojan SPY html.SMITFRAUD.C

have u ever eliminate this kind of pest? using your
suggestion? McAfee e Norton didn't work.

>-----Original Message-----
>Microsoft AntiSpyware is not a AntiVirus utility, update
the definitions for
>your AntiVirus software restart in safe mode and do a
full scan with it.
>
>Have you tried an online virus scanner?
>
>Run at least 2 of these:
>
>Panda ActiveScan
>http://www.pandasoftware.com/activescan
>
>Bitdefender
>http://www.bitdefender.com/scan/Msie/index.php
>
>McAfee FreeScan
>http://us.mcafee.com/root/mfs/default.asp
>
>Symantec Security Check
>http://security.symantec.com/sscv6/
>
>Pc-Cillin (Trend Micro Housecall)
>http://housecall.antivirus.com/housecall/start_pcc.asp
>
>PcPitstop
>http://pcpitstop.com/antivirus/default.asp
>
>RAV
>http://www.ravantivirus.com/scan/
>--
>
>Andre
>http://spaces.msn.com/members/adacosta
>FAQ for MS AntiSpy
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm
>
>"eustaquio" <anonymous@discussions.microsoft.com> wrote
in message
>news:048b01c549c1$bd4e0590$a501280a@phx.gbl...
>> hi people,
>>
>> I got this problem:"TROJAN-SPY.html.SMITFRAUD.C"
>>
>> Microsoft Windows anti-spyware didn't notice him.
>>
>> is there someone that had this problem solved?
>
>
>.
>

Thank u Ron, i'll do this.


>-----Original Message-----
>1=Submit a Suspected Spyware Report
>
>2=and detail the cleaning issue you are finding.
>
>Have you tried scanning with Microsoft Antispyware in
safe
>mode?
>Run a full system scan, check the 3 boxe
>By doing these steps before trying something new, you
make
>the product better.
>
>3=Get HijackThis.exe from
>http://tomcoyote.org/hjt/hjt199//HijackThis.exe
>
>Save it to C:\hjt (new folder) then Open it and select
>Scan and Save Log. Note where you saved the log then
send
>it to Ron Kinner as an attachment. He can probably
>identify the problem and tell you how to get rid of it
for
>good.
>
>Put Hijack in the subject so I will know it's not spam.
>
>Ron Kinner
>rkinner@att.net
>
>Good luck
>
>Engel
>
>
>>-----Original Message-----
>>hi people,
>>
>>I got this problem:"TROJAN-SPY.html.SMITFRAUD.C"
>>
>>Microsoft Windows anti-spyware didn't notice him.
>>
>>is there someone that had this problem solved?
>>.
>>
>.
>

This bug is caused by a file called wp.exe that was sent
out in spam that looked like it came from SmithBarney. Run
HijackThis

http://tomcoyote.org/hjt/hjt199//HijackThis.exe

and you will see him down in the O4 entries.

O4 - HKCU\..\Run: [WindowsFY] C:\wp.exe

Terminate the process . You can use HijackThis, Config,
Misc Tools, Open Process Manager, find and highlight the
C:\wp.exe and Kill Process then Back and Scan and then
check his box and Fix Checked. That still leaves a problem
in your registry.

Start, Run, regedit, OK to bring up the regedit program.

find HKey_Current_User->Software ->Microsoft->Windows-
>CurrentVersion>policies (Hit the + sign in front of each
Key as you find them. That will open up the subkeys.)

Under Policies is usually an entry named System. If you
find it highlight it and press the Delete key. Then OK.
Close the program and reboot.

Start, Control Panel, Display (Properties). This should
bring up Display Properties/Background. Change the
wallpaper to something else and Apply. You may also need
to select Web and uncheck the box where it says View My
Active Desktop as a web page. OK

He also creates a file C:\wp.bmp which is what you see on
your desktop. Don't get rid of it until you have done all
of the above.

Ron

See this:

http://securityresponse.symantec.co...itfraudoid.html


"eustaquio" <anonymous@discussions.microsoft.com> wrote in message
news:048b01c549c1$bd4e0590$a501280a@phx.gbl...
> hi people,
>
> I got this problem:"TROJAN-SPY.html.SMITFRAUD.C"
>
> Microsoft Windows anti-spyware didn't notice him.
>
> is there someone that had this problem solved?