hijack trojan

Hi, I idiotically downloaded a file without checking
the validity of it and it apparently carred a 'hijack
trojan'. At first I had no idea what happened ...all the
internet windows closed and when I restarted my computer
it showed a blue screen saying it detected
a 'smitfraud.c' on internet explorer. I did some basic
spyware and virus scan/removal and it didn't find
anything. I downloaded ms spyware removal beta and it
finally found the problem ...but it returned as soon as I
restarted the computer. I found out after some checking
that this spyware reinstalls itself after it gets
deleted...and I should run a cws delete program(cool web
search). I ran the program but it didn't detect it
because the signatures might not have been updated with
this trojan. I did update it before I performed the
search. The main problem I obviously have is that the
spyware removal detects it and deletes it ..but it just
comes right back. ...if anyone knows what I am talking
about ...and knows what file is causing it to reinstall
itself...maybe I can do a search for that file and delete
it. Also this is a tricky trojan ...there were some
programs that were immediately added to startup and were
running so they couldn't be deleted when i found
them ...I had to quickly end the process and delete the
file super fast before it restarted.

Joe wrote:
> Hi, I idiotically downloaded a file without checking
> the validity of it and it apparently carred a 'hijack
> trojan'. At first I had no idea what happened ...all the
> internet windows closed and when I restarted my computer
> it showed a blue screen saying it detected
> a 'smitfraud.c' on internet explorer. I did some basic
> spyware and virus scan/removal and it didn't find
> anything. I downloaded ms spyware removal beta and it
> finally found the problem ...but it returned as soon as I
> restarted the computer. I found out after some checking
> that this spyware reinstalls itself after it gets
> deleted...and I should run a cws delete program(cool web
> search). I ran the program but it didn't detect it
> because the signatures might not have been updated with
> this trojan. I did update it before I performed the
> search. The main problem I obviously have is that the
> spyware removal detects it and deletes it ..but it just
> comes right back. ...if anyone knows what I am talking
> about ...and knows what file is causing it to reinstall
> itself...maybe I can do a search for that file and delete
> it. Also this is a tricky trojan ...there were some
> programs that were immediately added to startup and were
> running so they couldn't be deleted when i found
> them ...I had to quickly end the process and delete the
> file super fast before it restarted.

Perhaps it is in system restore,or in a temp file.
I have written a few pages that might help.
Virus Removal Instructions: http://home.neo.rr.com/manna4u/
-max
--
You can find my e-mail address on my pages.
This message is virus free as far as I can tell.

Boot to Safe Mode and run the removal programs there.

--

Frank Saunders, MS-MVP IE/OE
http://www.fjsmjs.com

"Joe" <kobin@sbcglobal.net> wrote in message
news:07cb01c56013$339bc9a0$a501280a@phx.gbl...
> Hi, I idiotically downloaded a file without checking
> the validity of it and it apparently carred a 'hijack
> trojan'. At first I had no idea what happened ...all the
> internet windows closed and when I restarted my computer
> it showed a blue screen saying it detected
> a 'smitfraud.c' on internet explorer. I did some basic
> spyware and virus scan/removal and it didn't find
> anything. I downloaded ms spyware removal beta and it
> finally found the problem ...but it returned as soon as I
> restarted the computer. I found out after some checking
> that this spyware reinstalls itself after it gets
> deleted...and I should run a cws delete program(cool web
> search). I ran the program but it didn't detect it
> because the signatures might not have been updated with
> this trojan. I did update it before I performed the
> search. The main problem I obviously have is that the
> spyware removal detects it and deletes it ..but it just
> comes right back. ...if anyone knows what I am talking
> about ...and knows what file is causing it to reinstall
> itself...maybe I can do a search for that file and delete
> it. Also this is a tricky trojan ...there were some
> programs that were immediately added to startup and were
> running so they couldn't be deleted when i found
> them ...I had to quickly end the process and delete the
> file super fast before it restarted.

You will want to download and run Hijack This - available
at:

http://www.tomcoyote.org/hjt/

Do read the instructions :~)

JC
>-----Original Message-----
> Hi, I idiotically downloaded a file without checking
>the validity of it and it apparently carred a 'hijack
>trojan'. At first I had no idea what happened ...all
the
>internet windows closed and when I restarted my computer
>it showed a blue screen saying it detected
>a 'smitfraud.c' on internet explorer. I did some basic
>spyware and virus scan/removal and it didn't find
>anything. I downloaded ms spyware removal beta and it
>finally found the problem ...but it returned as soon as
I
>restarted the computer. I found out after some checking
>that this spyware reinstalls itself after it gets
>deleted...and I should run a cws delete program(cool web
>search). I ran the program but it didn't detect it
>because the signatures might not have been updated with
>this trojan. I did update it before I performed the
>search. The main problem I obviously have is that the
>spyware removal detects it and deletes it ..but it just
>comes right back. ...if anyone knows what I am talking
>about ...and knows what file is causing it to reinstall
>itself...maybe I can do a search for that file and
delete
>it. Also this is a tricky trojan ...there were some
>programs that were immediately added to startup and were
>running so they couldn't be deleted when i found
>them ...I had to quickly end the process and delete the
>file super fast before it restarted.
>.
>