PCTech Forums

Hi,
I suddenly started getting an alert dialog box as soon as I open IE on my laptop. The alert is about a virus W32.Myzor.FK@Y that affects .exe files and accesses private data such as passwords, etc. When I click the 'OK' button on the message dialog box it takes me to the website http://malwarewiped.com/?aid=246. The header of the web page shows "Internet Security", the LHS shows Official Partners and the RHS gives details about my computer. The Official Partners listed are: 'Spy Heal', 'Pest Capture', 'Antivirus golden', and 'Malware Wiped'.

Hello ratan kataria, and welcome to our forum.

Warning these instruction are for this thread only!
You should never attempt to use them for anything else!

Please download HijackThis http://downloads.malwareremoval.com/hijackthis.zip and save it to your desktop.

Please download
Extract the content (a folder named SmitfraudFix) to your Desktop.

Extract HijackThis:

1. Right-click your file HijackThis.zip and from the menu select "Extract All".
2. The Extraction Wizard Window will appear, Click "Next".
3. Click Browse and navigate to "C:\" or the "C:\Program Files" and click "Create A New Folder" and call it "HJT" or "HijackThis" or whatever that is easy to remember and then click OK.
4. Click the Extract button.
5. Close the HijackThis.zip dialogue box.

Now double-click on hijackthis.exe and when the window opens, Press the Scan now and save a logfile button and then when it is done, copy and paste the contents of the notepad it opens as a reply to this post.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply along with the HijackThis report.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool";
it is not a virus, but a program used to stop system processes.
Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Here is the new log file

SmitFraudFix v2.166

Scan done at 19:11:13.90, Tue 04/10/2007
Run from C:\Documents and Settings\Kaven\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\icont.exe Deleted
C:\WINDOWS\system32\wp.bmp Deleted

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{431619F8-AEC1-46D0-B66C-AB7B98EAA611}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{88C2B23C-8705-4809-B1E4-54C69300D1A8}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{88C2B23C-8705-4809-B1E4-54C69300D1A8}: NameServer=208.67.222.222,208.67.220.220
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9E5FA035-D0BE-46F2-B9C3-B5A62BEC6B56}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CS1\Services\Tcpip\..\{431619F8-AEC1-46D0-B66C-AB7B98EAA611}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{88C2B23C-8705-4809-B1E4-54C69300D1A8}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{88C2B23C-8705-4809-B1E4-54C69300D1A8}: NameServer=208.67.222.222,208.67.220.220
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9E5FA035-D0BE-46F2-B9C3-B5A62BEC6B56}: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CS3\Services\Tcpip\..\{431619F8-AEC1-46D0-B66C-AB7B98EAA611}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{88C2B23C-8705-4809-B1E4-54C69300D1A8}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{88C2B23C-8705-4809-B1E4-54C69300D1A8}: NameServer=208.67.222.222,208.67.220.220
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=68.87.72.130 68.87.77.130
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=68.87.72.130 68.87.77.130


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

Is there anything else I should do? Should I try reinstalling and updating AVG again? Cause before I ran this I tried AVG and it kept saying it found viruses in all kinds of places, which I think is kind of fishy, and it also disabled my updates for AVG.