Frigin Stupid annoying smitfraud-c thing!!!!

[Tai Sen]

Ya. Well i spent about 6 hours looking for things to fix the frigin smitfraud but non of them worked. and whenever i tried to delete it with spybot it would just come back next time i used my computer. it said that it fixed it.
: Smitfraud-C.: User settings (Registry key, fixed)
  HKEY_USERS\S-1-5-21-1409082233-796845957-682003330-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{479FD0CF-5BE9-4C63-8CDA-B6D371C67BD5}


but thats bs. didnt work. so what do i do? my dads about to kill me for using the computer for so long but i just imhad to get this fixed. So i am asking u guys now. How do i get rid of it? oh and everytime i start my computer in safe mode the monitor says its out of range. so what do i do? AKKK! Im getting frustrated. especially by this stupid popup baloon that says it senses spyware activity and i have to download some crap i know is a scam. it looks like a white question mark in a blue circle and it has a red cross that goes over it every second. ill post a screenie. plz i need ur help!!!!....-_-

so here is the question mark thing. its an avi vid.

but i dont get it because now when i scan with spybot it doesnt come up.

so i dont know what to do to get rid of the question mark thing. ya the thing is Smitfraud-C

[oddjob]

Print this out to help you follow the advice.

Here is the process for removing what you have ....

http://www.bleepingcomputer.com/forums/topic17258.html

It should be run in safe mode but I see your problem with the monitor saying "out of range".

*****************

If the monitor shows that as soon as you turn on the PC then there is something physically wrong.

Are you tapping the F8 key (or possibly F5) during startup to get the Startup Menu? You should then chose Safe Mode. Does the screen still come up blank?

If so this is not normal. You have to think long and hard about a resolution if this really is the case.

*****************

During boot up the monitor should show POST messages on the screen (or a manufacturers "splash screen"). These are displayed at VGA resolutions and frequencies before any screen drivers are loaded.

Borrow another monitor from somewhere and see what the difference is.

Check in the end of the monitor cable for bent pins (some are missing this is normal).

Test your monitor on another PC.

*****************

You can also lower the resolution and color depth to the lowest setting, change the resolution and, if possible, the refresh rate to a minimum value (640x480 resolution).

*****************

You can also try hardware repair ... open the case and reseat the video card (or is it onboard video?) as outlined below.

If you have a plug-in video card (aka Display/Graphics adaptor or GPU) then here is a step by step to reseat it:

    * Shutdown and switch off but do not remove the power cord.
    * Take off the cover.
    * Hold on to a metal part of the case now and as often as you can during the entire process.
    * Pull out the power cord.
    * Undo the screw holding the video card in place and unplug any cables going to the card.
    * Unplug the card by pulling firmly upward. There may be a latch at the back of the card, press down on this to help eject it.
    * If there is a lot of dust around use a can of compressed air to blow out the card slot.
    * If the edge connectors of the card look tarnished clean them lightly with a pencil erasor.
    * Firmly plug the card back in and secure it with the screw.
    * Put the case cover back on.
    * Check in the end of the monitor cable that there are no broken or bent pins (some pins are missing - that is normal).
    * Connect the monitor cable, turn the securing screws finger tight only, switch the monitor on and reboot.

*****************

if you still can't boot to safe mode without the "out of range" problem can you go to the Startup Menu and choose Command Prompt Only? Do you get a readable screen?

*****************

On the other hand ... if you can now get to safe mode ... carry out the smitfraud fix at the start of this post.


OJ

[patio]

And clean up your sig images as well.

We have members of all ages and also people on dialup...

[Tai Sen]

Print this out to help you follow the advice.

Here is the process for removing what you have ....

http://www.bleepingcomputer.com/forums/topic17258.html

It should be run in safe mode but I see your problem with the monitor saying "out of range".

*****************

If the monitor shows that as soon as you turn on the PC then there is something physically wrong.

Are you tapping the F8 key (or possibly F5) during startup to get the Startup Menu? You should then chose Safe Mode. Does the screen still come up blank?

If so this is not normal. You have to think long and hard about a resolution if this really is the case.

*****************

During boot up the monitor should show POST messages on the screen (or a manufacturers "splash screen"). These are displayed at VGA resolutions and frequencies before any screen drivers are loaded.

Borrow another monitor from somewhere and see what the difference is.

Check in the end of the monitor cable for bent pins (some are missing this is normal).

Test your monitor on another PC.

*****************

You can also lower the resolution and color depth to the lowest setting, change the resolution and, if possible, the refresh rate to a minimum value (640x480 resolution).

*****************

You can also try hardware repair ... open the case and reseat the video card (or is it onboard video?) as outlined below.

If you have a plug-in video card (aka Display/Graphics adaptor or GPU) then here is a step by step to reseat it:

    * Shutdown and switch off but do not remove the power cord.
    * Take off the cover.
    * Hold on to a metal part of the case now and as often as you can during the entire process.
    * Pull out the power cord.
    * Undo the screw holding the video card in place and unplug any cables going to the card.
    * Unplug the card by pulling firmly upward. There may be a latch at the back of the card, press down on this to help eject it.
    * If there is a lot of dust around use a can of compressed air to blow out the card slot.
    * If the edge connectors of the card look tarnished clean them lightly with a pencil erasor.
    * Firmly plug the card back in and secure it with the screw.
    * Put the case cover back on.
    * Check in the end of the monitor cable that there are no broken or bent pins (some pins are missing - that is normal).
    * Connect the monitor cable, turn the securing screws finger tight only, switch the monitor on and reboot.

*****************

if you still can't boot to safe mode without the "out of range" problem can you go to the Startup Menu and choose Command Prompt Only? Do you get a readable screen?

*****************

On the other hand ... if you can now get to safe mode ... carry out the smitfraud fix at the start of this post.


OJ

Well basicly, the computer starts in normal just fine but it wont start in safe mode. the screen doesnt show the put of range until it starts the safe mode. but normal is fine. but what i dont get is that on normal the resolution is like 1000 bye 700 or something and safe mode uses only the basic video setup so im not sure y it works with better graphics and not with lower ones. oh and borrowing another monitor well...itl be a bit hard....and how can i change the refresh rate for my monitor? and how does that effect safe mode? Is there a way to modify the safe mode video setting in normal mode or anything? and what do i do if i can use safemode with command prompt only thing? oh ya and how do u tell whats ur videocard?

And clean up your sig images as well.

We have members of all ages and also people on dialup...

ya sry bout tat. I feel like a n00b

[patio]

No Problem...thanx for taking care of it.

Is this an LCD monitor ? ?

[Tai Sen]

No Problem...thanx for taking care of it.

Is this an LCD monitor ? ?

whoa. skills. yes in fact this is an lcd monitor? does that change anything? and i think the video card is part of the motherboard on the computer. i cant see any plug ins or anything. i breathed in dust from the fan until i was coughing. and the memory of the video card is taken right out of the DDR RAM. so instead of 512 mb of RAM i only have about 448 mb of RAM or something.

[patio]

It's possible that onboard chip can't support that monitor in safe mode because it uses the generic Window drivers...
To find out what is in there go to Start/Run and type in dxdiag and hit Enter.
Under Display it should show your vid chip info...

[Tai Sen]

It's possible that onboard chip can't support that monitor in safe mode because it uses the generic Window drivers...
To find out what is in there go to Start/Run and type in dxdiag and hit Enter.
Under Display it should show your vid chip info...

ok ill post a a the file here.....cause i dont want to ask if i have to and then w8 for u to get back.
 nvm ill just copn paste. no i wont ill upload it somewhere and u can download it and see. the file format will be .txt so no viruses.

 http://files.filefront.com//;6985126;;/
 sigh. I'm a sad panda...
 

[patio]

According to your report you have an onboard chip that uses 64M of installed RAM...

---------------
Display Devices
---------------
        Card name: SiS 650_651_M650_M652_740
     Manufacturer: SiS
        Chip type: SiS M650  
         DAC type: Internal
       Device Key: Enum\PCI\VEN_1039&DEV_6325&SUBSYS_D0001458&REV_00
   Display Memory: 64.0 MB
     Current Mode: 1280 x 1024 (32 bit) (60Hz)
          Monitor: Plug and Play Monitor
  Monitor Max Res: 1600,1200
      Driver Name: SiSGRV.dll
   Driver Version: 6.14.0010.3700 (English)
      DDI Version: 9 (or higher)
Driver Attributes: Final Retail
 Driver Date/Size: 10/4/2005 23:56:44, 1735168 bytes
      WHQL Logo'd: Yes
  WHQL Date Stamp: n/a
              VDD: n/a
         Mini VDD: sisgrp.sys
    Mini VDD Date: 10/4/2005 23:43:02, 243712 bytes
Device Identifier: {D7B71ED9-2065-11CF-9C79-0AF0A1C2CB35}
        Vendor ID: 0x1039
        Device ID: 0x6325
        SubSys ID: 0xD0001458
      Revision ID: 0x0000
      Revision ID: 0x0000
      Video Accel: ModeMPEG2_D ModeMPEG2_C ModeMPEG2_A ModeMPEG1_A
 Deinterlace Caps: n/a
         Registry: OK
     DDraw Status: Enabled
       D3D Status: Enabled
       AGP Status: Enabled
DDraw Test Result: Not run
 D3D7 Test Result: Not run
 D3D8 Test Result: Not run
 D3D9 Test Result: Not run

But let's finish your cleanup issues above before moving on to other reccomendations.

[Tai Sen]

According to your report you have an onboard chip that uses 64M of installed RAM...

---------------
Display Devices
---------------
        Card name: SiS 650_651_M650_M652_740
     Manufacturer: SiS
        Chip type: SiS M650  
         DAC type: Internal
       Device Key: Enum\PCI\VEN_1039&DEV_6325&SUBSYS_D0001458&REV_00
   Display Memory: 64.0 MB
     Current Mode: 1280 x 1024 (32 bit) (60Hz)
          Monitor: Plug and Play Monitor
  Monitor Max Res: 1600,1200
      Driver Name: SiSGRV.dll
   Driver Version: 6.14.0010.3700 (English)
      DDI Version: 9 (or higher)
Driver Attributes: Final Retail
 Driver Date/Size: 10/4/2005 23:56:44, 1735168 bytes
      WHQL Logo'd: Yes
  WHQL Date Stamp: n/a
              VDD: n/a
         Mini VDD: sisgrp.sys
    Mini VDD Date: 10/4/2005 23:43:02, 243712 bytes
Device Identifier: {D7B71ED9-2065-11CF-9C79-0AF0A1C2CB35}
        Vendor ID: 0x1039
        Device ID: 0x6325
        SubSys ID: 0xD0001458
      Revision ID: 0x0000
      Revision ID: 0x0000
      Video Accel: ModeMPEG2_D ModeMPEG2_C ModeMPEG2_A ModeMPEG1_A
 Deinterlace Caps: n/a
         Registry: OK
     DDraw Status: Enabled
       D3D Status: Enabled
       AGP Status: Enabled
DDraw Test Result: Not run
 D3D7 Test Result: Not run
 D3D8 Test Result: Not run
 D3D9 Test Result: Not run

But let's finish your cleanup issues above before moving on to other reccomendations.

i had said that....

[oddjob]

OK. Let's go back to my reply #1.

I say that the fix should be run in safe mode but, as you can't get to safe mode, go through the smitfraud fix process in normal mode.

Post the smitfraudfix log and a fresh HJT log when you are done.

Please also let us know how your computer is operating now.


OJ

[Tai Sen]

OK. Let's go back to my reply #1.

I say that the fix should be run in safe mode but, as you can't get to safe mode, go through the smitfraud fix process in normal mode.

Post the smitfraudfix log and a fresh HJT log when you are done.

Please also let us know how your computer is operating now.


OJ

ok here is the smitfraud log.

SmitFraudFix v2.150

Scan done at 14:12:35.32, Tue 03/20/2007
Run from D:\LimeWire saved\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b292ec9f-a074-4115-8342-1f459702d8d2}"="characterizing"

[HKEY_CLASSES_ROOT\CLSID\{b292ec9f-a074-4115-8342-1f459702d8d2}\InProcServer32]
@="C:\WINDOWS\system32\fyxkaah.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{b292ec9f-a074-4115-8342-1f459702d8d2}\InProcServer32]
@="C:\WINDOWS\system32\fyxkaah.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
 
Registry Cleaning done.
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b292ec9f-a074-4115-8342-1f459702d8d2}"="characterizing"

[HKEY_CLASSES_ROOT\CLSID\{b292ec9f-a074-4115-8342-1f459702d8d2}\InProcServer32]
@="C:\WINDOWS\system32\fyxkaah.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{b292ec9f-a074-4115-8342-1f459702d8d2}\InProcServer32]
@="C:\WINDOWS\system32\fyxkaah.dll"



»»»»»»»»»»»»»»»»»»»»»»»» End

[Tai Sen]

and this is the hijackthis 1

Logfile of HijackThis v1.99.1
Scan saved at 2:14:25 PM, on 3/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\svchost.exe
D:\lime wire pro\no thid 1\LimeWire\LimeWire.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\explorer.exe
D:\LimeWire saved\HijackThis.exe

O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\screenshot thing\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\DOWNLO~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiV

but is till have the stupid question mark thing....

[patio]

Your last Hijack log is incomplete...
You might actually have to hook up an older monitor to get into safemode so you can properly apply oddjob's fixes here....
I know it sounds like we're stumbling along here and mixing hardware/software discussions and remedies here but that's how i would approach it...

[Tai Sen]

Your last Hijack log is incomplete...
You might actually have to hook up an older monitor to get into safemode so you can properly apply oddjob's fixes here....
I know it sounds like we're stumbling along here and mixing hardware/software discussions and remedies here but that's how i would approach it...

AKKKK!!!!! My lord please do not forsake me!!!!U sure thats the only way....i mean getting my dad to bring home the old monitor will piss him off...