Infected with Smitfraud.c, unable to boot PC, help please

Question

My darling son has managed to infect our pc with the above. On booting up the PC (WinXP, all goes well up to the windows password screen. On pressing enter, I get a blue screen with the following message

'Fatal error in IE has occured at 0028:Coo11E36 in VXD VMM901) + 00010E36.
Error was caused by Trojan-spy. HTML. Smitfraud.c
*System cannot function in normal mode. Please check you security settings.
*Scan your PC with any available antivirus/spyware remover program to fix problem.'

Over this are two messages, the same wording.
Explorer.exe. application error
The application failed to initialize properly (0xc0000005).
Click on OK to terminate the application.

booting process freezes at that point, clicking Ok just makes the two screens go away, leaving the blue screen.
Tried booting in safe mode, same result
tried running XP off cd, didn't find hard disk!!

Have seen solutions to remove this trojan, but all rely on PC actually working, which mine refuses to do,
What are my options, in laymans lanquage please coz i'm not to good on the tech stuff,
Cheers

100mph · Answer

It's called W32.Desktophijack. '... Changes the desktop wallpaper to an image with one of following texts: * Warning! Your computer is infected! * Security warning A fatal error in IE has occured at 0028:C0011E36 in UXD UMM01 * 00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c * System cannot function in normal mode. Please check your security settings. * Scan your PC with any available antivirus / spyware remover program to fix this problem. ... ' Check this out: http://securityresponse.symantec.com/avcenter/venc/data/w32.desktophijack.html Good Luck!

imiller9 · Answer

Thanks for the link, however, reading it, it still appears as if i have to actually have access to the programs to run my antivirus (Mcafee).

my pc locks up at the blue screen during bootup.

I have tried safe mode windows, but the same error message appears in safe mode. I can get safe mode command prompt, but don't know what to do from there.

I have tried to open programs via task manager, and whilst i can happily open solitaire
blimey, that useful at the moment!!!) I have tried to open mcafee and nothing happens.

Can you 'talk me through' how to either get my desktop back to allow me to run mcafee or how do i run it from c:\ prompt.
Thanks
Ian

100mph · Answer

'... I have tried to open programs via task manager, and whilst i can happily open solitaire blimey, that useful at the moment!!!) I have tried to open mcafee and nothing happens ...' Did you try REGEDIT? If it works, start from step #4 of the removal instructions. If not, let us know.

imiller9 · Answer

OK, seem to be getting someware.
got into regedit, followed steps 4 onwards.
in 4/e, the values were not there,
in 4/g, the value were not there, so could not delete them.
the remaining values were all present and were deleted.
on exiting regedit and restarting pc, it again got to the woindows logon screen, pressed enter, and have now got a blank blue screen with an error window saying
"explorer.exe.application error.
The application failed to initilaize properly (0xc0000005). click ok to terminate application."

On clicking ok, window closes and left with a blank blue screen.

Ran task manager, could not work out how to run Mcafee, tried all .exe files, they someopened in background, but really want to run a virusscan. however opened MS antispyware and ran it. found one item - poss. browser hijack and it deleted it.

still getting just a blue screen and the error message window, how can i restore the desktop?
Thanks for help so far,
Ian

ky331 · Answer

there have been several alleged 'fixes' posted for this problem.... I'll point you to two of them, for you to examine and consider... however (even though I posted one as a 'service' to the community), I cannot personally vouch for either one.   One alleged fix is here: http://forums.us.dell.com/supportforums/board/message?board.id=sw_winxp&message.id=146933&view=by_date_ascending&page=2   another alleged fix is here: http://forums.us.dell.com/supportforums/board/message?board.id=si_virus&message.id=40203&query.id=344077#M40203   It's entirely possible that  one of these will work for you.... but I can't make any guarantees as to the effectivenes, NOR THE SAFETY, of either approach.   HOWEVER, since you've already done some 'tinkering', and partial-fixing, you might consider seeking personalized help from the HiJackThis forum.   (If you can't download HiJackThis on your bad machine, you can go to a good machine (at work?), download the program, and hopefully transfer it via floppy to the infected machine.)   Download the latest version of HJT(hijackthis) (version 1.99.1) from http://majorgeeks.com/download3155.html you must create a separate folder and place it there.... people commonly use C:\HJT.   Note:  Please do *NOT* use a TEMP (temporary) folder, *NOR* your DESKTOP, as HJT will be generating log files and backup files in the folder from which it is run... you risk accidentally losing these if you use a TEMP folder, and you will generate extreme clutter if you use your DESKTOP. The file above comes as a compressed .ZIP file... you have to UNzip it (hopefully, you have an UNzip utility built into your Windows Explorer.   If for any reason, you're unable to UNzip it, you can download the already-unzipped .EXE file from http://downloads.malwareremoval.com/HijackThis.exe ) After Unzipping, double click on HiJackThis.EXE Click on  Do a System Scan and Save a LogFile This will automatically open NotePad Copy the entire file from NotePad:  EDIT/SelectAll, EDIT/Copy Then go to the new forum dedicated for HiJack This logs (**NOT** back here), and  PASTE the results there: http://forums.us.dell.com/supportforums/board?board.id=si_hijack Be sure to include a detailed description of any problems/errors/warnings you are encountering. Hopefully, one of the HJT experts will get to it as quickly as possible.   WARNING:  HiJack This is a VERY POWERFUL tool.  Do *NOT* do anything else (in particular, do NOT use it to delete any entries) until you are advised to do so!!   Improper use of this tool can severely damage your system.     Please note:  The procedure as worded above has been carefully edited over time, so as to expedite the process of helping people.   Nevertheless, it seems that many individuals try to be 'creative', and make some variations.  It really would be to your benefit if you follow these directions EXACTLY as stated... because certain changes on your part can result in slowing-down the help process.  Specifically, the following are 3 very common BAD deviations which will cause delays: a)  BAD:  using an older/outdated version of HiJackThis... The experts only work with the current version.   So if you make a post with an older version, you'll simply be advised to get the latest version, re-run it, and re-post your log. b) BAD:  using a TEMP directory or your DESKTOP for HJT.... Some experts may insist you move HJT before they'll begin working with you.   Others will start the repair process, advising you to move HJT as one of the very first steps.   Failure to do so can result in losing potentially critical information.   So please,  just use the suggested  C:\HJT  directory, rather than try to be creative. c) BAD:  posting your log in the wrong forum... if you post your log back here, in the Virus/SpyWare forum, it will 'sit idly', either until the forum moderator gets around to move it for you... or until you decide to repost your log...  in the HiJackThis forum.   Message Edited by ky331 on 07-14-2005 03:23 PM

100mph · Answer

'... On clicking ok, window closes and left with a blank blue screen. ...' Did you try Safe Mode? Then at the blank screen use Task Manager to open explorer.exe

imiller9 · Answer

Thank you both for your help with this problem. 100MPH, thanks I tried safe mode and explorer.exe, but that just made the error message appear again. ky331, I tried both of the links and followed the instructions, but unfortunatly, both failed to make any difference. I took you advice and downloaded hijack this on another pc (my sons, the one who downloaded the virus in the first place. Why he didn't do it on his pc in his bedroom and not the family (the newest and most expensive) one I don't know. I have pasted the scan results on the hijack this forum and look foward to some replies.   Many thanks Ian (Liverpool, England)

ky331 · Answer

Ian, Just wanted to let you know that, even though I haven't been 'active' here, I've nevertheless been keeping an eye on your posting of your HiJackThis log in the other forum.  I don't know what happened, that Ron hasn't replied to you in the past 8 days.  He (and the other volunteers there) are often overwhelmed with the volume of logs they take on... so I'm assuming it's just an oversight.   The point being, I would NOT interpret his lack of (recent) response as indicating your problem can't be fixed.  Please be patient, and hopefully he'll be able to finish the fix with you.   for your information, the HiJackThis Log forum has its own special 'etiquette'/protocol:   once someone, such as Ron, starts working with you, none of the other 'regulars' will 'interfere' with him, unless he personally requests their assistance (or indicates that he will be away on vacation, etc.)   (some of the 'non-regulars', that aren't aware of this rule, might pop-in to offer some advice.) that's why I'm replying in this thread/forum, rather than 'breaking in' over there.

imiller9 · Answer

Obviously I am sorry, i didn't appreciate how the system works. I wasn't sure how long to leave it, and as my previous posts had been answered so quickly, i thought that maybe i had managed to completly ruin the pc, and need to reformat.

Will be patient now i know,

many thanks for the 'heads-up'

Ian

ky331 · Answer

I see that Ron has gotten back to you... that it was an oversight... apparently, he THOUGHT he had responded to your log... but apparently, he mis-directed it.

it's very RARE for a machine to be so badly ruined that a reformat is necessary. but unfortunately, many people will advise reformatting... and many people will CHOOSE to reformat, thinking it's simpler and may save them time... but the HiJackThis forum is a viable, and impressive, alternative. Some people are "lucky" enough to have their problem fixed in a matter of days. Others, with very severe infections, have unfortunately had to stick-it-out with back-and-forth communications that go on for weeks... but more often than not, they ultimately do succeed in conquering their problems.

imiller9 · Answer

Just a quick note to say that not only did Ron reply but he came through.

It was something to do with an altered wininet.dll, so i followed his instructions and it is now running as good as new,

Thanks for your help,

Cheers Ian

Virus & Spyware

Infected with Smitfraud.c, unable to boot PC, help please

Was this post helpful?