spybot update 2005-09-09

Question

now available

botzaris · Answer

ky331, do you know if they fixed the smitfraud.c bug in this update? botzaris

ky331 · Answer

botzaris: I cannot speak with any 'definitive' / 'first-hand' knowledge on this point, since SpyBot hadn't picked up on this particular problem on my machines.  All I can do is point you to the postings at the SpyBot forum, which (as of my writing this) were last updated on 23 Aug: http://forums.net-integration.net/index.php?showtopic=32278 http://forums.net-integration.net/index.php?showtopic=32658 perhaps Joe53, who i believe DID encounter this particular problem, can tell us more?  Joe, you out there?  :smileywink:

botzaris · Answer

joe53,

for the last two weeks every time i have run spybot it has reported the presence of smitfraud but it has been unable to take it out. i have run several other resident and online scans but to no avail; smitty according to spybot is still with me. what next step should i take? hijackthis? thanx for your help guys. botzaris

joe53 · Answer

Nope, no more to add to what ky331 said, and his links.

Spybot did have a false positive detection related to smitfraud in July, it was duly reported, noted by Team Spybot,
and there have been no subsequent similar reports, so I presume they fixed the problem.

ky331 · Answer

botzaris,   based on what i've seen people complain about when they say they've contracted smitfraud.c ,  i would tend to doubt you really have it, since you haven't indicated any of the 'classic' symptoms, such as your desktop and/or wallpaper changing,  and/or receiving amessage that  A fatal error in IE has occurred at 0028:C0011E36 ... for expanded details of the symptoms, see the following two webpages --- and in so doing, be advised that Smitfraud is also known as DesktopHijack:   http://securityresponse.symantec.com/avcenter/venc/data/w32.desktophijack.html   http://securityresponse.symantec.com/avcenter/venc/data/trojan.desktophijack.html   unless you find you have these syptoms, my suggestion is that you just ignore the spybot warnings.   but if you want to confirm matters, yes, you can run/post your HiJackThis log. Message Edited by ky331 on 09-11-2005 11:58 PM

joe53 · Answer

botzaris:

I just ran all my scans, including Spybot with the latest def's, and no smitfraud was detected.

If I were you, I would post a hjt logfile just to be sure, and for peace of mind. If only Spybot is
detecting this, and it is only a single detection, the odds are that it is a false positive detection.

Edit: ky331 said it quicker, and more completely, (slow typer here) but I think the message is
the same.

Message Edited by joe53 on 09-11-2005 11:19 PM

botzaris · Answer

joe53, i have just posted my hjt logfile. will keep you informed. botzaris

Virus & Spyware

spybot update 2005-09-09

Was this post helpful?