Post by: Clive on June 09, 2004, 03:10:50 AM
Post by: dpb on June 13, 2004, 10:10:16 AM
/sad.gif\' class=\'bbc_emoticon\' alt=\':(\' />
Post by: oz on June 13, 2004, 12:31:11 PM
Post by: Guest on June 13, 2004, 05:27:18 PM
i hate those [censored]ers at smart security..
at the very top of the screen, right click, it should appear as a standard option menu (compared to when right click the big black desktop..)
as you right click, select properties..
destop tab..
click the "customize destop" button at the bottom..
select the "web" tab..
an uncheck the "security" box..
and your done..i would suggest you dl some type of adware killer..
if anyone has anymore ideas, or questions, email [email protected]
Post by: kkken on June 15, 2004, 12:20:18 AM
i hate those [censored]ers at smart security..
at the very top of the screen, right click, it should appear as a standard option menu (compared to when right click the big black desktop..)
as you right click, select properties..
destop tab..
click the "customize destop" button at the bottom..
select the "web" tab..
an uncheck the "security" box..
and your done..i would suggest you dl some type of adware killer..
if anyone has anymore ideas, or questions, email [email protected][/quote]
This worked for me thanks guys
Post by: Guest on June 15, 2004, 02:22:37 AM
Post by: Guest on June 15, 2004, 02:26:17 AM
Post by: Guest on June 15, 2004, 05:30:57 PM
Has anyone any advice to offer?
Post by: MickeyP on June 15, 2004, 05:44:21 PM
Post by: calvin on June 15, 2004, 06:57:04 PM
I constantly get a winpatrol message: a change has been detected in your internet "hosts" file.
the file is full of porn crap listings
what the *** should i do?
sorry, not a computer expert
Post by: Chucky on June 15, 2004, 09:16:41 PM
Post by: BustaDyme on June 16, 2004, 08:31:46 AM
The desktop web page removal worked as well for me. Thanks. But now, my CPU usage is ALWAYS at 100% and my computer works much slower now
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> Most definately, there's some program Smarsecurity installed in our computers that's eating up all the processor power.
What do I do to resolve this???
/sad.gif\' class=\'bbc_emoticon\' alt=\':(\' />
Post by: Harold999 on June 16, 2004, 09:14:08 AM
I checked out the source of the black screen and it brought up a text file in NOTEBOOK. I checked to see where it would be SAVED AS and went and erased that file. The problem that I have now is that I have a plain background when using WINDOWS EXPLORER. I have set the home web page to be a valid one (MSN.COM) and set the background in the DISPLAY area of the CONTROL PANEL but nothing changes.
Anyone have any ideas?
Post by: Guest on June 16, 2004, 09:44:02 AM
The desktop web page removal worked as well for me. Thanks. But now, my CPU usage is ALWAYS at 100% and my computer works much slower now
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> Most definately, there's some program Smarsecurity installed in our computers that's eating up all the processor power.
What do I do to resolve this???
/sad.gif\' class=\'bbc_emoticon\' alt=\':(\' /> [/quote]I used Spybot to no avail. But I only used it once though. Well, finally, I ended up re-installing Windows XP
/sad.gif\' class=\'bbc_emoticon\' alt=\':(\' />Man! Isn't there some way we can get back at those stupid asses @ smartsecurity?
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' />
Post by: Guest on June 16, 2004, 10:01:03 AM
First the 100% processer problem. C:Windows,, look for a program called mstask2.exe REMOVE IT.
also mstask1, mstask3, and mstask4.
You may have to stop the process on mstask2.exe with a Control, Alt, Delete then second tab. (Win XP) You will see it as running 99-100%. Right click and Stop its process.
I was then able to remove it and the other three.
The info from [email protected] fixed my desktop.
Hope this helps.
Post by: Cricket on June 16, 2004, 11:40:06 AM
Post by: eto on June 16, 2004, 11:44:39 AM
Post by: Guest on June 16, 2004, 12:33:56 PM
Post by: Guest on June 16, 2004, 02:30:15 PM
Finally did a system restore to yesterday and it seems to be gone.
I hope!!!!!
Post by: Jessica on June 16, 2004, 06:49:57 PM
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> I found that it installed 4 .exe files (I have win2k, so windows dir is winnt, yours may be just windows).
winnt\seksdialer.exe
winnt\desktop.exe
winnt\system.exe
winnt\downloaded program files\load.exe
It also seemed to install winnt\system32\system32.dll, at least it had a create date as the time this f***er took over. (I was trying to help someone else debug over the phone, went to the website & it's been downhill ever since.) I checked 2 other Win2k systems and they didn't have this file, so I moved it to a floppy. Still not sure if I need it, though windows seems to run without, just without sound at the moment.
I then ran through the registry and replaced or deleted:
secure.html (on another infected pc, it was an ip, so whatever your home page is getting set to - look for that)
load.exe (this is installed into IE, like the google or yahoo toolbars, so everytime you start up IE, it loads itself again) I deleted the branch that held this file.
I didn't find the other .exe's in the registry.
Then I went to control panel -> internet options and changed the home page and deleted all files.
Then to the cookies location (varies per platform) and deleted them all.
Then I ran through Windows Updates (choose from Tools menu in IE) until there were no more CRITICAL updates. I chose to skip the rest.
Then I made sure I had the latest virus defs & scanned (nothing found).
Then I went to webroot.com & installed the trial version of Spy Sweeper & ran that.
For the most part, it seems ok, but now my sound is hosed, and the pc seems much slower.
I saw a mstask.exe as "Guest" mentioned, but I don't seem to have access to get rid of that. So off to find out where that's hiding.
I sent them a nasty message on their site. I also looked them up via whois, but of course the phone # for the contact is disconnected.
Good luck all.
Post by: Guest on June 16, 2004, 08:33:43 PM
ok i have done everything everyone here has suggested, but i can not get rid of the c:\secure. that this is a SOB. I have 3 diffrent spyware adaware virus trackers and even thou they fond a few things and cleared them up, nothing i can do will get rid of it. If any one comes up with a solution please post it in basic computer talk lol i am a computer novice!
Post by: Barry on June 16, 2004, 08:56:49 PM
First, thanks to all for their help and suggestions!
After I got rid of all the items listed above I still couldnt get a real desktop. After I replaced "Desktop.HTML" and in Control Panel/ Display/Desktop tab/Customize Desktop/ Web tab/, I found a "Security" webpage. I unchecked it and then removed it and was them able to go in and resellect a wallpaper and save my internet home page.
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' /> Hope this helps!
Post by: buffboi on June 17, 2004, 12:57:27 AM
Post by: Guest on June 17, 2004, 01:10:28 AM
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> These Smart Security Assholes appear to be based in the UK. Can we find out if they're a real company and sue the hell out of them?
If not, Ill personally give $1000 US to anyone in the UK who will kill or maim these [censored]ers... IRA or Al Qaeda are you listening?
ps, Im just joking on the last one. Don't want The Dept of Homeland Security knocking on my door
Post by: damo on June 17, 2004, 05:19:50 AM
read this through entirely before doing anything, and i'm not responsible for any damage caused etc. etc. and i'm sure that the operators of this forum don't want to be either
there are a few things i've noticed the virus/spyware do.
first the desktop was replaced by a webpage that led to www.smart-security.info apologizing that their advertisers are malicious (bs). this desktop, as long as it was enabled would open up pages to various websites every 60 seconds or so. i removed it by going to desktop properties=>web and deselecting 'security' i also deleted it (no need to keep it).
that's the desktop done, now the rest
first thing's first...write this down, save it to a text file, print it out, whatever. you may not have net access to this page in safemode. restart and when you see your hard disks being detected by bios start pushing F8 until you see the boot menu for windows. select safe mode or safe mode with networking (which may allow net access)
check the processes running and if mstasks2.exe is running, stop it.
go to the windows directory (btw i have winxp pro) and delete these files:
'system.exe','desktop.exe','seksdialer.exe','mstask2.exe','mstask1.exe','mstask3.exe','mstask4.exe','secure.html'.
notice how secure.html reappears.
now this is the trick to get rid of this [censored]...you need to have your xp cd handy... i don't know if the good old 'FCKGW' cd's will work, but guess they should.
hit the sweet ctrl+alt+del combo that has served so many times before, but usually only to close other 'not responding' microsoft programs.
find explorer.exe in the processes list and end it...your start menu should disappear.
go to file=>new task (run) and type 'cmd'
browse to d:\i386\ (where d: is your cd drive)
type in 'copy explorer.ex_ c:\windows\explorer.exe' (ex_ is not a typo and where c:\windows is the location of your INFECTED copy of explorer.exe)
the prompt will ask if you want to overwrite the file...yes you do.
thats a fresh explorer.exe and no auto changing to secure.html. you can now start up explorer again by closing the cmd prompt and going to file=>run on the task manager again. this time type 'explorer.exe'
if u have a anti-virus software, at some stage it may find a file or two it doesn't like and delete them or whatever it does. this should be ok.
boo ya
that's it...change your home page back to google or whatever it was, but remember to delete secure.html first. just in case it reinfects.
i checked the registry a thousand times trying to work the virus/spyware out, but in the end i dont think it actually uses it...just in case though, you should check for anything in the run/runservices that you dont want starting.
win xp pro sp1 (2600.xpsp2.030422-1633)
forums i posted on:
http://www.computercops.biz/postt48562.html (http://\"http://www.computercops.biz/postt48562.html\")
http://www.thetechguide.com/forum/index.ph...showtopic=10600 (http://\"http://www.thetechguide.com/forum/index.php?showtopic=10600\")
no spyware/anti-virus programs found this [censored], but we may now all sleep easy knowing we may not have to format our comps
Post by: Guest on June 17, 2004, 08:18:40 AM
If I delete the file windows>system.exe ... this isn't going to balls up my computer completely is?
Plus, my laptop came with windows XP ready installed, so I don't have the disks, how essential is the step that involves the disks?
I'm a real tech idiot, I'm a bit scared to do anything unless I mess the whole thing up!
Post by: Guest on June 17, 2004, 08:37:36 AM
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' /> what I deleted
first of all I have unchecked the security box and then deleted it from my HD after that I deleted:
mstask 1 from c:\windows
mstask 2 from c:\windows
mstask 3from c:\windows
mstask 4 from c:\windows
system.exe from c:\windows
also deleted the (smart security) contents of c:\windows\web
and finally run some ad-ware and antivirus program's (like ad-ware 6 and of course norton antivirus)
greetings cas
/wink.gif\' class=\'bbc_emoticon\' alt=\';)\' />
Post by: Guest on June 17, 2004, 08:55:07 AM
Post by: Guest on June 17, 2004, 08:59:37 AM
grr...
Post by: Cleveland St. Jacques on June 17, 2004, 01:58:51 PM
Post by: nick c on June 17, 2004, 02:18:48 PM
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' />
Post by: spencer on June 17, 2004, 05:04:47 PM
Post by: BustaDyme on June 18, 2004, 09:31:12 AM
read this through entirely before doing anything, and i'm not responsible for any damage caused etc. etc. and i'm sure that the operators of this forum don't want to be either
there are a few things i've noticed the virus/spyware do.
first the desktop was replaced by a webpage that led to www.smart-security.info apologizing that their advertisers are malicious (bs). this desktop, as long as it was enabled would open up pages to various websites every 60 seconds or so. i removed it by going to desktop properties=>web and deselecting 'security' i also deleted it (no need to keep it).
that's the desktop done, now the rest
first thing's first...write this down, save it to a text file, print it out, whatever. you may not have net access to this page in safemode. restart and when you see your hard disks being detected by bios start pushing F8 until you see the boot menu for windows. select safe mode or safe mode with networking (which may allow net access)
check the processes running and if mstasks2.exe is running, stop it.
go to the windows directory (btw i have winxp pro) and delete these files:
'system.exe','desktop.exe','seksdialer.exe','mstask2.exe','mstask1.exe','mstask3.exe','mstask4.exe','secure.html'.
notice how secure.html reappears.
now this is the trick to get rid of this [censored]...you need to have your xp cd handy... i don't know if the good old 'FCKGW' cd's will work, but guess they should.
hit the sweet ctrl+alt+del combo that has served so many times before, but usually only to close other 'not responding' microsoft programs.
find explorer.exe in the processes list and end it...your start menu should disappear.
go to file=>new task (run) and type 'cmd'
browse to d:\i386\ (where d: is your cd drive)
type in 'copy explorer.ex_ c:\windows\explorer.exe' (ex_ is not a typo and where c:\windows is the location of your INFECTED copy of explorer.exe)
the prompt will ask if you want to overwrite the file...yes you do.
thats a fresh explorer.exe and no auto changing to secure.html. you can now start up explorer again by closing the cmd prompt and going to file=>run on the task manager again. this time type 'explorer.exe'
if u have a anti-virus software, at some stage it may find a file or two it doesn't like and delete them or whatever it does. this should be ok.
boo ya
that's it...change your home page back to google or whatever it was, but remember to delete secure.html first. just in case it reinfects.
i checked the registry a thousand times trying to work the virus/spyware out, but in the end i dont think it actually uses it...just in case though, you should check for anything in the run/runservices that you dont want starting.
win xp pro sp1 (2600.xpsp2.030422-1633)
forums i posted on:
http://www.computercops.biz/postt48562.html (http://\"http://www.computercops.biz/postt48562.html\")
http://www.thetechguide.com/forum/index.ph...showtopic=10600 (http://\"http://www.thetechguide.com/forum/index.php?showtopic=10600\")
no spyware/anti-virus programs found this [censored], but we may now all sleep easy knowing we may not have to format our comps[/quote]
Ayo, I know you don't take responsability and what not, but I did just like you posted, and the end result was no explorer at all! When I restarted the computer all I got was the desktop image and that's all. No means of navigating.
Luckily I have the Win XP CD and I just reinstalled it. You sure it's explorer we got to delete?
Apart from that all your other advice was cool.
Thank you all for your assistance. This is really a new problem that we're all experiencing and apparently these guys are somehow protected so that they can't be brought to justice
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' />
Post by: Guest on June 19, 2004, 12:57:56 PM
I will never purchase anything from that sneaky company.
My best to you all...
Post by: Guest on June 19, 2004, 05:38:09 PM
Then the fukkers use something like ACTIVE DESKTOP, you can track down the files, but it will still load an blank screen or something after deleting. You have to put it OUT manually in DESKTOP SETTINGS/ACTIVE DESKTOP in Windows... good luck!
Post by: Guest on June 19, 2004, 05:38:21 PM
Then the fukkers use something like ACTIVE DESKTOP, you can track down the files, but it will still load an blank screen or something after deleting. You have to put it OUT manually in DESKTOP SETTINGS/ACTIVE DESKTOP in Windows... good luck!
Post by: Guest on June 19, 2004, 11:37:31 PM
Domain ID:D5928130-LRMS
Domain Name:SMART-SECURITY.INFO
Created On:18-May-2004 10:24:19 UTC
Last Updated On:15-Jun-2004 17:50:11 UTC
Expiration Date:18-May-2006 10:24:19 UTC
Sponsoring Registrar:R159-LRMS
Status:ACTIVE
Status:OK
Registrant ID:C4844095-LRMS
Registrant Name:Aleksandr Romantsev
Registrant Organization:Smart Security GM
Registrant Street1:Lindaal 33
Registrant City:Overijse
Registrant Postal Code:3090
Registrant Country:BE
Registrant Phone:+1.3022617417
Registrant FAX:+1.3022617417
Registrant Email:[email protected]
Admin ID:C4844095-LRMS
Admin Name:Aleksandr Romantsev
Admin Organization:Smart Security GM
Admin Street1:Lindaal 33
Admin City:Overijse
Admin Postal Code:3090
Admin Country:BE
Admin Phone:+1.3022617417
Admin Email:[email protected]
Billing ID:C4844095-LRMS
Billing Name:Aleksandr Romantsev
Billing Organization:Smart Security GM
Billing Street1:Lindaal 33
Billing City:Overijse
Billing Postal Code:3090
Billing Country:BE
Billing Phone:+1.3022617417
Billing Email:[email protected]
Tech ID:C4844095-LRMS
Tech Name:Aleksandr Romantsev
Tech Organization:Smart Security GM
Tech Street1:Lindaal 33
Tech City:Overijse
Tech Postal Code:3090
Tech Country:BE
Tech Phone:+1.3022617417
Tech Email:[email protected]
Name Server:NS1.SMART-SECURITY.INFO
Name Server:NS2.SMART-SECURITY.INFO
This is not a legitimate company, I suspect there isn't even anything to download except some more scum once you send this joker money.
-- 1 old crow
Post by: Guest on June 20, 2004, 06:55:52 PM
Has anyone any advice to offer?
HI, to solve your screen background prob, just go to Settings off the start menu and select either NVidia Nview Desktop Manager (if you have that) or to the DISPLAY options. If select Nvidia then select display settings. Select DESKTOP from either one (Nvidia or DISPLAY ) then select Customize desktop. Select the WEB folder and delete the SECURITY option that shows there and all should look normal again.[/quote]
Doesn't work for me, unfortunately. Right clicking does bring up a menu. Selecting Properties gets a window but, no Web tab, only General.
Has anyone any advice to offer?
HI, to solve your screen background prob, just go to Settings off the start menu and select either NVidia Nview Desktop Manager (if you have that) or to the DISPLAY options. If select Nvidia then select display settings. Select DESKTOP from either one (Nvidia or DISPLAY ) then select Customize desktop. Select the WEB folder and delete the SECURITY option that shows there and all should look normal again.
Post by: Boogie boy on June 21, 2004, 11:28:08 AM
Frustration aside, even with all the good advice I cannot get rid of C/secure.html and am consequently getting regularly linked to a porn web site where the girls look underage. :
Does anyone have any advice as to how to get rid of this for someone with limited understanding of computers and also how do we report the underage girl sites. The website names are virginlovers, I think, and [censored]schoolgirls which is nice.
Post by: one pissed-off dude on June 22, 2004, 02:27:32 AM
I seem to be having a diffculty that no one else here has mentioned. I have WIN Media Player 9, or rather, used to - I noticed the shortcut AND .exe both lost the original icon look and are replaced by the default 'application' icon... and whenever I try to run it, the whole thing repeats. Seksdialer returns and begins dialing, mstasks1 and all return, etc. When I was looking around after clearing it all out again - WMP9 aside, don't know what to do there - I noticed this log file... basically I saw a TON of files - loaders and such - being copied and installed. Right now I just want my music! That, and to know that I can safely run stuff w/o fearing reinfection...
Post by: Die Smart-Security Die!! on June 22, 2004, 11:26:59 AM
I ran Norton Anti Virus and I found that it downloaded a virus call Trojan.Noupdate.B. The Norton program was unable to get rid of it but there are instructions on the website as to how to do it.
here is the link with instructions to get rid of it:
http://securityresponse.symantec.com/avcen...noupdate.b.html (http://\"http://securityresponse.symantec.com/avcenter/venc/data/trojan.noupdate.b.html\")
Then I restarted on safe mode and got rid of the following files:
mstasks2.exe (if it is running, stop it)
mstasks1.exe
mstasks3.exe
mstasks4.exe
desktop.exe
system.exe
seksdialer.exe
But Most importantly look for and erase
System32.dll and any other file with similar name to it with the same time stamp
then run Hijackthis and erase all he references to the hijacker's website c//windows.secure
then look for and erase the following
secure.html (the anoying hijacking website-if you erase it before erasing system32 another copy of secure will just appear again)
and erase a notepad file called
secure32
restart your computer normally and that should get rid of the problem.
This was the most anoying eperience I had in a while of course those assholes in smartsecurity are impossible to find. There has to be a way to get back at them! Oh well I hope this post helps
Post by: p'oed on June 23, 2004, 10:20:31 AM
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> These Smart Security Assholes appear to be based in the UK. Can we find out if they're a real company and sue the hell out of them?
If not, Ill personally give $1000 US to anyone in the UK who will kill or maim these [censored]ers... IRA or Al Qaeda are you listening?
ps, Im just joking on the last one. Don't want The Dept of Homeland Security knocking on my door[/quote]
I feel you? That damn trash was killing my computer softly. But thanks to everyone hear I finally was able to rescue my computer. The persons on MS newsgroups had no answers. I was about to pay Norton or MS tech support for help!
Thanks! I will come to this site if I have any more major problems.
Post by: p'oed on June 23, 2004, 10:21:01 AM
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> These Smart Security Assholes appear to be based in the UK. Can we find out if they're a real company and sue the hell out of them?
If not, Ill personally give $1000 US to anyone in the UK who will kill or maim these [censored]ers... IRA or Al Qaeda are you listening?
ps, Im just joking on the last one. Don't want The Dept of Homeland Security knocking on my door[/quote]
I feel you? That damn trash was killing my computer softly. But thanks to everyone hear I finally was able to rescue my computer. The persons on MS newsgroups had no answers. I was about to pay Norton or MS tech support for help!
Thanks! I will come to this site if I have any more major problems.
Post by: patrick on June 23, 2004, 11:57:36 AM
/rolleyes.gif\' class=\'bbc_emoticon\' alt=\':rolleyes:\' /> What a pain in the butt!!! I finally got rid of it but it came back when I used the windows media player to open a file off the net.
I noticed that the smartsecurity software seems to load after notification from Norton Anti_Virus detects something called "bloodhound".
I restored the media player to it's original configuration, then went to windows update and re-installed media player 9. Hopefully, that issue is resolved. I will post again if that doesn't solve the problem.
Thanks to everyone for the assistance on this monster smartsecurity. I hope it's gone for good.
Post by: BK on June 23, 2004, 04:19:02 PM
My computer (Windows XP) downloaded this nasty thing June 19 or so. I've deleted all the files fore mentioned, and restored my computer to an earlier time. Thinking, that I've gotten rid of this crap. My desktop is back to normal, and my homepage is set to my prefered default. However, I keep getting tons of pop-ups, which I don't recall being there before. Some are adverstisments and others are porn-related, and others are 'Your computer may be infected with spyware!' types. Anyone else having this problem? Is there something I possibly could have missed?
Post by: CompleteTranslations.com on June 23, 2004, 07:38:13 PM
I ran Norton Anti Virus and I found that it downloaded a virus call Trojan.Noupdate.B. The Norton program was unable to get rid of it but there are instructions on the website as to how to do it.
here is the link with instructions to get rid of it:
http://securityresponse.symantec.com/avcen...noupdate.b.html (http://\"http://securityresponse.symantec.com/avcenter/venc/data/trojan.noupdate.b.html\")
Then I restarted on safe mode and got rid of the following files:
mstasks2.exe (if it is running, stop it)
mstasks1.exe
mstasks3.exe
mstasks4.exe
desktop.exe
system.exe
seksdialer.exe
But Most importantly look for and erase
System32.dll and any other file with similar name to it with the same time stamp
then run Hijackthis and erase all he references to the hijacker's website c//windows.secure
then look for and erase the following
secure.html (the anoying hijacking website-if you erase it before erasing system32 another copy of secure will just appear again)
and erase a notepad file called
secure32
restart your computer normally and that should get rid of the problem.
This was the most anoying eperience I had in a while of course those assholes in smartsecurity are impossible to find. There has to be a way to get back at them! Oh well I hope this post helps[/quote]
I know who these people are.
It is a guy in Belgium.
Want his phone number and address?
Just go to www.internic.net and do a whois on his URL
I hope you do not mind but I have gotten a lot of calls on this problem and I am going to post the fix for it on my web site's forum (with a link to your forum as well)
My web site is CompleteTranslations.com
and hopefully I will put it in other languages soon.
Post by: Guest on June 24, 2004, 05:37:20 AM
Spybot did not get it for me. But I think I am clean now.
/blink.gif\' class=\'bbc_emoticon\' alt=\':blink:\' />
Post by: kostas on June 27, 2004, 06:19:42 AM
Instead your desktop you see nasty black picture and your start page changes. I think in my case a bit different. But one thing is true this is trojan. What I did.
At first, delete all content in temporal intenet folder (there exist some maliciuos *.exe file and other mess)
Second, Start/Control Panel/Display/Desktop/Customize Desktop/Web and in Web page window delete "Security".
Third, C/Windows/Web and delete all nasty pictures (about 12).
Then run antivirus (in my case Norton) or other special application to find trojan and remove one away.
Succesion could be various. Most important that you know the reason.
In my case I did not find
mstasks2.exe
mstasks1.exe
mstasks3.exe
mstasks4.exe
desktop.exe
system.exe
seksdialer.exe
or other, may be this scum like a variety.
Post by: frenziedfreak on June 27, 2004, 08:21:18 AM
First to remove the desktop image...follow as mentioned by "guest". It works.
For PC running slow, do the following
1. Reboot your machine in save mode , (Press f8 when starting machine)
2. Press CTRL+ALT+DEL and see if there is any process "mstask2.exe" is running. If it is running stop it
3. Go to c:\windows and remove the following files
- system.exe
-desktop.exe
-seksdialer.exe
-mstasks1.exe
-mstasks2.exe
-mstasks3.exe
-mstasks4.exe
restart the machine in normal mode. Hope this helps. It works for me...
Dont know how these f..kers are born in this world...
Post by: am on June 27, 2004, 02:24:16 PM
there is a file called wintime.exe that automatically starts up when the machine boots up. search for it in the windows directory and delete it.
also delete the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "WinTime" = C:\WINDOWS\system32\wintime.exe
also search and delete the file dl.html from your harddrive.
refer to
http://uk.mcafee.com/virusInfo/default.asp...&virus_k=126205 (http://\"http://uk.mcafee.com/virusInfo/default.asp?id=description&virus_k=126205\")
for details
Post by: am on June 27, 2004, 02:42:35 PM
http://securityresponse.symantec.com/avcen...tartpage.e.html (http://\"http://securityresponse.symantec.com/avcenter/venc/data/trojan.startpage.e.html\")
for details
Post by: THAT THING WORKed for the deskto on June 27, 2004, 09:04:25 PM
/ph34r.gif\' class=\'bbc_emoticon\' alt=\':ph34r:\' /> [/size][/color][/font]
Post by: Die Smart-Security Die!! on July 06, 2004, 01:44:35 AM
You need to run Norton Antivirus on the Windows Media Player, this is where the main file is hidden (I think) is called "downloader" This one installs all the nonsense that affects the computer. Once the Anti Virus Detects this file it will quarantine it and then you may erase it manually. That is the last I heard of Smart-Security. Man I hate those assholes.
Post by: vinnysmiff on July 07, 2004, 03:16:33 AM
Post by: Guest on July 07, 2004, 04:53:17 PM
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' /> thanks you guy's are life savers im just a teen ,and im pretty nifty with a computer but i couldnt figure out how to get that black screen off my desktopthanks alot
Post by: Anakin4711 on July 08, 2004, 03:04:16 AM
I made an systemrecovery from yesterday and it worked .
I got rid of the dirty programm.
/wink.gif\' class=\'bbc_emoticon\' alt=\';)\' />
Post by: Luupi on July 13, 2004, 11:51:28 AM
So ... HELP!
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' />
Post by: Guest on July 13, 2004, 11:55:03 AM
/dry.gif\' class=\'bbc_emoticon\' alt=\'<_<\' />
Post by: Al Orfi on August 10, 2004, 03:56:24 PM
http://www.smart-security.info/removal.html (http://\"http://www.smart-security.info/removal.html\")
If that doesn't work, I also found another way to do it. Anyone who needs help can email me at [email protected]. Good Samaritans helped me so I'm happy to return the favor to someone else.
Post by: jazzsyx on August 10, 2004, 04:03:21 PM
Post by: Guest on August 10, 2004, 08:21:35 PM
i hate those [censored]ers at smart security..
at the very top of the screen, right click, it should appear as a standard option menu (compared to when right click the big black desktop..)
as you right click, select properties..
destop tab..
click the "customize destop" button at the bottom..
select the "web" tab..
an uncheck the "security" box..
and your done..i would suggest you dl some type of adware killer..
if anyone has anymore ideas, or questions, email [email protected][/quote]
thank you so much. those bastards really suck!!!!!!
Post by: Toby on August 13, 2004, 04:05:44 AM
it worked for me. I agree that who ever the suckers are for doing this
needs to have to answer to everyone of us who have had to go thru this,
and at least for me, the anxioty, and yet, not for doing anything wrong. For
the anxioty alone, they need to be sued.... anyway, the best to us all.
Post by: Guest on August 16, 2004, 11:59:42 PM
Great Job
Post by: Guest_Steve on August 22, 2004, 04:40:48 AM
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' />
Post by: ben on September 10, 2004, 01:54:09 AM
Post by: Guest on October 06, 2004, 10:43:00 AM
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' />
Post by: Guest on October 11, 2004, 10:24:16 PM
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> I found that it installed 4 .exe files (I have win2k, so windows dir is winnt, yours may be just windows).
winnt\seksdialer.exe
winnt\desktop.exe
winnt\system.exe
winnt\downloaded program files\load.exe
It also seemed to install winnt\system32\system32.dll, at least it had a create date as the time this f***er took over. (I was trying to help someone else debug over the phone, went to the website & it's been downhill ever since.) I checked 2 other Win2k systems and they didn't have this file, so I moved it to a floppy. Still not sure if I need it, though windows seems to run without, just without sound at the moment.
I then ran through the registry and replaced or deleted:
secure.html (on another infected pc, it was an ip, so whatever your home page is getting set to - look for that)
load.exe (this is installed into IE, like the google or yahoo toolbars, so everytime you start up IE, it loads itself again) I deleted the branch that held this file.
I didn't find the other .exe's in the registry.
Then I went to control panel -> internet options and changed the home page and deleted all files.
Then to the cookies location (varies per platform) and deleted them all.
Then I ran through Windows Updates (choose from Tools menu in IE) until there were no more CRITICAL updates. I chose to skip the rest.
Then I made sure I had the latest virus defs & scanned (nothing found).
Then I went to webroot.com & installed the trial version of <a href="spy%20sweeper" onmouseover="window.status='Spy Sweeper'; return true;" onmouseout="window.status=''; return true;">Spy Sweeper</a> & ran that.
For the most part, it seems ok, but now my sound is hosed, and the pc seems much slower.
I saw a mstask.exe as "Guest" mentioned, but I don't seem to have access to get rid of that. So off to find out where that's hiding.
I sent them a nasty message on their site. I also looked them up via whois, but of course the phone # for the contact is disconnected.
Good luck all.[/quote]
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> The info Jessica notes is helpful---and if you could note their web address as I will send them a nasty gram as well----I wish I could find an address for these fellows----I would visit them personally-------which would be a bad day for them.
Signed---avid emailer and former Marine Recon 2nd Lt.------served in Somalia and would like to use some of my little tricks on them personally.
Post by: Rob on October 18, 2004, 05:50:36 PM
Post by: Guest on October 18, 2004, 08:38:16 PM
Dee
Post by: Young on October 22, 2004, 11:18:00 PM
/tongue.gif\' class=\'bbc_emoticon\' alt=\':P\' />
Post by: MAD on October 29, 2004, 05:10:54 AM
C:\soft.exe
C:\sysmap.exe
C:\WINDOWS\system32\Mon.exe
C:\WINDOWS\system32\egdi32.exe
The added desktop was removed with:
C:\soft.exe /r
Hope it will be useful.
Post by: http://www.neu-net.com on October 30, 2004, 09:38:22 PM
Domain Name:SMART-SECURITY.INFO
Created On:18-May-2004 10:24:19 UTC
Last Updated On:15-Jun-2004 17:50:11 UTC
Expiration Date:18-May-2006 10:24:19 UTC
Sponsoring Registrar:R159-LRMS
Status:ACTIVE
Status:OK
Registrant ID:C4844095-LRMS
Registrant Name:Aleksandr Romantsev
Registrant Organization:Smart Security GM
Registrant Street1:Lindaal 33
Registrant City:Overijse
Registrant Postal Code:3090
Registrant Country:BE
Registrant Phone:+1.3022617417
Registrant FAX:+1.3022617417
Registrant Email:[email protected]
Admin ID:C4844095-LRMS
Admin Name:Aleksandr Romantsev
Admin Organization:Smart Security GM
Admin Street1:Lindaal 33
Admin City:Overijse
Admin Postal Code:3090
Admin Country:BE
Admin Phone:+1.3022617417
Admin Email:[email protected]
Billing ID:C4844095-LRMS
Billing Name:Aleksandr Romantsev
Billing Organization:Smart Security GM
Billing Street1:Lindaal 33
Billing City:Overijse
Billing Postal Code:3090
Billing Country:BE
Billing Phone:+1.3022617417
Billing Email:[email protected]
Tech ID:C4844095-LRMS
Tech Name:Aleksandr Romantsev
Tech Organization:Smart Security GM
Tech Street1:Lindaal 33
Tech City:Overijse
Tech Postal Code:3090
Tech Country:BE
Tech Phone:+1.3022617417
Tech Email:[email protected]
Name Server:NS1.SMART-SECURITY.INFO
Name Server:NS2.SMART-SECURITY.INFO
Post by: Roydha on November 01, 2004, 04:00:52 PM
http://www.smart-security.info/removal.html (http://\"http://www.smart-security.info/removal.html\")
If that doesn't work, I also found another way to do it. Anyone who needs help can email me at [email protected]. Good Samaritans helped me so I'm happy to return the favor to someone else.[/quote]
This worked great for me thanks you're a life saver
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' />
Post by: Guest on November 03, 2004, 02:43:21 PM
i hate those [censored]ers at smart security..
at the very top of the screen, right click, it should appear as a standard option menu (compared to when right click the big black desktop..)
as you right click, select properties..
destop tab..
click the "customize destop" button at the bottom..
select the "web" tab..
an uncheck the "security" box..
and your done..i would suggest you dl some type of adware killer..
if anyone has anymore ideas, or questions, email [email protected][/quote]
This worked for me thanks guys [/quote]
Thanx!! it worked for me also. I had XP-PRO installed with SP2,Norton AV,Spy-Begone and Spy Pop UP as well as Ad-Aware installed. The Bastards got past ALL of them. Harry
Post by: ecyta on November 04, 2004, 01:19:01 AM
Post by: Guest on November 04, 2004, 02:53:33 AM
I know who my next seach Engine will be....
Post by: Guest_Steve on November 04, 2004, 09:30:33 AM
Thank you all for your your input on smartsecurity. I was infected by those bastards yesterday and used your comments to get out of the jamb. How do we go about a class-action against them? Perhaps a public lenching would be more appropriate and deserving?
BTW, for those of you with XP, follow these slightly modified (clarified) instructions:
1. Hit "Start"
2. Choose "Control Panel
3. Choose "Display"
4. Choose "Customize Desktop"
5. Choose "Web" (Tab)
6. Uncheck the "Security" box
7. Hit "OK"
You are finished and your screen should be back to normal.
Dont know about the "slow down" issues yet but have a feeling I might soon!
Thanks again!
Post by: notzrus on November 04, 2004, 01:13:12 PM
here is their website
Post by: Guest on November 04, 2004, 08:54:41 PM
If you right click on the top of your screen and dont get the needed option then goto control panel,under display,goto desktop, click on customize settings and unclick security
Post by: dave on November 05, 2004, 03:10:03 PM
Has anyone any advice to offer?[/quote]
the message posted by freehelp guest was right and if you can not right click on desktop then go to "control panel" "diplay"or try moving your start menu either way from there you can get to your "desktop" tab and then "customise desktop" then "web" and finally delete the web page from smart security but be warned you do get all kinds of goodies from these guys as well as a [censored]ty desktop. If anyone still cannot get it to go away email me at wtz137Email Removed
Post by: Tygmannen on November 08, 2004, 06:22:02 AM
http://www.smart-security.info/removal.html (http://\"http://www.smart-security.info/removal.html\")
But i will sweep my computer for spyware anyway, i do not trust smartSecurity to clean everything they left behind...
I'm amazed that a company that defines them selfs as "Smart" would do something so stupid as to use spyware to infect computers and force users to buy there product.
Do the really think we are so dumb that we will fall for that?
/blink.gif\' class=\'bbc_emoticon\' alt=\':blink:\' />
Post by: cag on November 09, 2004, 04:08:19 AM
Post by: Miramar on November 10, 2004, 02:02:31 AM
Bande d'enfoirés, de pourris et d'enculés qui prennent les PC en otage moyennant rétribution pour un logiciel......
Smartsecurity vous êtes à chier
/ph34r.gif\' class=\'bbc_emoticon\' alt=\':ph34r:\' /> /ph34r.gif\' class=\'bbc_emoticon\' alt=\':ph34r:\' /> /ph34r.gif\' class=\'bbc_emoticon\' alt=\':ph34r:\' />
Post by: Guest on November 10, 2004, 03:37:52 PM
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' /> /biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' /> thank you it worked on my computor! One should nail this kind of adds - if possible sue them!!
Post by: Guest on November 10, 2004, 09:48:01 PM
Post by: Guest on November 11, 2004, 11:14:26 AM
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> [censored] these bastards .They make me insane .Go to hell all with this tool BLET !!!
Post by: [email protected] on November 12, 2004, 09:41:37 AM
Post by: Guest_Mark on November 12, 2004, 12:40:12 PM
/dry.gif\' class=\'bbc_emoticon\' alt=\'<_<\' /> I also was hit by this evil virus. However, I think that I got rid of it. However, now when I start my computer, a box comes up with this message:
C:\\WINDOWS\SYSTEM32\services\ir.exe
(Big X in a red circle) "Windows cannot find `C:\WINDOWS\System32\services\ir.exe'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search."
(What I don't understand is that I haven't searched for this file. I mean, I'm just starting the computer so how could I have searched for it.)
After I click OK, another box comes up immediately with this message:
DESKTOP
(! in a yellow triangle) "Could not load or run `C:\WINDOWS\System32\services'ir.exe' specified in the registry. Make sure the file exists on your computer or remove the reference to it in the registry."
After I click OK on that box my computer finishes starting up. The computer seems to run alright afterward.
I'm hoping that in my fevor to get rid of the virus, I didn't remove something necessary to the running of my computer. Either way, I'd like to stop these boxes from coming up each time I start my computer.
Also, in the second box, what or where is the "registry." I suppose I could "remove the reference" in the registry, but a) I don't know where it is and
/cool.gif\' class=\'bbc_emoticon\' alt=\'B)\' /> I don't want to damage my software.Thanks in advance for any suggestions.
Mark
Post by: Micky on November 13, 2004, 12:46:36 AM
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' /> Thanks You Guys!! I took the advice of cricket, jessica and guest and my own little know how, and guess what it worked. [censored] that [censored]!
Post by: David on November 13, 2004, 09:00:06 AM
Post by: DenDen on November 14, 2004, 07:11:43 PM
/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' /> Thank You -- It worked great. It could not be removed by Spybot or Ad-Aware SE Personal. Is the reason because they are both free programs? Is there a program that would have removed it?
Post by: KP on November 14, 2004, 10:46:19 PM
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> Take care.
KP
Post by: Reille on November 15, 2004, 08:05:34 PM
Post by: Guest on November 16, 2004, 01:25:54 PM
Post by: Dave on November 17, 2004, 02:49:27 PM
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' /> To remove the Smartsecurity screen pest go to this site, http://www.smart-security.info/removal.html and download the tool that they have placed there.It worked for me!
Post by: Guest on November 19, 2004, 06:09:35 PM
Post by: gofoth on November 22, 2004, 09:56:43 AM
Post by: Fraz on November 22, 2004, 05:31:42 PM
/tongue.gif\' class=\'bbc_emoticon\' alt=\':P\' /> /tongue.gif\' class=\'bbc_emoticon\' alt=\':P\' />
Post by: Glenn on November 22, 2004, 05:34:17 PM
At this point, with all your accumulated experience on this, do you think I can just leave it alone? (My system doesn't seemed to have slowed down, and my cpu usage is low). Or is Smart Security monitoring everything I do online? Any of the spyware programs that can take care of it? (btw, Mcafee VirusScan didn't pick it up).
Thanks, and my admiration to all of you who (a) worked so hard to figure this ugliness out and (
/cool.gif\' class=\'bbc_emoticon\' alt=\'B)\' /> are planning appropriate vengeance on Smart Security.Glenn
Post by: Guest on November 22, 2004, 09:17:12 PM
http://www.smart-security.info/removal.html (http://\"http://www.smart-security.info/removal.html\")
You can also go to a great page and run this test. It will help you stop it from happening again.
http://www.jasons-toolbox.com/BrowserSecurity/ (http://\"http://www.jasons-toolbox.com/BrowserSecurity/\")
You also might want to read this. It's where I started and it helped me to understand the problem.
http://computercops.biz/postt7736.html (http://\"http://computercops.biz/postt7736.html\")
Good luck all,
Jim Spokane,WA.
Post by: Guest on November 22, 2004, 09:18:48 PM
Keep up the good work TTG !
Jim H.
Spokane, WA.
Post by: Guest on November 23, 2004, 03:48:31 PM
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' /> .
Post by: oak on November 25, 2004, 10:10:52 AM
Post by: LL on November 27, 2004, 10:25:41 AM
Check it out Here (http://\"http://www.freepalms.com/index.php?AFFID=4778\")
Post by: Guest on November 27, 2004, 02:07:55 PM
Those F**** had stolen from me 100$ from my E-Gold!!!!!
I got the IP of that man.. 213.201.38.171
who can help me to do somthing??
Post by: The duke on November 28, 2004, 04:20:46 AM
the ip adress for the site is 213.159.117.130 so if anyone runs into that some how STAY AWAY this thing got all over my computer, does anyone know whether this is a virus or not?
i wanna kick the [censored] outta these guys
Post by: norton on November 29, 2004, 10:22:42 PM
i tried many ways to remove it, but it keeps coming back after i restart my computer. i will come out after norton detected and deleted the downloader.trojan.
any other sollution???
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' />
Post by: lolo on December 01, 2004, 01:07:57 AM
Post by: jgbarbeau on December 01, 2004, 10:30:05 PM
Smart Security was trying my patience!
Post by: Mario B. on December 02, 2004, 02:26:39 AM
Post by: MC on December 05, 2004, 11:56:56 AM
http://computercops.biz/postt7736.html (http://\"http://computercops.biz/postt7736.html\")
Good luck all,
Jim Spokane,WA.[/quote]
I went to the computercops site and installed SPYWARE BLASTER. I then ended up with non stop pop ups about spyware, which replaced whatever page I was looking at at the time. It also tried connecting with the internet every 5 mins
..................................
Problems like this are really winding me up. Why should we have to buy expensive software to stop it.
MC
ps does anyone know if I can change Windows XP from Danish to English easily. Again, I do not want to have to pay a fortune.
Post by: patgb on December 09, 2004, 01:58:23 PM
/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />
Post by: B|G on December 11, 2004, 09:57:38 AM
I got it on my comp and it completely made me crazy. No worries, i the background and some other stuff fixed, thanks to my buddy and the people at techguide, but now i get all of these popups and i found em to be from the following
WintoolsA (a few more like these but with A changed to other letters)
PIB
TBIS
my winpatrol scanner picks it up but everytime i disable/remove it it always comes back. i have 3 other spyware removal programs and none of them seem to be fixing the probelm. If anyone has an answer i would be more than thankful. I'm running XP windows and unfortunately cannot find my XP CD. otherwise i would have gotten rid of this sooner.
Thank you in advance
B|G
P.S on page 3 of this forum one of the good samaritans has posted this mofo's billing info. any good ideas what to send him ?
Post by: Unregistered on December 11, 2004, 04:46:08 PM
In IE go to tools > internet net options > content
Enable content advisor & select a password
select "approved sites" tab
enter the websites for this damn trojan/virus/spyware/whater & select "never"
This will keep your web browser from going to their sites & then you can work on getting rid of it. I haven't completely gotten rid of it, but am on my way.
Their websites:
213.159.117.134
213.159.117.150
213.159.117.150/index.pnp
Post by: destoyer on December 12, 2004, 04:10:43 PM
Post by: Jason on December 14, 2004, 07:20:21 PM
Post by: Guest on December 15, 2004, 11:12:36 AM
i tried many ways to remove it, but it keeps coming back after i restart my computer. i will come out after norton detected and deleted the downloader.trojan.
any other sollution???
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' />[/quote]this screen has been black too long i tried everythiing please help me
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> /mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> /mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' />
Post by: jzj on December 23, 2004, 08:06:32 PM
/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />[/quote]the same [censored] happened to me man please can somebody help me email me at jzjy2kEmail Removed
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> /mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> /mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> /mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> /mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' />
Post by: guestolo on December 24, 2004, 12:38:41 AM
Post by: Rachel on December 26, 2004, 01:30:21 PM
Can anyone help me??
Post by: guestolo on December 26, 2004, 01:36:14 PM
Post by: grrr on December 29, 2004, 10:53:19 PM
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' />
Post by: Guest_guest on December 30, 2004, 03:11:50 PM
Post by: Guest on January 02, 2005, 02:36:42 PM
Thankyou to everyone involved in this thread - I got hit today (2nd Jan 05!) and this was the only help available.
Gee... this scum at SmartSecurity have certainly put together the single worst computer virus problem I have ever dealt with. If i ever get hold of the guy responsible I'm going to stick three poles up his arse and open him up like a teepee.
Thank You All!
Post by: Guest on January 03, 2005, 02:22:05 PM
Frankly the amount of time that I spend cleaning all this crap of my puter is enormous. It is the biggest form of terrorism impacting american business today and that is how it should be addressed.
I would love five minutes ina back alley with any of the writers of this virus' - only one of us would be walking away!!!
Lets make it legal to kill spammers!!!!!!!!!!!!!!!!
Post by: Michael on January 04, 2005, 01:12:23 PM
I removed 'desktop.html' straight away, changed my background to a normal screen(unclicking 'Security').
I unfortunately can't find any mstasks2.exe , mstasks.exe, mstasks3.exe or mstasks4.exe . I'm going to make the change to the '0' text document. I also can't find a notepad file called secure32 or system32.dll , have they changed the file names?
I haven't got Norton Anti-Virus but Im hoping with a swift scan from this baby I should be able to finally get rid of the Trojan. There's still no indication that its there but I've got a feeling it is.
I will check the folder 'winnt' also, but my os is XP , where would I find the files : seksdialer.exe, desktop.exe, system.exe, load.exe,
How do I check the registry ?
Please please please help!!!
Post by: Guest_Lauren on January 11, 2005, 06:53:34 AM
what should I get rid of from my highjackthis scan....
Logfile of HijackThis v1.99.0
Scan saved at 2:45:59 AM, on 1/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\System32\kernels32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\AOL\110474~1\EE\AOLHOS~1.EXE
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\PROGRA~1\COMMON~1\AOL\110474~1\EE\AOLServiceHost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WebSiteViewer\125209.dlr
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Snuggles\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Snuggles\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Snuggles\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Snuggles\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Snuggles\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Snuggles\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Snuggles\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
O1 - Hosts: 127.0.0.3 www.iframedollars.biz
O1 - Hosts: 127.0.0.3 iframedollars.biz
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 iframe.biz
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.autoescrowpay.com
O1 - Hosts: 127.0.0.3 x.full-tgp.net
O1 - Hosts: 127.0.0.3 counter.sexmaniack.com
O1 - Hosts: 127.0.0.3 autoescrowpay.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4AF3A5A2-670A-46E4-BAFB-9D9BF658F75F} - C:\WINDOWS\System32\jnfi.dll
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1104745260\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AOL Fast Start] "C:\PROGRA~1\AMERIC~1.0\Email RemovedEXE" -b
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab (http://\"http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab\")
O18 - Filter: text/html - {3A8D399B-F35A-430A-BD84-116E65D3CD2F} - C:\WINDOWS\System32\jnfi.dll
O18 - Filter: text/plain - {3A8D399B-F35A-430A-BD84-116E65D3CD2F} - C:\WINDOWS\System32\jnfi.dll
O23 - Service: AOL Connectivity Service - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
Post by: horefrost on January 11, 2005, 08:04:50 PM
Thanks again!!!!
Post by: bobby on January 11, 2005, 08:36:35 PM
I've been on this site for a week now. I've deleted the same files so damn many times I could puke. I went to their site [ http://www.smart-security.info/removal.html (http://\"http://www.smart-security.info/removal.html\") ] and got their "fix" four times and of course got nothing done. I've read over the posts from you guys/gals so many times, I feel like I should send out birthday cards or something.
So...
I've got an Inspiron 1100 laptop
windows XP
black screen [temp removal thru the 'right click at the top' method]
"! protect your data" icon on desktop
blah, blah, blah [same [censored] as everybody else]
ad-aware se personal
17 smart/full scans later, the only thing I've gotten done is the removal of the "TEEN [censored] PICS" icon that came up with the S.S. bs.
Any other ideas would be greatly appreciated, and thanks to the website for being available and to all those who contributed.
Bobby
Post by: guestolo on January 11, 2005, 09:01:04 PM
Simply click on this THIS LINK (http://\"http://www.thetechguide.com/forum/index.php?showforum=4\")
And then click the START NEW near the top
Can you also redownload Hijackthis and save it to a permanent folder
C:\Documents and Settings\Snuggles\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
That tells me you just opened the zipped file or didn't save it to a permanent folder
Create a permanent folder
EG....Double Click "MY Computer"
Open your C: drive
Click "File" >>> "New" >>>> "Folder"
A new folder will be created, name it HJT
Now you will have C:\HJT
Anything removed will make backups, the backups will be lost if you clear your temp folders
You can redownload hijackthis from my signature below........
Post by: jojo on January 12, 2005, 04:10:09 PM
And I hope a place in hell for smart serciuty!!!!!!!!!!!!!
It was driving me crazy!
How are we going to report them?
Post by: Guest_Paul on January 12, 2005, 07:20:22 PM
pjz037Email Removed
Post by: John W on January 16, 2005, 06:54:35 PM
Norton Virus Software and Spyware and neither can get rid of this crap.
I Will try some of the suggestions from the postings here and hope they work.
Post by: Guest on January 17, 2005, 05:45:17 AM
Post by: Guest on January 23, 2005, 11:19:11 AM
A whole PC screwed up in 10 seconds.
I did a brute force cleaning with CWS, Hijackthis, adaware, Trendmicro... all at the same time. Done this 3 times and everything is clean now ( i hope so ).
Please do me a favour and wish those assholes a painfull dead on
http://www.smart-security.info/feedback.php?a=1 (http://\"http://www.smart-security.info/feedback.php?a=1\")
Post by: kkbrown on January 24, 2005, 12:30:56 AM
i hate those [censored]ers at smart security..
at the very top of the screen, right click, it should appear as a standard option menu (compared to when right click the big black desktop..)
as you right click, select properties..
destop tab..
click the "customize destop" button at the bottom..
select the "web" tab..
an uncheck the "security" box..
and your done..i would suggest you dl some type of adware killer..
if anyone has anymore ideas, or questions, email [email protected][/quote]
YOU ARE THE MAN, This damn thing had me up all night, At least I got my drives squeaky clean.
Thanks Dude
Post by: Guest_tom_* on January 31, 2005, 05:50:30 PM
Post by: guestolo on January 31, 2005, 05:57:10 PM
If you need a hand removing this from your system
Can you do what I asked from Lauren above
Simply click on this THIS LINK (http://\"http://www.thetechguide.com/forum/index.php?showforum=4\")
And then start a NEW TOPIC
near the top
Include a Hijackthis log
Can you Download Hijackthis 1.99
A small utility to help identify if any Hijackers, Malware, Spyware, etc.....Reside on your computer
Important: Create a Permanent folder for Hijackthis
Double Click "MY Computer"
Open your C: drive
Click "File" >>> "New" >>>> "Folder"
A new folder will be created, name it HJT
Now you will have C:\HJT
Download Hijackthis from CLICK HERE (http://\"https://ssl.perfora.net/tools.radiosplace.com/HijackThis.exe\") or CLICK HERE (http://\"http://aumha.org/downloads/hijackthis.exe\")
Save it to that new folder
Do a SCAN and Save a Log file---Save the log----copy and paste the WHOLE contents of the log here... Don't try and fix anything yet----It is all important
DO NOT post the log in this thread
It is get confusing to post in this long thread
Post by: Geust on February 06, 2005, 02:39:00 PM
/sad.gif\' class=\'bbc_emoticon\' alt=\':(\' />. HELP ME!
Post by: Guest on March 05, 2005, 12:03:01 PM
Post by: Annoyed on March 18, 2005, 10:13:22 AM
Quote
at the very top of the screen, right click, it should appear as a standard option menu (compared to when right click the big black desktop..)
as you right click, select properties..
destop tab..
click the "customize destop" button at the bottom..
select the "web" tab..
an uncheck the "security" box..
I tried this, but there IS NO items called "security" precent... what am i supposed to do, i have looked for all the files listed here but none of those can be found on my computer, i have tried everything and can't get rid of it....
Post by: Michal126 on March 19, 2005, 09:08:59 AM
my log file is below
Logfile of HijackThis v1.99.1
Scan saved at 14:45:55, on 2005-03-19
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\logonui.exe
E:\WINDOWS\system32\spoolsv.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
E:\WINDOWS\System32\ntddetect.exe
E:\WINDOWS\System32\Ekk.exe
E:\WINDOWS\System32\ctfmon.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Spyware Doctor\swdoctor.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\WINDOWS\System32\notepad.exe
E:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.ht...count_id=138770 (http://\"http://www.couldnotfind.com/search_page.html?&account_id=138770\")
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *new-search.net*;*x-google.net*
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O1 - Hosts file is located at: E:\WINDOWS\nsdb\hosts
O1 - Hosts: 82.179.166.192 new-search.net
O1 - Hosts: 82.179.166.190 x-google.net
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - E:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - E:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [Qum] E:\WINDOWS\Bop.exe
O4 - HKLM\..\Run: [ntddetect] E:\WINDOWS\System32\ntddetect.exe
O4 - HKLM\..\Run: [Vrn] E:\WINDOWS\System32\Ekk.exe
O4 - HKLM\..\Run: [Ssg] E:\WINDOWS\System32\Dcg.exe
O4 - HKLM\..\Run: [Gfi] E:\WINDOWS\System32\Cgr.exe
O4 - HKLM\..\Run: [Vli] E:\WINDOWS\Mtt.exe
O4 - HKLM\..\Run: [Mib] E:\WINDOWS\System32\Mpc.exe
O4 - HKLM\..\Run: [Dhb] E:\WINDOWS\Ont.exe
O4 - HKLM\..\Run: [Eml] E:\WINDOWS\Drk.exe
O4 - HKLM\..\Run: [Tkr] E:\WINDOWS\System32\Tbr.exe
O4 - HKLM\..\RunServices: [ntddetect] E:\WINDOWS\System32\ntddetect.exe
O4 - HKLM\..\RunOnce: [VcCleanUp.exe] E:\DOCUME~1\Michal\USTAWI~1\Temp\VcCleanUp.exe /F E:\PROGRA~1\COMMON~1\SYMANT~1\LiveReg\ /RemoveAll
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NBJ] "E:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "E:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Qum] E:\WINDOWS\Bop.exe
O4 - HKCU\..\Run: [ntddetect] E:\WINDOWS\System32\ntddetect.exe
O4 - HKCU\..\Run: [Vrn] E:\WINDOWS\System32\Ekk.exe
O4 - HKCU\..\Run: [Ssg] E:\WINDOWS\System32\Dcg.exe
O4 - HKCU\..\Run: [Gfi] E:\WINDOWS\System32\Cgr.exe
O4 - HKCU\..\Run: [Vli] E:\WINDOWS\Mtt.exe
O4 - HKCU\..\Run: [Mib] E:\WINDOWS\System32\Mpc.exe
O4 - HKCU\..\Run: [Dhb] E:\WINDOWS\Ont.exe
O4 - HKCU\..\Run: [Eml] E:\WINDOWS\Drk.exe
O4 - HKCU\..\Run: [Tkr] E:\WINDOWS\System32\Tbr.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - E:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.166.145/x15.chm::/trs15.exe
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} - http://www.spywarestormer.com/files2/Install.cab (http://\"http://www.spywarestormer.com/files2/Install.cab\")
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwa...ash/swflash.cab (http://\"https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab\")
O16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/es/SysWebTelecom.cab (http://\"http://www.sponsoradulto.com/es/SysWebTelecom.cab\")
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_21.cab (http://\"http://67.15.101.3/g_bin/pl/billard8_2_0_0_21.cab\")
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_21.cab (http://\"http://67.15.101.3/g_bin/pl/snooker_2_0_0_21.cab\")
O18 - Filter: text/html - {4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB} - (no file)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
Post by: Guest on March 19, 2005, 08:55:05 PM
Post by: guestolo on March 19, 2005, 09:00:16 PM
It's too confusing to work on a log in this long of a thread
Post by: GSB on March 20, 2005, 10:13:57 AM
Got this annoying thing off my PC.
Followed removal instructions at the SmartSecurity Website.
http://www.smart-security.info/removal.html (http://\"http://www.smart-security.info/removal.html\")
Downloadable uninstaller did nothing, but editing desktop values via regedit did the trick. It´s cumbersome but the only thing that has worked for me...
If you´ve tried everything else, follow the instructions on changing values in regedit. It did work for me.
Phew.
Post by: Guest_steve_* on March 20, 2005, 11:12:22 AM
http://www.smart-security.info/removal.html (http://\"http://www.smart-security.info/removal.html\")
Post by: Guest on March 20, 2005, 03:40:32 PM
/dry.gif\' class=\'bbc_emoticon\' alt=\'<_<\' /> Although the red screen is gone and system appears to be fixed, after running the free fix above, windows shuts down very slow , im not convenced the fix is 100% complete. ill run a reg checker and system works windows scan.steve /dry.gif\' class=\'bbc_emoticon\' alt=\'<_<\' />
Post by: Nabs on March 20, 2005, 04:48:15 PM
Thanks!
Post by: Techie From Canada on March 22, 2005, 02:02:25 AM
*WARNING EDITING THE REGISTRY CAN CAUSE SERIOUS PROBLEMS IF NOT DONE EXACTLY AS SHOWN*
Open registry editor (Start->Run->[type regedit.exe and press enter]).
Delete the following registy keys (the key structure is accessible through
the tree on the left).
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[any thre letters, the first is capital]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\[any thre letters, the first is capital]
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\\Desktop\General\Wallpaper
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\BackupWallpaper
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\SafeMode\General\Wallpaper
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\
Set value "%USERPROFILE%\Desktop" to the following keys:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User shell folders"\Custom Desktop
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell folders\Desktop
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell folders\Desktop
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User shell folders\Desktop
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User shell folders\Desktop
Set blank value to the following keys:
HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper
HKEY_CURRENT_USER\Control Panel\Desktop\OriginalWallpaper
HKEY_CURRENT_USER\Control Panel\Desktop\ConvertedWallpaper
REBOOT IMMEDIATELY AFTER DOING THESE STEPS!
You'll notice most of this was taken from the smart security removal page however his instructions not only messed things up, some things were missing so I modified it to the way I fixed the problem. I hope this has been useful for everyone and thank you to everyone who posted solutions.
Post by: Guest on March 22, 2005, 02:04:44 AM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\
Post by: Garden on March 22, 2005, 04:48:26 AM
we got this SmartSecurity crap too, arghrhrghhs!! We spent two days to remove it and finally it happens. But only partially. I delete desktop.html from C:\WINDOWS (we use Win XP in Czech language edition) and work with register keys (only in "Set value "%USERPROFILE%\Desktop" to the following keys" we replace "Desktop" to Czech equivalent "Plocha").
Now we have no red background on desktop, we can use right button, but we cannot change Desktop picture (yes, I read advices about unchecking Security in Control Panel Display/Desktop/settings/web but in Cuech version is no checkbox Security, but only Lock items on desktop...) and every item I place on desktop is shown twice there (but in apropriate folder in system is only once!!). Can somebody help me, please?? Thank you.
Garden
Post by: Chris_Guest on March 22, 2005, 08:20:21 AM
Post by: Garden on March 22, 2005, 09:20:28 AM
Garden
Post by: Chris_Guest on March 22, 2005, 03:08:00 PM
Post by: Techie From Canada on March 22, 2005, 04:00:21 PM
Post by: Pissed Off on March 23, 2005, 03:41:05 AM
Maybe a few THOUSAND E_MAILS will get OUR point across!!
InterNIC
Whois Search Results
Search again (.aero, .arpa, .biz, .com, .coop, .edu, .info, .int, .museum, .name, .net, or .org):
Domain (ex. internic.net)
Registrar (ex. ABC Registrar, Inc.)
Nameserver (ex. ns.example.com or 192.16.0.192)
NOTICE: Access to .INFO WHOIS information is provided to assist persons in
determining the contents of a domain name registration record in the Afilias
registry database. The data in this record is provided by Afilias Limited
for informational purposes only, and Afilias does not guarantee its
accuracy. This service is intended only for query-based access. You agree
that you will use this data only for lawful purposes and that, under no
circumstances will you use this data to: (1) allow, enable, or otherwise
support the transmission by e-mail, telephone, or facsimile of mass
unsolicited, commercial advertising or solicitations to entities other than
the data recipient's own existing customers; or (2) enable high volume,
automated, electronic processes that send queries or data to the systems of
Registry Operator or any ICANN-Accredited Registrar, except as reasonably
necessary to register domain names or modify existing registrations. All
rights reserved. Afilias reserves the right to modify these terms at any
time. By submitting this query, you agree to abide by this policy.
Domain ID:D5928130-LRMS
Domain Name:SMART-SECURITY.INFO
Created On:18-May-2004 10:24:19 UTC
Last Updated On:23-Feb-2005 21:01:51 UTC
Expiration Date:18-May-2006 10:24:19 UTC
Sponsoring Registrar:R159-LRMS
Status:CLIENT LOCK
Status:OK
Registrant ID:C4844095-LRMS
Registrant Name:Aleksandr Romantsev
Registrant Organization:Smart Security GM
Registrant Street1:Lindaal 33
Registrant City:Overijse
Registrant Postal Code:3090
Registrant Country:BE
Registrant Phone:+1.3022617417
Registrant FAX:+1.3022617417
Registrant Email:[email protected]
Admin ID:C4844095-LRMS
Admin Name:Aleksandr Romantsev
Admin Organization:Smart Security GM
Admin Street1:Lindaal 33
Admin City:Overijse
Admin Postal Code:3090
Admin Country:BE
Admin Phone:+1.3022617417
Admin Email:[email protected]
Billing ID:C4844095-LRMS
Billing Name:Aleksandr Romantsev
Billing Organization:Smart Security GM
Billing Street1:Lindaal 33
Billing City:Overijse
Billing Postal Code:3090
Billing Country:BE
Billing Phone:+1.3022617417
Billing Email:[email protected]
Tech ID:C4844095-LRMS
Tech Name:Aleksandr Romantsev
Tech Organization:Smart Security GM
Tech Street1:Lindaal 33
Tech City:Overijse
Tech Postal Code:3090
Tech Country:BE
Tech Phone:+1.3022617417
Tech Email:[email protected]
Name Server:NS1.SMART-SECURITY.INFO
Name Server:NS2.SMART-SECURITY.INFO
Post by: Pissed Off on March 23, 2005, 07:00:30 AM
I haven't tried it yet, but at this point, I figure I have nothing to loose. The "Free Clean Utility" mentioned can be found at their website.
I'll make another post after I follow these instructions and let you all know how it turns out.
We apologize for actions of several our advertisers. We are investigating their promotion business.
Download FreeClean Utility to remove desktop advertisement.
Active desktop should disappear. If it have not disappeared - then try to disable it via Control Panel.
If the utility does not work (the spyware has blocked it out, we
are getting this problem solved), try the following steps to remove
the ad maually.
Open registry editor (Start->Run->[type regedit.exe and press enter]).
Delete the following registy keys (the key structure is accessible through
the tree on the left).
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\[any thre letters, the first is capital]
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\[any thre letters, the first is capital]
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Desktop\\General\\Wallpaper
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Desktop\\General\\BackupWallpaper
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Desktop\\SafeMode\\General\\Wallpaper
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoViewContextMenu
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoViewContextMenu
Set value "%USERPROFILE%\\Desktop" to the following keys:
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User shell folders\\Common Desktop
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User shell folders"\\Custom Desktop
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell folders\\Desktop
HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell folders\\Desktop
HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User shell folders\\Desktop
HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User shell folders\\Desktop
Set blank value to the following keys:
HKEY_CURRENT_USER\\Control Panel\\Desktop\\Wallpaper
HKEY_CURRENT_USER\\Control Panel\\Desktop\\OriginalWallpaper
HKEY_CURRENT_USER\\Control Panel\\Desktop\\ConvertedWallpaper
REBOOT IMMEDIATELY AFTER DOING THESE STEPS!
Post by: Pissed Off on March 23, 2005, 08:31:25 AM
I also went through the registry and followed their directions...and the adds still there. I did get my Icons back, and my Right Click works now, but the adds still there.
Maybe some of you will have better luck, but I think if you tried to remove it with Spyware or Antivirus Programs, your going to run into the same thing I did.
Microsoft will provide Free Support for those of us that have had the unfortunate displeasure of running into this company.
You'll go through Teir 1 Virus Support, and be transfered to the Virus Escalation Department quickly. At least that's how it's going for me. I found out quickly that just because the screens gone, it doesn't mean the program is gone.
Best of luck to you all.
Post by: Techie From Canada on March 23, 2005, 04:27:16 PM
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User shell folders\\Common Desktop
IF YOU DO IT WILL MAKE DOUBLE ICONS ALL OVER AGAIN
also be sure to delete
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper
Post by: John Smith Jr. on March 28, 2005, 03:03:56 PM
You guys tell me to do smthn in that customize desktop, but i dont even have that 'web' thing.
I tried that official remover from homepage, but now the screen is gone and my background is blue and i cant change wallpapers.
All stays blue.
Post by: ricksoft on March 30, 2005, 12:13:14 AM
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' />
Post by: Guest_jack_* on March 30, 2005, 03:44:21 PM
/wink.gif\' class=\'bbc_emoticon\' alt=\';)\' />
Post by: JLMonty on March 30, 2005, 05:09:13 PM
I'm trying to get this off of my pastors computer, which is terribly inappropriate to be popping up on his machine!
So far, I have successfully removed the wallpaper, now I'm left with a basic blue background. I no longer seem to be seeing recurring files popping up, and all the stated reg entries seem to be gone, AV scans, spybot and spysweeper scans show clear.
However, I do not seem to be able to select a new desktop. Trying th change themes simply does not change the desktop, and the entries in the desktop section of display properties seems non functional, cannot select anything except color, which again, dosn't seem to actuall do anything when applied.
What did I miss? Any help is very appreciated.
Thank you for being here!
JL
Post by: Victim on April 01, 2005, 09:11:30 AM
I'm trying to get this off of my pastors computer, which is terribly inappropriate to be popping up on his machine!
So far, I have successfully removed the wallpaper, now I'm left with a basic blue background. I no longer seem to be seeing recurring files popping up, and all the stated reg entries seem to be gone, AV scans, spybot and spysweeper scans show clear.
However, I do not seem to be able to select a new desktop. Trying th change themes simply does not change the desktop, and the entries in the desktop section of display properties seems non functional, cannot select anything except color, which again, dosn't seem to actuall do anything when applied.
What did I miss? Any help is very appreciated.
Thank you for being here!
JL
[post=\"31758\"]<{POST_SNAPBACK}>[/post]
[/quote]I was in your shoes last night. I went into the registry and searched out all instances of: Desktop.html, c:\winnt\desktop, c:\desktop. I replaced all values with what I think were the correct values and it seems to have worked. Prior to diving into the registry, I was running Teatimer from Spybot and used Hijack This to remove files and keys that were still active while performing the repair.
This has got me back to where I was, I think (Notice I say repair and not fix <smile>). Hoping an app that removes this pest hits the net (soon). Only than will I feel comfortable that I have gotten rid of it.
Hope this helps.
Post by: Brox on April 01, 2005, 12:38:51 PM
My problem is similar to everyone else's, but I have no right click available nor security box to uncheck.
I´ve been investigating a solution for this smartsecurity problem and I came across several possible solutions, but they all required editing or erasing stuff. I was looking for a removal tool,so decided to have a go at the one they supply: http://www.smart-security.info/removal.html (http://\"http://www.smart-security.info/removal.html\"). What harm could it do?
It seems to have worked fine, despite coming from the same assholes who had put it out in the first place.
Post by: smartsecurity problems on April 02, 2005, 03:28:12 AM
this is a personal attack by smartsecurity on my personal computer and freedom.
let find out who this company is - company ownership, website and let attack back (legally, i guess?)
lets get them
Post by: egb on April 02, 2005, 05:32:34 PM
On the desktop: If I Right_Click - Properties - Desktop, the BACKGROUND selection is inactive, can see the selections, but can't make a choice or use the BROWSE button.
The COLOR selection allows a color choice, but has no effect.
Stuck with the damn red spam screen... Jee, I wonder why there is no phone number posted on the SmartSecurity web site? What a bunch of bums.
Any suggestions?
Thanks
Post by: Trevor Saint on April 03, 2005, 01:06:57 AM
I have followed this thread from beginning to end, as I have many others from other similar sites. I have done everything everyone has posted, but I still have the problem. It simply won't go away.
I have been spending my life in Safe Mode for the last week. I have now run out of options.
Is there a real expert at this site who can help me? It will be a massive challenge, and I'm (obviously) prepared to work one-on-one with anybody who can help. If you can get this off my PC, you are an expert, and possibily will have the ultimate the soltion to this murderous desease. I wouldn't be suprised if people have had heart attacks and strokes trying to deal with this bastard of a problem.
Please, please help me.
I am a novice at this stuff, and will therefore need step by step help, remembering that I have already done all the suggestions on this thread.
Post by: guestolo on April 03, 2005, 01:37:52 AM
Click Here (http://\"http://www.thetechguide.com/forum/index.php?showtopic=14623\")
It will give you instructions on how to post a Hijackthis log
This helps in identifying some bad guys
I will also require you too Register to the forum
If you decide to post a hijackthis log, Please start your own post
Don't post in this thread as it is way too long
To all others reading this thread, please start your own topic in the Tech Clinic section and supply a Hijackthis log
All problems must be treated individually, and you may be surprised how easy it is to rid yourself of this pest
Here are the instructions
[color=\"#800080\"]CLICK HERE[/color] (http://\"http://www.thetechguide.com/forum/index.php?showtopic=22942\")
Post by: Trevor Saint on April 03, 2005, 10:33:58 AM
I have downloaded the HJT.
Do you want the HJT log from a Safe Mode boot or a normal boot?
Please post reply to the new thread, as described above.
Many thanks.
Post by: allex on April 03, 2005, 04:57:29 PM
(http://www.geocities.com/rilxhub/smartsecurity.GIF)
of my new pretty red desktop... how can i remove it?
Post by: Jasper454 on April 04, 2005, 07:56:38 PM
/mad.gif\' class=\'bbc_emoticon\' alt=\':angry:\' /> Hey everyone. i was tooling around on the net one day trying to get Kazaa to work again (hey, why lie
/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' /> ?) anyway, i clicked on a link to fix the 'connect' on kazaa, only to end up downloading 'Smart Security'. Yay! i updated my virus software (Norton), upadated Microsoft Anti spyware beta and Spybot and Adaware. Ran everything in 'safe' mode and thought i had it licked. I even cleaned out everything possible with Hijack. i can't find traces of anything that you all have mentioned in this post, but i still cannot change my desktop wallpaper. i have searched and searched for the 'security' tab, but cannot find one. Has anyone else had this problem? oh, i downloaded Spy Sweeper also and deleted everything it found. (Did not run that one in safe mode)Suggestions? You can get fairly technical with me... I don't consider myself an 'expert', but can get into and work with 'regedit', 'msconfig', etc.
Post by: Guest_annoyed_* on April 06, 2005, 02:55:51 PM
what is the best advice for dealing with this??
Post by: jasper454 on April 06, 2005, 03:32:30 PM
/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />
Post by: Guest_Dennis_* on April 09, 2005, 12:14:47 PM
http://www.smart-security.info/removal.html (http://\"http://www.smart-security.info/removal.html\")
It worked for me!
Post by: Guest_delphina_* on April 09, 2005, 10:22:31 PM
1. Downloaded and ran the remove utility from smart-security's website. That enabled me to get a menu when I right-clicked, but that's all it appeared to fix.
2. Did an online scan at trendmicro.com, which identified and fixed 2 viruses. Once those viruses were taken care of, all was well. Perhaps this would have worked without having run the remove utility.
This particular machine had all kinds of malware and a few viruses on it, which makes it difficult to know if the above steps would have been sufficient if smart-security were the only problem. Prior to those final steps, I had run Spybot S&D, AdawareSE, and Norton Antivirus 2002 (which was already onboard, but the auto-detect function had been disabled by one of the pieces of garbage infecting the machine). Those scans got rid of all but the smart-security, Haxdoor virus, and one other virus (the name escapes me, but it appeared to me that it was specific to smart-security, and Trend and one other anti-virus vendor (Sophos?) detect it).
The Norton virus definitions on this machine were up to date, and the entire 2002 version of Norton Internet Security was installed and running. No idea what the user clicked on, but this sure adds to my failing confidence in Symantec's products!
Post by: JonMan on April 14, 2005, 05:09:22 PM
To make the Background, Appearance, etc. options return to your Display Dialog, we edited the registry and deleted the following folder:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
System
Best of luck.
Post by: VASILIK on April 15, 2005, 04:44:21 AM
The best way to get rid of this [censored] with danger spyware and desktop click is to download this file and run it.!!! IT WORKS 100%.Its not a joke.The program is from smartsecurity!!!!!
FIX [censored] w32.HAXDOOR spyware (http://\"http://www.smart-security.info/removal.html\")
/biggrin.gif\' class=\'bbc_emoticon\' alt=\':D\' /> /smile.gif\' class=\'bbc_emoticon\' alt=\':)\' /> www.smart-security.info/removal.html
Post by: Guest on April 15, 2005, 05:31:07 PM
I cant right click, the sods figured it out and now I cant right click or acess web security
Unless I solve this now I'm gonna have to reformat everything
/sad.gif\' class=\'bbc_emoticon\' alt=\':(\' />
Post by: Guest on April 15, 2005, 05:32:29 PM
go to smart security and download the very trojan that people are trying to get rid of
Wow, we are dumb arent we for not figuring that out :/
*Idiot*
Post by: noraloo on April 15, 2005, 06:45:03 PM
anyway i think our man who offered up the regedit a few posts back (HKEY_CURRENT_USER_\software and so on) is on the right track...at least my desktop options aren't frozen now. i can put pretty f'ing tulips on my desktop now if i like.
however i still fear that SmartSecurity is still lurking around somewhere in the depths of my knowledge box. and i'm not one to fall on the lawsuit bandwagon these days but sh*t if anyone wants to get a suit going against these folks i'm all for it. just tell me where to sign up.
any lawyers out there? or folks with time?