Hello Tim,
Tuesday, July 19, 2005, 8:59:28 AM, you wrote:
> Norton (up to date) kicked in and flashed up a high risk warning
> but reassuringly stated that it had cleared the threat. I clicked
> OK. Norton flashed again and then a third time. At the end of this
> my wallpaper had been replaced by an error message (something about
> "Trojan-Spyware.HTML.smitfraud.c has caused a fatal exception error"
> from memory), there were three new icons on my desktop for online
> dating agencies and the but of the task bar over by the clock
The reference "Trojan-Spyware.HTML.smitfraud.c" initially confused me
because it is a Kapersky Lab name and the events you report do not
correlate with Kapersky's description of that virus:
http://www.viruslist.com/en/viruses/encyclopedia?virusid=73615.
However a bit more googling found the following:
Begin Quote
Smitfraud is an adware program that infects the Windows file
WININET.DLL with the virus detected as W32/Smitfraud.A.
The infected DLL (Dynamic Link Library) hooks all the calls to the
function HttpSendRequest, and as a result the adware is able to log
the web pages accessed by the user and send this information to a
server, or download and run a file that installs a so-called
antispyware program on the computer, stealthily and without user
consent.
This program changes the Windows Desktop to a picture that simulates a
Windows fatal error, warning users that they have been affected by
Trojan-Spy.HTML.Smitfraud.c. These kind of messages attempt to trick
users into purchasing the fake antispyware program.
Smitfraud is installed in the affected computer by other adware,
detected as CWS.YEXE, which is downloaded while accessing several
adult sites or pirated software sites.
End Quote
Sounds pretty much what you have described?
http://www.antivirusworld.com/articles/virus/smitfraud.php
The above doesn't offer precise removal instructions but it does
detail all the changes smitfraud makes. A PDF (3 pages) of the above
emailed to you direct.
Chris
--
Chris Salter mailto:[log in to unmask]
Lincolnshire Post-Polio Network http://www.lincolnshirepostpolio.org.uk/
Polio and Post-Polio News http://mt.lincolnshirepostpolio.org.uk/pandppnews/
|