Smitfraud

Smitfraud Description

Smitfraud is a Trojan, which shows excessive pop-up messages showing a false alert or fake error message, trying to lure computer user into purchasing anti-spyware software, such as AdwareDelete, PSGuard, AntivirusGold or SpySheriff, that supposedly detects adware on your computer but in turn is a malicious spying software. Furthermore, Smitfraud replaces some Windows critical components with own infected files. Smitfraud is a malicious spyware and may cause serious system instability issues. It’s recommended that you get rid of this trojan as soon as possible.

Aliases

Generic26.ZUH [AVG]Trojan/win32.agent.gen [Antiy-AVL]TR/Kazy.48076.5 [AntiVir]Trojan.Win32.Generic!BT [VIPRE]Gen:Variant.Kazy.48076 [BitDefender]MSIL:Dropper-RL [Drp] [Avast]a variant of MSIL/Injector.QA [NOD32]Trj/CI.A [Panda]Backdoor/Win32.Gbot [AhnLab-V3]Trojan.Win32.FakeAV.IS (v) [VIPRE]

More aliases (119)

Smitfraud Automatic Detection Tool (Recommended)

Is your PC infected with Smitfraud? To safely & quickly detect Smitfraud, we highly recommend you run the malware scanner listed below.

Download SpyHunter's* Malware Scanner to detect Smitfraud What happens if Smitfraud does not let you open SpyHunter or blocks the Internet?

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

#	File Name	Detection Count
1	atmtd.dll._	696
2	gndarmblsnv.dll	541
3	drsmartload95a.exe	527
4	drsmartload45v.exe	234
5	atmtd.dll	234
6	drsmartload46v.exe	190
7	drsmartload46a.exe	169
8	MTE3NDI6ODoxNg.exe	162
9	ssqnool.dll	28
10	drsmartload1.exe	N/A

More files

Registry Modifications

Tutorial: To edit and delete registry entries manually, read the tutorial on how to remove malicious registry entries.

Tip & Warning: Editing and removing the wrong registry keys can severely damage your PC, so remember to backup your Windows Registry! To optimize your Windows Registry and speed up your PC, download RegHunter's registry cleaner.

The following newly produced Registry Values are:
HKEY..\..\{Value}SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler, value: {64ba30a2-811a-4597-b0af-d551128be340}SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler, value: {aea3d2df-2b2c-4d7b-81a0-d975c6dc088e}Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler, value: {f31aee4a-1530-4fef-8537-79c6973bff9a}Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler, value: {5f938c17-fbc7-4a3c-8526-85e5b1a1f762}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}cproc.exegwizSystemSv121
The following CLSID's were detected:
HKEY..\..\{CLSID Path} {b292ec9f-a074-4115-8342-1f459702d8d2}{27321538-5739-4aa1-b84c-7d18e4383f1f}{5f938c17-fbc7-4a3c-8526-85e5b1a1f762}{f31aee4a-1530-4fef-8537-79c6973bff9a}{dfa61db1-388e-4c87-8d56-540fa229bcb4}{03413bf7-e34c-445b-bfc0-a2b127255871}{5839511e-ec1b-4f91-ace3-fb88e52f5239}{ed39ecef-902e-4ed1-8434-71e8db89e5ca}{82B07A2B-F0AF-45FC-BE44-18D83B01EAD9}{3808C05F-CFB0-4C9B-858D-851CC3EBB3BC}{EACC5636-980A-4D26-9250-1CF418E6D1D1}{BA6BD7B1-990F-4D05-8D6C-9CBAFCB3C7ED}{4480F41F-F91F-4781-B1EA-30D261DA06AC}{973ecdd8-1e81-4c28-b5a1-69966c0a2ce4}{C4248759-304D-477D-A1B3-F706CF99756D}{1AC7107A-938F-4347-864C-C51E49EC586E}{5085333B-FD15-4754-A571-852F7077C5F2}{6a307130-b248-4b23-b2b7-4498da8c977a}{87EF7048-8905-4E82-862E-65004D4DFA80}{3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A}{AB5FE6E5-7C72-4B89-85D0-D57E7AEAC236}{FD2A7D3A-3DA1-4CA5-AD39-B4C3A72B567F}{19452E5B-963F-4886-766D-0526284B6F61}{f79fd28e-36ee-4989-aa61-9dd8e30a82fa}