Home Spyware Database "Smitfraud Removal Guide"

Smitfraud Removal Guide

Smitfraud Description

How can I Detect Smitfraud?

The most common spyware removal tactic is to uninstall Smitfraud by using the "Add/Remove Programs" utility. However, as there may still be hidden Smitfraud files, it's possible that Smitfraud will reappear after reboot. Follow the Smitfraud detection and removal methods below.

Smitfraud Automatic Detection (Recommended)

Is your PC infected with Smitfraud? To safely & quickly detect Smitfraud, we highly recommend you...

Download SpyHunter's Malware Scanner.

SpyHunter's free version is only for malware detection. If SpyHunter's malware scanner detects Smitfraud on your PC, you will need to purchase SpyHunter's malware removal tool to remove Smitfraud and other malware threats.

Smitfraud Manual Removal Instructions

Below is a list of Smitfraud manual removal instructions and Smitfraud components listed to help you remove Smitfraud from your PC. Backup Reminder: Always be sure to back up your PC before making any changes.

Note: This manual removal process may be difficult and you run the risk of destroying your computer. We recommend that you use SpyHunter's malware detection tool to check for Smitfraud.

Step 1 : Use Windows File Search Tool to Find Smitfraud Path

1. Go to Start > Search > All Files or Folders.
2. In the "All or part of the the file name" section, type in "Smitfraud" file name(s).
3. To get better results, select "Look in: Local Hard Drives" or "Look in: My Computer" and then click "Search" button.
4. When Windows finishes your search, hover over the "In Folder" of "Smitfraud", highlight the file and copy/paste the path into the address bar. Save the file's path on your clipboard because you'll need the file path to delete Smitfraud in the following manual removal steps.

Step 2 : Use Windows Task Manager to Remove Smitfraud Processes

1. To open the Windows Task Manager, use the combination of CTRL+ALT+DEL or CTRL+SHIFT+ESC.
2. Click on the "Image Name" button to search for "Smitfraud" process by name.
3. Select the "Smitfraud" process and click on the "End Process" button to kill it.
4. Remove the "Smitfraud" processes files:
5. faceback.exe n2ewma1xxsv2234.exe retadpu1000106.exe retadpu.exe retadpu[2].exe retadpu[1].exe wjiio.exe retadpu21.exe arpl.exe retadpu77.exe drsmartload815a.exe drmv2clt.exe MTE3NDI6ODoxNg[1].exe MTE3NDI6ODoxNgnew.exe drsmartload44a[1].exe cproc.exe ntsystem.exe MTE3NDI6ODoxNg.exe drsmartload1.exe drsmartload95a.exe drsmartload849a.exe drsmartload46a.exe drsmartload45a.exe drsmartload100a[1].exe drsmartload849v.exe drsmartload46v.exe drsmartload45v.exe drsmartload849a8b5.exe drsmartload849a[1].exe drsmartload45a[1].exe loader[1].exe drsmartload46a[1].exe drsmartload849a7h.exe drsmartload46a7h.exe drsmartload45a7h.exe drsmartload.exe drsmartload849a7i.exe drsmartload46a7i.exe drsmartload45a7i.exe drsmartload192a[1].exe drsmartload849a849m.exe drsmartload46a46m.exe drsmartload45a45m.exe zloader3.exe wp.exe winstall.exe winhook.exe uninstiu.exe shnlog.exe popuper.exe ole32vbs.exe msole32.exe msmsgs.exe intmonp.exe intmon.exe hookdump.exe helper.exe bsw.exe, helper.exe, hookdump.exe, intmon.exe, intmonp.exe, msmsgs.exe, msole32.exe, ole32vbs.exe, popuper.exebsw.exe
   Read more about How to kill Smitfraud Processes

Step 3 : Use Registry Editor to Remove Smitfraud Registry Values

1. To open the Registry Editor, go to Start > Run > type regedit and then press the "OK" button.
2. Locate and delete the entry or entries whose data value (in the rightmost column) is the spyware file(s) detected earlier.
3. To delete "Smitfraud" value, right-click on it and select the "Delete" option.
4. Locate and delete "Smitfraud" registry entries:
5. 82B07A2B-F0AF-45FC-BE44-18D83B01EAD9 973ecdd8-1e81-4c28-b5a1-69966c0a2ce4 4480F41F-F91F-4781-B1EA-30D261DA06AC BA6BD7B1-990F-4D05-8D6C-9CBAFCB3C7ED D878CD49-CE41-4434-831D-EFC15D06D25C 8AC6FA22-65B6-41B0-B0BB-243F35B86E74 EACC5636-980A-4D26-9250-1CF418E6D1D1 9D2C4CFB-0C11-4658-9EF5-B05BED9CC447 3808C05F-CFB0-4C9B-858D-851CC3EBB3BC 5085333B-FD15-4754-A571-852F7077C5F2 1AC7107A-938F-4347-864C-C51E49EC586E C4248759-304D-477D-A1B3-F706CF99756D 87EF7048-8905-4E82-862E-65004D4DFA80 6a307130-b248-4b23-b2b7-4498da8c977a C2DE4340-CB68-450F-90CD-9BE1A26739D7 3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A AB5FE6E5-7C72-4B89-85D0-D57E7AEAC236 0B9B7B2E-30E3-4C5D-AD2C-C38724979B4B MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\vtursro MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ssqnool FD2A7D3A-3DA1-4CA5-AD39-B4C3A72B567F b292ec9f-a074-4115-8342-1f459702d8d2 SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\b292ec9f-a074-4115-8342-1f459702d8d2 Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\instcat 27321538-5739-4aa1-b84c-7d18e4383f1f 5f938c17-fbc7-4a3c-8526-85e5b1a1f762 Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\5f938c17-fbc7-4a3c-8526-85e5b1a1f762 SOFTWARE\Policies\06849E9F-C8D7-4D59-B87D-784B7D6BE0B3 dfa61db1-388e-4c87-8d56-540fa229bcb4 f31aee4a-1530-4fef-8537-79c6973bff9a Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\f31aee4a-1530-4fef-8537-79c6973bff9a 03413bf7-e34c-445b-bfc0-a2b127255871 Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\incestuously 19452E5B-963F-4886-766D-0526284B6F61 Microsoft\drsmartload2 64ba30a2-811a-4597-b0af-d551128be340 aea3d2df-2b2c-4d7b-81a0-d975c6dc088e ed39ecef-902e-4ed1-8434-71e8db89e5ca WMuse 5839511e-ec1b-4f91-ace3-fb88e52f5239 SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\64ba30a2-811a-4597-b0af-d551128be340 SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\aea3d2df-2b2c-4d7b-81a0-d975c6dc088e SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\decorin f79fd28e-36ee-4989-aa61-9dd8e30a82fa D5BC2651-6A61-4542-BF7D-84D42228772Centry. HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallinternetupdate HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerSearchURL(Default)=[siteaddress] HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerSearchSearchAssistant=[siteaddress] HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerSearchCustomizeSearch=[siteaddress] HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainLocalPage=[siteaddress] HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainSearchPage=[siteaddress] HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainSearchBar=[siteaddress] HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainDefault_Search_URL=[siteaddress] HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainDefault_Page_URL=[siteaddress] FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunmsnmessenger HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunWindowsFZ Search the Windows registry for {D5BC2651-6A61-4542-BF7D-84D42228772C} entry.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunWindowsFY HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionUninstallinternet update HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerSearchURL(Default)=[site address] HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerSearchSearchAssistant=[site address] HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerSearchCustomizeSearch=[site address] HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainLocal Page=[site address] HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainSearch Page=[site address] HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainSearch Bar=[site address] HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainDefault_Search_URL=[site address] HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainDefault_Page_URL=[site address] HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionExplorerBrowser Helper Objects{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF} HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionRunmsn messenger HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionRunWindowsFZ HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionRunWindowsFY
   Read more about How to Remove Smitfraud Registry Entries

Step 4 : Use Windows Command Prompt to Unregister Smitfraud DLL Files

1. To open the Windows Command Prompt, go to Start > Run > type cmd and then click the "OK" button.
2. Type "cd" in order to change the current directory, press the "space" button, enter the full path to where you believe the Smitfraud DLL file is located and press the "Enter" button on your keyboard. If you don't know where Smitfraud DLL file is located, use the "dir" command to display the directory's contents.
3. To unregister "Smitfraud" DLL file, type in the exact directory path + "regsvr32 /u" + [DLL_NAME] (for example, :C\Spyware-folder\> regsvr32 /u Smitfraud.dll) and press the "Enter" button. A message will pop up that says you successfully unregistered the file.
4. Search and unregister "Smitfraud" DLL files:
5. gndarmblsnv.dll asgp32.dll dxpvqlmqng.dll dxpvqlmtqn.dll domnftwlvq.dll domnftwwrn.dll domnftwmnf.dll domnftwost.dll bndsrdkq.dll bndsrgxt.dll oembios32.dll vtursro.dll ssqnool.dll olnohdw.dll tazth.dll ixt2.dll winetn32.dll atmtd.dll oybgrql.dll dnr4019qe.dll oleadm32.dll oleadm.dll hhk.dll param32.dll wldr.dll
   Read more about How to Remove Smitfraud DLL Files

Step 5 : Detect and Delete Other Smitfraud Files

1. To open the Windows Command Prompt, go to Start > Run > type cmd and then press the "OK" button.
2. Type in "dir /A name_of_the_folder" (for example, C:\Spyware-folder), which will display the folder's content even the hidden files.
3. To change directory, type in "cd name_of_the_folder".
4. Once you have the file you're looking for type in "del name_of_the_file".
5. To delete a file in folder, type in "del name_of_the_file".
6. To delete the entire folder, type in "rmdir /S name_of_the_folder".
7. Select the "Smitfraud" process and click on the "End Process" button to kill it.
8. Remove the "Smitfraud" processes files:
9. faceback.exe gndarmblsnv.dll asgp32.dll n2ewma1xxsv2234.exe SystemSv121 domnftwwrn.dll-removed_skip domnftwmnf.dll-removed_skip domnftwost.dll-removed_skip dxpvqlmqng.dll dxpvqlmtqn.dll domnftwlvq.dll domnftwwrn.dll domnftwmnf.dll domnftwost.dll bndsrdkq.dll bndsrgxt.dll oembios32.dll retadpu1000106.exe retadpu.exe retadpu[2].exe retadpu[1].exe wjiio.exe vtursro.dll retadpu21.exe ssqnool.dll arpl.exe retadpu77.exe runner1 olnohdw.dll drsmartload815a.exe drmv2clt.exe MTE3NDI6ODoxNg[1].exe MTE3NDI6ODoxNgnew.exe drsmartload44a[1].exe tazth.dll ixt2.dll winetn32.dll cproc.exe cprocsvc ntsystem.exe gwiz drsmartload2.dat MTE3NDI6ODoxNg.exe drsmartload1.exe drsmartload95a.exe drsmartload849a.exe drsmartload46a.exe drsmartload45a.exe atmtd.dll atmtd.dll._ drsmartload100a[1].exe drsmartload849v.exe drsmartload46v.exe drsmartload45v.exe oybgrql.dll drsmartload849a8b5.exe drsmartload849a[1].exe drsmartload45a[1].exe loader[1].exe drsmartload46a[1].exe drsmartload849a7h.exe drsmartload46a7h.exe drsmartload45a7h.exe drsmartload.exe drsmartload849a7i.exe drsmartload46a7i.exe drsmartload45a7i.exe dnr4019qe.dll drsmartload192a[1].exe drsmartload849a849m.exe drsmartload46a46m.exe drsmartload45a45m.exe wp.bmp sites.ini perfcii.ini hp[X].tmp zloader3.exe wp.exe winstall.exe winhook.exe uninstiu.exe shnlog.exe oleadm32.dll oleadm.dll hhk.dll param32.dll wldr.dll popuper.exe ole32vbs.exe msole32.exe msmsgs.exe intmonp.exe intmon.exe hookdump.exe helper.exe bsw.exe shnlog.exe, uninstiu.exe, winhook.exe, winstall.exe, wp.exe, zloader3.exe, hp[X].tmp, perfcii.ini, sites.ini, wp.bmp
   Read more about How to Delete Harmful Files

Smitfraud Recommendation

RECOMMENDED: To avoid the unnecessary risk of damaging your computer, we highly recommend you use a good malware remover to track Smitfraud and automatically remove Smitfraud as well as other spyware, adware, trojans, and virus threats in your PC.

If you believe you have Smitfraud installed on your computer, check for Smitfraud with SpyHunter's Malware Scanner.

SpyHunter's free version is only for malware detection. To remove Smitfraud and other malware threats, you will need to purchase SpyHunter's malware removal tool. Since new Smitfraud files are constantly being released, it is normally advised to run SpyHunter's scanner weekly to get the latest updates on Smitfraud and other malware threats.

To learn more on Smitfraud, see our Smitfraud resource section below.

Smitfraud Technical Details

The following Smitfraud components and their MD5s:

More Smitfraud Resources

What is Trojans?

Smitfraud is a type of Trojans.

Trojans install themselves secretly and quietly onto your computer, most often by the simple downloading of email attachments (usually .avi, .pif, .exe, and even .jpg files.) Most Trojans gain complete control over your system after installation, and with that may delete files, steal passwords, change your system settings, and monitor your computer acitivity.

Think you have Smitfraud? Run SpyHunter's malware scan and automatically detect Smitfraud on your PC.

Back to Top

Smitfraud Prevention Rules

Protect your computer from Smitfraud and other spyware by following these four easy prevention rules.

Rule #1: Keep your Windows Security up-to-date

Microsoft provides updates weekly and can always be downloaded manually from the Microsoft website.
Tip: Regularly visit Windows Update and set your computer to receive security & critical updates automatically.

To get Microsoft Update, go to IE > Tools > Windows Update > Product Updates, and select "ALL High-Priority Security Updates" from the list.

Then open IE and go to Internet Options > Security > Internet, then press "Default Level", then OK. Now press "Custom Level."

Rule #2: Download and install a reliable anti-spyware software

A good anti-spyware software that recognizes current Smitfraud spyware as well as other forms of spyware can can be the answer to all your security issues. Listed below is an anti-spyware program that can effectively reverse the damage of your computer and detect Smitfraud automatically.

Download SpyHunter's Malware Scanner

SpyHunter's free version is only for malware detection. To remove Smitfraud and other malware threats, you will need to purchase SpyHunter's malware removal tool.

Rule #3: Install and keep your firewall turned on

A firewall is essential for a complete protection of your PC. Make sure that your firewall is always turned on. A firewall can prevent unwanted software like Smitfraud from infecting your computer.

Rule #4: Keep your anti-spyware definitions up-to-date

Since new Smitfraud files can be created every day, it is important to keep your anti-spyware program up-to-date. Your anti-spyware scanner should have an update feature where with a click of a button you can get new spyware definitions instantly. Often, an anti-spyware software will open an update window reminding you that there are new updates available.

Back to Top

User Comments

Back to Top