[M2 Carbine]

So far no luck removing it with Spybot, Malwearbytes, AVG and SUPERAntiSpyware.

I'd like to have just five minutes with the *******s that produce this kind of ****.:steamed:

 

[Lotiki]

So far no luck removing it with Spybot, Malwearbytes, AVG and SUPERAntiSpyware.

I'd like to have just five minutes with the *******s that produce this kind of ****.:steamed:

MalwareBytes Anti-Malware should get rid of it for you. Are you running it in safe mode?
http://www.malwarebytes.org/mbam.php


Or you can do the following to remove it manually in safe mode;

1. Kill processes:
wmptray.exe
dejusched.exe

2. Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\GenericMultiMedia
HKEY_LOCAL_MACHINE\SOFTWARE\GenericMultiMedia\WinCoDecPRO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "WmpTray"

3. Delete files:
wmptray.exe
dejusched.exe
1.gif wall.html

4. Delete directories:
c:\Program Files\MediaSystem

Also, the smitfraudfix program that is available for free online has worked wonders for people with this problem. Run it in safe mode and it will do the rest. This program is so popular that some trojans have started making any program with that name simply not start. Change the name of the downloaded .exe to something else if it wont start. Select option #2 - clean to start and it will fix your pc.
http://siri.geekstogo.com/SmitfraudFix.php

 

[MavsX]

yes to safe mode

 

[MavsX]

maybe safe mode with networking..and you can do a online scan through..

housecall(trend micro)....symantec, or mcaffe..

 

[M2 Carbine]

I'm still working on it.

Yes, been using safe mode.

So far all the above programs haven't turned up a thing.

I also haven't been able to find any of the files/folders or the Registry values mentioned.

housecall is still running and looks like it will take another hour or two. It says it has found 6 threats but doesn't say what they are.

I'm puzzled that I can't find any files/folders or registry entries, because the virus is still active with a icon next to the clock. The most obvious problems are all the video programs and sound are out and I keep getting "balloons" that try and take me to the WincodecPro web site.

This virus is a SOB. I've never had this much trouble getting rid of one.











t

 

[IndyGunFreak]

Oh how I miss the days..., tirelessly running virus scans, malwarebytes, spybot, adaware, rebooting... Almost brings a tear to my eye.. :crying:

Seriously... Hope you get it worked out M2...

IGF

 

[Sgt. Schultz]

Turn off System Restore and then try to clean your system in safe mode.



.

 

[Lotiki]

Smitfraudfix or Combofix will easily fix any smitfraud trojan like this one, try them, it is what they were designed for. Don't forget to change the name of the .exe before you run it.

Smitfraudfix;
http://siri.geekstogo.com/SmitfraudFix.php

Combofix;
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

 

[M2 Carbine]

Now this is an interesting development.:shocked:

I was still fighting with this virus up to a few minutes ago.
Nothing was working but I was confusing the virus I think. It quit taking me to the WinCodecPro web site and began taking me to Google.

Balloons and Error boxes still popped up.

I was fixing to try Combofix in safe mode with Restore turned off.

I got a Win update notice about SP3. It seems in the past I had trouble with SP3, so I've been running SP2. I thought I'd try SP3 again.
When SP3 finished installing the virus appears to be gone.:dunno:

Just to be on the safe side I'm going to boot into safe mode and run Smitfraudfix and all the other programs again.


Thanks for all the help and info.





.

 

[noway]

 

[IndyGunFreak]

 

[noway]

I'll up your Tux, and lay down a Puffer

 

[IndyGunFreak]

I'll up your Puffer...