From: "Bryan Hesters" <Bryan
Hesters@discussions.microsoft.com>
| David,
|
| You are very knowledgable on this topic, but I was a bit confused by this
| post. Is Spyaxe synonymous with PSguard, and if so, does SmitFraud work with
| MCE 2005? I seem to have contracted PSguard (detected with ad-aware), and
| have found several references to SmitFraud as the solution to my problem, but
| despite having run the batch file three times now, it doesn't seem to clear
| the problem.
|
| I suspected that perhaps a change in directory structure or file names might
| cause the batch file to fail, and I would appreciate your confirmation that
| these instructions are applicable to MCE.
|
| Thanks!
|
|
Yes, a PC infected with SpyAxe and/or the SmitFruad Trojan can be infected with PS Guard.
What is "MCE 2005" ? I don't don't know what that is.
Follow all the directions in the following tools.
You may have to run them in Safe Mode as well as in Normal Mode.
Two part reply..
Perform Part 1 and then perform Part 2.
Use the alternate if the first two parts are ineffective...
Note: Alternate only for Win2K, WinXP and Win2003 Server
Part 1
-----------
Use noahdfear's SmitFraud and SpyAxe removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click...click.php?id=1
http://www.bleepingcomputer.com/forums/topic36868.html
Part 2
-----------
Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe
Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close
NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.
Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }
A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.
Alternate:
Part 1
-----------
Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool.
http://secured2k.home.comcast.net/tools/AntiPuper.exe
http://forums.mcafeehelp.com/viewtopic.php?t=65072
Part 2
-----------
Swandog46's Apropos Adware/RootKit remover
http://swandog46.geekstogo.com/aproposfix.exe
* * * Please report back your results * * *
--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm