Spyware/Adware Infection Precaution Advisory

• ndmmxiaomayi

  25 Oct 06, 20:17

  PornPass Manager
  
  Welcome our latest anti-spyware!
  
  Read more here.
  
  DO NOT download this program!
  
  A fix is available if you have see similar screenshots in the above link.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available below.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
  
  Extracting files
  
  For Windows XP users
  
  

  [*]Right click on SmitfraudFix.zip and select Extract All.
  
  
  
  [*]You will see the window below. Click Next.
  
  
  
  [*]You will see this window below:
  
  
  
  If you have saved it to your desktop, XP Extraction Wizard would extract it to the desktop. If you are not comfortable with the desktop, you can choose another location by clicking on the Browse button. After selecting a location, click Next
  [*]Windows will start extracting the files. Once it is done, you will see the window below:
  
  
  
  Tick the Show extracted files box. Now you can run the SmitfraudFix.cmd file.

  
  
  For 7-Zip users
  
  

  [*]Right click on SmitfraudFix.zip. Move the cursor down to 7-Zip and then select Extract here.
  
  
  
  A SmitfraudFix folder will be on your desktop if that's where you save it.
  [*]Double click on the SmitfraudFix folder.
  [*]Find SmitfraudFix.cmd. Double click to run it.

  
  
  For Winzip users
  
  

  [*]Right click on SmitfraudFix.zip. Move the cursor down to WinZip and select Extract to here.
  
  
  
  A SmitfraudFix folder will be on your desktop if that's where you save it.
  [*]Double click on the SmitfraudFix folder.
  [*]Find SmitfraudFix.cmd. Double click to run it.

  
  
  For WinRar users
  
  

  [*]Right click on SmitfraudFix.zip. Select Extract Here.
  
  
  
  A SmitfraudFix folder will be on your desktop if that's where you save it.
  [*]Double click on the SmitfraudFix folder.
  [*]Find SmitfraudFix.cmd. Double click to run it.

  
  
  For PowerArchiver users
  
  

  [*]Right click on SmitfraudFix.zip. Select Extract Here.
  
  
  
  A SmitfraudFix folder will be on your desktop if that's where you save it.
  [*]Double click on the SmitfraudFix folder.
  [*]Find SmitfraudFix.cmd. Double click to run it.
• ndmmxiaomayi

  31 Oct 06, 10:23

  MyPornMagPass
  
  More about it here
  
  DO NOT download this program!
  
  A fix is available if you have see similar screenshots in the above link.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  31 Oct 06, 10:34

  More fakes...
  
  This is a variation of VirusBurst and VirusBurster. It's called VirusBursters.
  
  Read read!!!
  
  DO NOT download this program!
  
  A fix is available if you have see similar screenshots in the above link.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
  
  Another removal guide by Bleeping Computer.
• ndmmxiaomayi

  1 Nov 06, 23:44

  This is older than VirusBursters. I actually missed it out.
  
  It's called AntiVermis.
  
  http://www.jahewi.nl/antivermins/antivermins.html
  
  DO NOT download this program!
  
  A fix is available if you have see similar screenshots in the above link.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  1 Nov 06, 23:55

  Hmm... even codecs can't be trusted now.
  
  TrueCodec is one of them.
  
  When you download and install TrueCodec, these programs will be installed.
  
  Safety Alerter 2006
  
  Internet Explorer Security Plugin 2006
  
  Public Messenger ver 2.03
  
  VirusBurster(s) 6.2
  
  The installation file icon:
  
  DO NOT download this program!
  
  A fix is available if you have see similar icon or if you have downloaded TrueCodec.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  2 Nov 06, 00:01

  The next bad codec... PCodec
  
  Installation icon:
  
  More information
  
  DO NOT download this program!
  
  A fix is available if you have see similar screenshots in the above link and/or if you have installed PCodec.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
  
  You might need to Gromozon removal tool, as it may come bundled with it.
  
  http://www.prevx.com/gromozon.asp
• ndmmxiaomayi

  2 Nov 06, 07:56

  ZCodec
  
  http://www.jahewi.nl/zcodec/zcodec.html
  
  Installation icon:
  
  DO NOT download this program!
  
  If your antivirus and anti-spywares have real-time protection mode on, it will detect a trojan horse immediately the file is ran.
  
  A fix is available if you have see similar screenshots in the above link and/or if you have installed ZCodec.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  2 Nov 06, 08:06

  iCodecPack
  
  DO NOT download this program!
  
  Screenshot of the website:
  
  Installation file icon:
  
  Running this installation file will install the following programs:
  
  iCodecPack 7.0
  
  Internet Explorer Security Plugin 2006
  
  Internet Security AddOn
  
  Public Messenger Ver2.03
  
  Safety Alerter 2006
  
  Removal
  
  A fix is available if you have been to the above website to download and install iCodecPack.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  2 Nov 06, 08:13

  PlayerCodec
  
  DO NOT download this program!
  
  This affects people who loves to visit porn sites.
  
  http://www.jahewi.nl/rogues/playercodec/playercodec.html
  
  For those who have antivirus and anti-spywares real-time protection mode on, it will detect new trojans immediately the file is ran.
  
  Installation file icon:
  
  Removal
  
  A fix is available if you see similar screenshots in the above link and/or if you have installed PlayerCodec.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  2 Nov 06, 08:19

  StrCodec
  
  DO NOT download this program!
  
  http://www.jahewi.nl/rogues/strcodec/strcodec.html
  
  Removal
  
  A fix is available if you have see similar screenshots in the above link and/or if you have installed StrCodec.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  2 Nov 06, 09:05

  MPCodec
  
  Hmm... the website for downloading this codec is dead officially. Don't know when it died.
  
  Anyway, there's a chance that you might have installed it.
  
  http://www.jahewi.nl/rogues/mpcodec/mpcodec.html
  
  Installation file icon:
  
  DO NOT download this program if you find it anywhere!
  
  Removal
  
  A fix is available if you have see similar screenshots in the above link and/or if you have installed MPCodec.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  2 Nov 06, 09:12

  WinMediaCodec
  
  DO NOT download this program!
  
  http://www.jahewi.nl/rogues/wmcodec/wmcodec.html
  
  The following programs are installed as well when you in WinMediaCodec:
  
  Internet Explorer Security Plugin 2006
  
  Internet Security AddOn
  
  Public Messenger Ver2.03
  
  Safety Alerter 2006
  
  Removal
  
  A fix is available if you have see similar screenshots in the above link and/or if you have installed WinMediaCodec.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  2 Nov 06, 10:10

  MMCodec
  
  It is known by a few other names. MMediaCodec, MultiMediaCodec, etc.
  
  MMCodec is not to be confused with MMConvert, which is legitimate.
  
  DO NOT download this program if you come across it! With the exception of MMConvert.
  
  Removal
  
  A fix is available if you have see similar screenshots in the above link and/or if you have installed MMCodec or any other codes that have a similar name.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  3 Nov 06, 08:08

  VideoCodec
  
  It is also known as VidCodec.
  
  DO NOT download this program if you come across it!
  
  File icon:
  
  When you install VidCodec, these programs are installed as well:
  
  TrueCodec 5.0
  
  Safety Alerter 2006
  
  Public Messenger ver 2.03
  
  VirusBursters 6.2
  
  Removal
  
  A fix is available if you have VidCodec or VideoCodec installed and your computer is prompting you that you are infected.
  
  An example is below:
  
  
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  3 Nov 06, 08:20

  iVideoCodec
  
  DO NOT download this program if you come across it!
  
  File icon:
  
  Removal
  
  A fix is available if you have iVideoCodec installed.
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  3 Nov 06, 08:24

  KeyCodec
  
  It could be VideoKeyCodec as well, depending on when you are infected by it.
  
  DO NOT download this program if you come across it!
  
  File icon:
  
  When you install KeyCodec, these programs are installed as well:
  
  VideokeyCodec 11.0
  
  Safety Alerter 2006
  
  Internet Explorer Security Plugin 2006
  
  Public Messenger ver 2.03
  
  VirusBursters 6.2
  
  Removal
  
  A fix is available if you have KeyCodec or VideoKeyCodec installed and your computer is prompting you that you are infected.
  
  An example is below:
  
  
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  3 Nov 06, 08:28

  VCCodec
  
  It may be VideoCompressionCodec as well, depending on when you are affected by it.
  
  DO NOT download this program if you come across it!
  
  File icon:
  
  When VCCodec or VideoCompressionCodec is installed, these programs are installed as well:
  
  VideoCompressionCodec 10.0
  
  Safety Alerter 2006
  
  Internet Explorer Security Plugin 2006
  
  Public Messenger ver 2.03
  
  VirusBurster 6.2
  
  Removal
  
  A fix is available if you have VidCodec or VideoCodec installed and your computer is prompting you that you are infected.
  
  An example is below:
  
  
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  3 Nov 06, 08:33

  TrueCodec
  
  DO NOT download this program if you come across it!
  
  File icon:
  
  When TrueCodec is installed, these programs are installed as well:
  
  TrueCodec 5.0
  
  Safety Alerter 2006
  
  Internet Explorer Security Plugin 2006
  
  Public Messenger ver 2.03
  
  VirusBurster(s) 6.2
  
  Removal
  
  A fix is available if you have VidCodec or VideoCodec installed and your computer is prompting you that you are infected.
  
  An example is below:
  
  
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  3 Nov 06, 08:37

  HQCodec
  
  DO NOT download this program if you come across it!
  
  File icon:
  
  When HQCodec is installed, these programs are installed as well:
  
  HQVideoCodec 4.0
  
  Safety Alerter 2006
  
  Internet Explorer Security Plugin 2006
  
  Public Messenger ver 2.03
  
  VirusBurster(s) 6.2
  
  Removal
  
  A fix is available if you have VidCodec or VideoCodec installed and your computer is prompting you that you are infected.
  
  An example is below:
  
  
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• ndmmxiaomayi

  3 Nov 06, 08:43

  SoftCodec
  
  DO NOT download this program if you come across it!
  
  File icon:
  
  When SoftCodec is installed, these programs are installed as well:
  
  SoftCodec 9.0
  
  Safety Alerter 2006
  
  Internet Explorer Security Plugin 2006
  
  Public Messenger
  
  Internet Security Add-On
  
  Removal
  
  A fix is available if you have VidCodec or VideoCodec installed and your computer is prompting you that you are infected.
  
  An example is below:
  
  
  
  

  [*]Download the latest version of SmitfraudFix and save it to your desktop. If you already have a copy of this, please delete the old copy. This fix is always updated.
  [*]Extract it to your desktop. A small guide on extracting is available here.
  [*]Double click on SmitfraudFix.cmd.
  [*]Type in 1 to create a report. This will indicate if you are infected.
  [*]Once it's done, you should find a report named rapport.txt on your C drive if your Windows is installed there.

  
  
  Copy and paste this report in the forum and somebody will analyze if you are infected or not.
• lpx88

  3 Nov 06, 22:30

  scary..they seem to be safe on surface
• ndmmxiaomayi

  3 Nov 06, 22:33

  Yup... a lot of them are popping up lately, no time to keep up with them.
• Y_Shun

  8 Nov 06, 14:57

  Originally posted by ndmmxiaomayi:

  New fake anti-spyware found, it goes by the name of VirusBurst.
  
  
  
  
  
  Removal instructions from Bleeping Computer
  
  More details: http://www.bleepingcomputer.com/securityblog/2006/08/31/virusburst-rogue-antispyware/
  
  Edit: Newer updates to this variant, it seems to be linked to a rootkit named Gromozon.
  
  Gromozon is the latest baddie in the security field, and it disables almost every tool available against it. This means F-Secure Blacklight, Sophos Anti-rootkit, Gmer, Icesword and Avenger barely works. The only removal tool that seems to be able to work is Prevx1 Gromozon Rootkit Removal, available here. There appears to have some errors while running this tool, so just be careful when using it.
  
  Full details for this variant
  
  By the way, no matter what browser you use, you will be attacked. I think Internet Explorer users may have a higher chance of escaping this, by not accepting any ActiveX downloads. Perhaps the only good news for IE users.
  
  PDF writeup for Gromozon
  
  Hmm... playing with some addons of Firefox and it's quite good if you are worried about getting it.
  
  https://addons.mozilla.org/firefox/722/
  http://www.extensionsmirror.nl/lofiversion/index.php/t5083.html
  https://addons.mozilla.org/firefox/1237/

  help arh..i kana tis one, i went to the website and then i downloaded the roguescanfix_setup.exe and i think it removed the whole program liao. i never see the "fake security ballon" liao..is that safe enough?/clean enough?
• ndmmxiaomayi

  8 Nov 06, 17:18

  Originally posted by Y_Shun:

  help arh..i kana tis one, i went to the website and then i downloaded the roguescanfix_setup.exe and i think it removed the whole program liao. i never see the "fake security ballon" liao..is that safe enough?/clean enough?

  I can never be sure.
  
  You post a HijackThis log and a SmitfraudFix log.
• Y_Shun

  8 Nov 06, 18:18

  Originally posted by ndmmxiaomayi:

  I can never be sure.
  
  You post a HijackThis log and a SmitfraudFix log.

  where to get it?