Spyware? Webpage to llehs.com and errorprotector.com appears

• LazerLordz

  11 Jul 07, 00:28

  I need some help here..
  
  There have been instances of these two websites popping up by themselves, regardless of whether I'm using Firefox 2.0 or IE6.
  
  Which is the file and where is it located, so I may delete them? Does anyone know the registry values of the offending files as well?
  
  Thanks.
• ndmmxiaomayi

  11 Jul 07, 05:04

  What websites have you visited recently? Especially blogs.
  
  Please download SmitFraudFix.exe by S!Ri and save it to the desktop.
  
  

  [*]Double click on SmitfraudFix.exe.
  [*]Press 1 then hit the Enter key.
  [*]It will create a report named rapport.txt, usually at C drive.

  
  
  Note: process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. Read more here
• LazerLordz

  11 Jul 07, 09:42

  Hey, thanks a lot.
  
  I've been getting quarantine reports of vundo, nebuler and bundo on my Symantec too..
  
  Hmm.
• ndmmxiaomayi

  11 Jul 07, 10:15

  Vundo! Although that one isn't nasty, but it isn't so easy to remove also, even with automated tools.