SmitFraud

Posted by corey

June 30, 2008

After the fourth computer I cleaned this year, I decided to do more research and make a post about SmitFraud for my reference, and all the people that are infected.

What is SmitFraud?

SmitFraud has been identified as a malicious process. SmitFraud is used by rogue software developers to trick users into purchasing various fraudulent software security products from affiliate developers.
Also referred to as W32/SmitFraud.A, this malicious process is categorized as spyware. It is often installed on MS Windows-based machines through a number of adware processes present on MS Windows-based computers. These adware processes can stealthily be dropped along with the installation of codecs with malicious code such as PCodec, BrainCodec, or VideoKeyCodec. Afterwards, SmitFraud is installed without the consent or knowledge of its users.
SmitFraud generates various fake error messages such as a Blue Screen of Death on the background of a Windows-based machine. This can trick users into purchasing various fake software products that are advertised by the error messages as tools that can eliminate security problems already present in the machine. If a user opts to download and automatically install such fake software security programs like Spyware Quake, Spylocked, SpySheriff, Spydawn, and SpyAxe among others, a fake full system scan is initialized.

Afterwards, the user is presented with fake messages instructing him or her to pay for the full version of the currently installed rogue security product in order to remove the malicious processes present in the machine. There are other varies of signs that you will notice with this infection. Such as not being able to see your C:\ drive in my computer, or your clock will change to military time, and display a VIRUS ALERT inside your time clock area.

SmitFraud can be removed by downloading the following tools:
1.    SmitRem - this is a software utility that was designed by NoahdFear to purge malicious programs such as SpySheriff, Spyaxe, WinHound, and PSGuard among others from MS Windows-based machines.
2.    SmitFraudFix - this is an application developed to properly delete malicious processes and registry entries dropped by SmitFraud.
3.    RogueRemover - this is a software application designed to un-install rogue security software programs.
After downloading the applications above and installing each program, users should restart their machines in Safe Mode. This can be done by keying in msconfig in the Run edit box and pressing Ok.

Afterwards, make the necessary selection that will allow you to reboot your computer in Safe Mode. Click on Ok at this point.Next, navigate the Windows Explorer browser to the SmitRem installation folder. Search for the RunThis.bat file. Execute the file by double-clicking on it in order to initialize the SmitRem removal process.

At this point, executing the SmitFraudFix tool will provide you with the options of initially scanning for malicious processes associated with SmitFraud and removing such security risks will allow you to completely remove SmitFraud and all its processes.

Finally, running the RogueRemover program will purge your machine from all fake security software applications currently installed on your computer.

Spyware