Anilrgowda

uestion: I am finding that even after deleting c:\windows\temp\smartdrv.exe - it still comes back somehow. AVG detected this as a virus. I deleted in safe mode and it does delete. It also clears startup entries but then after rebooting it will come back in both startup entries and also the actual program file in the same location.

I also booted to the recovery console and manually deleted but somehow still is coming back. No other suspicious program entries at startup.

Oddly... the system seems to run Ok but I know that this is not a legit program!
If anyone has a solution or knowledge on what this is please advise. THanks

------------------

Anilrgowda

smartdrv.exe in the system32 folder belongs to smitfraud infection, but that one is in the temp, have you tried cleaning your temp folder with CCleaner or ATF cleaner.


You could also try smitfraudfix, the SUPERAntispyware as already suggested.
SmitfraudFix:
SmitFraudFix
Extract the content (a folder named SmitfraudFix) to your Desktop.
Next, please reboot your computer in Safe Mode by rebooting the computer,
and repeatedly tapping the F8 key as the pc starts. Choose "Safe Mode" from
the options listed.

Once in Safe Mode, open the SmitfraudFix folder again and double-click
smitfraudfix.cmd

Select option #2 - Clean by typing 2 and press "Enter" to delete infected
files.

You will be prompted : "Registry cleaning - Do you want to clean the
registry?" answer "Yes" by typing Y and press "Enter" in order to remove
the Desktop background and clean registry keys associated with the
infection.

The tool will now check if wininet.dll is infected. You may be prompted to
replace the infected file (if found); answer "Yes" by typing Y and press
"Enter".

The tool may need to restart your computer to finish the cleaning process;
if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

You could also show us a hijackthis log.
http://danborg.org/spy/hjt/alternativ.exe
Open Hijackthis, click "Do a system scan and save a logfile" please don't fix anything yet.


OR:
Run combofix and show us the log.
Download ComboFix to your Desktop, from either of these locations:
http://www.techsupportforum.com/sect...s/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Double click "combofix.exe" and follow the prompts.
When finished, it shall produce a log for you.
Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

------------------