Not sure where to post this, but you guys have helped me in the past, so maybe now you can help my sister. She thinks she has a virus named Troj/fakevir/o. I did a little research on it, and I believe it to be fake. Is it? Thank you!

Well , it delivers fake warnings to try and scare you in buying there software , but it isn't fake itself.

Only why does she "think" she has it?


Download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.
Then boot up in safemode (hit f8 when booting up)
Once in Safe Mode, open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 and hit Enter to create a report of the infected files. The report can be found at the root of the system drive, usually at C:\rapport.txt
Please post that log to youre next reply.

Here's the report:

We did it all over the phone and she emailed me her report, so hopefully we did it all right, and this is HER report and not mine.

Here's the report:

Attached Files

rapport.txt (2.1 KB, 5 views)

I understand ofcourse. It wouldn't be of much use to run it on youre pc since her's is the one who's infected.


Download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.
Then boot up in safemode (hit f8 when booting up)

Once in Safe Mode, open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.

A text file will appear onscreen, with results from the cleaning process; please attach that report to your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

And when done, also post an Hijackthis log please.

Here's the two reports:

Attached Files

	rapport.txt (1.7 KB, 1 views)
	hijackthis.log (9.7 KB, 2 views)

I would not take a chance and say any virus was fake. thats just really danagrus.

Computwiz