Eh, I've been absent from here for a looooooong time, been dealing with lots of stuff :S


Anyways, one of my friends phoned me and was going hysterical blabbering bout some nasty stuff getting on his 'pooter, I just thought he was talking bout some annoying little spyware bot or something, but when he said SpyMarshal it brought back a nasty memmory of me battling with that program for a week before formatting (was a few years back).

I got him to send me a HijackThis log, I took a quick look but there's some thing I don't recognise so I told him to sit tight and leave his computer on for now since I know that program likes doing things when you boot up. I had him disable system restore already and remove the program for now.
Interesting to note, his SpyBot kept looping back to a file called "Baciami" and eventually it read that the scan was canceled by the user although he didn't click anything.

Attached is his HJT log, an answer ASAP would be greatly appreciated, aparently he's losing system settings gradually and he already lost some of his desktop functionality.

Welcome back Darklord!

A security analyst will look at your log soon.

Moved to Hijackthis Logs forum.

Oops, wasn't too sure if it went into HJT or Spyware since it's both sort of

Thanks

Doesnt matter but for in future (hopefully not) just put it into the Hijackthis logs forum. Thanks.

Will do (hopefully there won't be a next time... don't like spyware too much hehe)

Eagerly awaiting an answer so I can tell my friend what to do

Hello.

Please get your friend to download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm

Thanks, I'll let him know and post back as soon as I get an answer from him