Smitfraud Description

SmitFraud (also known as W32/SmitFraud.A) is a malicious spyware application that may install itself secretly via adware. SmitFraud may also be brought into your computer bundled with a fake codec (that may include the following: BrainCodec, VideoKeyCodec or PCodec). SmitFraud is designed to inject a corrupt code in Windows DLL that usually results in Blue Screen of Death (a nasty desktop modification). SmitFraud may also generate misleading warning messages, in order to scare gullible computer users into buying fraudulent anti-spyware applications. It is strongly recommended to dispose of SmitFraud as soon as possible.

Type: Trojans

Automatic Detection of Smitfraud

Smitfraud Technical Report

As new Smitfraud details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Smitfraud files with its MD5s were created in the system:

Smitfraud has typically the following processes in memory:

• hookdump.exe
• msmsgs.exe
• popuper.exe
• hhk.dll
• shnlog.exe
• winstall.exe
• drsmartload45a45m.exe
• drsmartload192a[1].exe
• drsmartload46a7i.exe
• drsmartload45a7h.exe
• drsmartload46a[1].exe
• drsmartload849a[1].exe
• drsmartload45v.exe
• drsmartload100a[1].exe
• drsmartload46a.exe
• drsmartload1.exe
• cproc.exe
• tazth.dll
• MTE3NDI6ODoxNg[1].exe
• olnohdw.dll
• ssqnool.dll
• wjiio.exe
• retadpu.exe
• bndsrgxt.dll
• domnftwmnf.dll
• dxpvqlmtqn.dll
• asgp32.dll
• helper.exe
• intmonp.exe
• ole32vbs.exe
• param32.dll
• oleadm32.dll
• winhook.exe
• zloader3.exe
• drsmartload849a849m.exe
• drsmartload45a7i.exe
• drsmartload.exe
• drsmartload849a7h.exe
• drsmartload45a[1].exe
• oybgrql.dll
• drsmartload849v.exe
• drsmartload45a.exe
• drsmartload95a.exe
• ntsystem.exe
• ixt2.dll
• MTE3NDI6ODoxNgnew.exe
• drsmartload815a.exe
• arpl.exe
• vtursro.dll
• retadpu[2].exe
• oembios32.dll
• domnftwost.dll
• domnftwlvq.dll
• n2ewma1xxsv2234.exe
• faceback.exe
• bsw.exe
• intmon.exe
• msole32.exe
• wldr.dll
• oleadm.dll
• uninstiu.exe
• wp.exe
• drsmartload46a46m.exe
• dnr4019qe.dll
• drsmartload849a7i.exe
• drsmartload46a7h.exe
• loader[1].exe
• drsmartload849a8b5.exe
• drsmartload46v.exe
• atmtd.dll
• drsmartload849a.exe
• MTE3NDI6ODoxNg.exe
• winetn32.dll
• drsmartload44a[1].exe
• drmv2clt.exe
• retadpu77.exe
• retadpu21.exe
• retadpu[1].exe
• retadpu1000106.exe
• bndsrdkq.dll
• domnftwwrn.dll
• dxpvqlmqng.dll
• gndarmblsnv.dll

Smitfraud creates the following registry entries:

• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunmsnmessenger
• HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainDefault_Search_URL=[siteaddress]
• HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainLocalPage=[siteaddress]
• HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerSearchURL(Default)=[siteaddress]
• f79fd28e-36ee-4989-aa61-9dd8e30a82fa
• SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\64ba30a2-811a-4597-b0af-d551128be340
• ed39ecef-902e-4ed1-8434-71e8db89e5ca
• Microsoft\drsmartload2
• 03413bf7-e34c-445b-bfc0-a2b127255871
• dfa61db1-388e-4c87-8d56-540fa229bcb4
• 5f938c17-fbc7-4a3c-8526-85e5b1a1f762
• SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\b292ec9f-a074-4115-8342-1f459702d8d2
• MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ssqnool
• AB5FE6E5-7C72-4B89-85D0-D57E7AEAC236
• 6a307130-b248-4b23-b2b7-4498da8c977a
• 1AC7107A-938F-4347-864C-C51E49EC586E
• 9D2C4CFB-0C11-4658-9EF5-B05BED9CC447
• D878CD49-CE41-4434-831D-EFC15D06D25C
• 973ecdd8-1e81-4c28-b5a1-69966c0a2ce4
• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunWindowsFZ
• HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainDefault_Page_URL=[siteaddress]
• HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainSearchPage=[siteaddress]
• HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerSearchSearchAssistant=[siteaddress]
• D5BC2651-6A61-4542-BF7D-84D42228772Centry.
• SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\aea3d2df-2b2c-4d7b-81a0-d975c6dc088e
• WMuse
• 64ba30a2-811a-4597-b0af-d551128be340
• Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\incestuously
• f31aee4a-1530-4fef-8537-79c6973bff9a
• Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\5f938c17-fbc7-4a3c-8526-85e5b1a1f762
• Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\instcat
• FD2A7D3A-3DA1-4CA5-AD39-B4C3A72B567F
• 0B9B7B2E-30E3-4C5D-AD2C-C38724979B4B
• C2DE4340-CB68-450F-90CD-9BE1A26739D7
• C4248759-304D-477D-A1B3-F706CF99756D
• 3808C05F-CFB0-4C9B-858D-851CC3EBB3BC
• 8AC6FA22-65B6-41B0-B0BB-243F35B86E74
• 4480F41F-F91F-4781-B1EA-30D261DA06AC
• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunWindowsFY
• FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF
• HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainSearchBar=[siteaddress]
• HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerSearchCustomizeSearch=[siteaddress]
• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallinternetupdate
• SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\decorin
• 5839511e-ec1b-4f91-ace3-fb88e52f5239
• aea3d2df-2b2c-4d7b-81a0-d975c6dc088e
• 19452E5B-963F-4886-766D-0526284B6F61
• Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\f31aee4a-1530-4fef-8537-79c6973bff9a
• SOFTWARE\Policies\06849E9F-C8D7-4D59-B87D-784B7D6BE0B3
• 27321538-5739-4aa1-b84c-7d18e4383f1f
• b292ec9f-a074-4115-8342-1f459702d8d2
• MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\vtursro
• 3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A
• 87EF7048-8905-4E82-862E-65004D4DFA80
• 5085333B-FD15-4754-A571-852F7077C5F2
• EACC5636-980A-4D26-9250-1CF418E6D1D1
• BA6BD7B1-990F-4D05-8D6C-9CBAFCB3C7ED
• 82B07A2B-F0AF-45FC-BE44-18D83B01EAD9

Important Article Disclaimer