Sunday, December 16, 2007

Trojan.Win32.Obfuscated.gx

Trojan.Win32.Obfuscated.gx Fake Alert Message:

Critical System Error!“Your browser was infected by Trojan.Win32.Obfuscated.gx You need to clean your system immediately, in other case it can be crashed soon! Click OK to download the high-tech antispyware protection software! (Recommended)”

Do not click or download any product that is recommended on the Trojan.Win32.Obfuscated.gx fake alert message.


Trojan.Win32.Obfuscated.gx Automatic Removal Instructions


"http://siri.urz.free.fr/Fix/SmitfraudFix.exe"



This automatic removal method is for non-techie computer users. If you’re too lazy to learn about spyware removal or how to access sensitive files in your computer, then this is the method for you.

Before you start: Print or bookmark these instructions because you’ll have to reboot into Safe Mode. Also back up your computer in case you make a mistake.
Download and save SmitfraudFix to your desktop.

Restart your computer in . Once thedesktop appears, double click on the SmitFraudfix.exe on your desktop.
After the credits screen, you’ll see a menu as shown in the image below.Select the option number 2, which is ‘Clean (safe mode recommended)’, and thenpress Enter to delete infect files.
SmitfraudFix will begin cleaning your computer and take a series of cleanupprocesses. When the process is over, it will automatically begin the DiskCleanup program. View the ‘Disk Cleanup program’ image below.
Once the Disk Cleanup program is complete, you will be prompted with themessage ‘Registry cleaning - Do you want to clean the registry’. Answer Y (Yes)and hit Enter. Reboot your computer.
SmitfraudFix will now check if wininet.dll is infected. SmitfraudFix willask you whether to replace the infected file (if there’s any) ‘Replace infectedfile?’ Answer by typing Y (Yes) and hit Enter.
Reboot your computer to complete the cleaning process.
After reboot, a Notepad screen may appear containing a log of all the filesremoved from your computer. If it doesn’t appear, a file will be created calledrapport.txt in the root of your drive, (Local Disk C:).
Restart your computer in
.

. Once thedesktop appears, double click on the SmitFraudfix.exe on your desktop.
After the credits screen, you’ll see a menu as shown in the image below.Select the option number 2, which is ‘Clean (safe mode recommended)’, and thenpress Enter to delete infect files.
SmitfraudFix will begin cleaning your computer and take a series of cleanupprocesses. When the process is over, it will automatically begin the DiskCleanup program. View the ‘Disk Cleanup program’ image below.
Once the Disk Cleanup program is complete, you will be prompted with themessage ‘Registry cleaning - Do you want to clean the registry’. Answer Y (Yes)and hit Enter. Reboot your computer.
SmitfraudFix will now check if wininet.dll is infected. SmitfraudFix willask you whether to replace the infected file (if there’s any) ‘Replace infectedfile?’ Answer by typing Y (Yes) and hit Enter.
Reboot your computer to complete the cleaning process.
After reboot, a Notepad screen may appear containing a log of all the filesremoved from your computer. If it doesn’t appear, a file will be created calledrapport.txt in the root of your drive, (Local Disk C:).
Restart your computer in
Go to C:\Windows\Temp, click Edit, click Select All, press DELETE, and thenclick Yes to confirm that you want all the items to go to the Recycle Bin.

Go to C:\Documents and Settings\[LISTED USER]\Local Settings\Temp,click Edit, click Select All, press DELETE, and then click Yes to confirm thatyou want all the items to go to the Recycle Bin.

Reboot your computer back to normal mode. Go to Windows Update and downloadall critical updates.

Trojan.Win32.Obfuscated.gx Manual Removal Instructions
This manual removal method is for techie computer users. Trojan.Win32.Obfuscated.gx manual removal may be difficult and time consuming to remove. There’s no guarantee that Trojan.Win32.Obfuscated.gx will be removed completely. So read the Trojan.Win32.Obfuscated.gx removal steps carefully and good luck.
Before you start: Close all programs and Internet browsers. Also back up your computer in case you make a mistake and your computer stops working.
Uninstall Trojan.Win32.Obfuscated.gx Program
Click on Start > Settings > Control Panel > Double-click on Add/Remove Programs. Search for and uninstall Trojan.Win32.Obfuscated.gx if found.
To stop Trojan.Win32.Obfuscated.gx processes (view process removal steps)
Go to Start > Run > type taskmgr. The click the Processes tab and you’ll see a list of running processes.

For each unwanted process, right-click on it and then select “End task”.

To Unregister Trojan.Win32.Obfuscated.gx DLLs (view DLL removal steps)

Search and unregister these Trojan.Win32.Obfuscated.gx

DLLs:stream32a.dllvipextqtr.dllecxwp.dllgebca.dllddcdedd.dlladvrepkon.dllddccd.dllsgqddvym.dllpofwjina.dllbkfgnqhm.dllorkbobob.dlltuvttrr.dllcpwvehup.dllenhtb.dllmlljh.dllibpmxtbv.dllljjhedc.dllcabvie.dllwindivx.dllddayv.dllvkcxxfvi.dllssqpo.dlladvpac.dlltdlRMS.dlllcxmehhg.dllhdbxuqje.dllmljge.dllddcbyvt.dll

To locate the Trojan.Win32.Obfuscated.gx DLL path, go to Start > Search > All Files or Folders.

Type Trojan.Win32.Obfuscated.gx and in the Look in: select either My Computer or Local Hard Drives. Click the Search button.

Once you have the Trojan.Win32.Obfuscated.gx DLL path, go to Start and then click on Run. In the Run command box, type cmd, and then click on OK.

To locate the exact DLL path, type cd in order to change the current directory. To display the contents of the directory, use the dir command. To remove the DLL file type regsvr32 /u

FILENAME.dll (FILENAME is the name of the file that you want to unregister).

To unregister Trojan.Win32.Obfuscated.gx registry keys

Go to Start > Run > type regedit > press OK.

Edit the value (on the right pane) by right-clicking on it and selecting the Modify option. Select the Delete option.

Search and delete these Trojan.Win32.Obfuscated.gx registry keys:7d4b39e4cab018496e2fe9bf9c3234b2
69c9be662f7f284aae171adeb136cb24
1bc5752bd72f44f004d9f061dd7f9e00
bcf3a381bbe26d9c1ec24bac8b18f567
8266c79a434aed795a5f3f7abb0aff0d
696ce23305a35bb118afc42d58845791
2982068d063848ddb0b8029750411a84
fe6e6a62a572e84e9eaee12eb3ee8a2b
1057a2dcd13130963be0a51c41dc4d1c
396955766b2e512bc3545a24bc485dbe
5f9523529ce2cac480acbda2b8bf4e1e
7df5417b22988d88e8080a44392ade95
cbdc7b3033e82c2065a1b48061b2ca01
6d3c4dbecf4aaf1ae826a0a7edde5951
e05997f932f826f0271cf32d00bbd3be
c18c3b4771120703624baaf835feecd8
9ceecf911241c9890541167edf53739f
40613dee6ad5fec910606c25b25262fd
3ba096caa45ab117721e725079cc53a1
bb5be1c92c299a1c6bcfe67655b0a0c7
9a9f57899a28547b04fc2da3700c95cf
7a329404de21925daacbbbee093ff6dc

If your homepage has been changed, go to Start > Control Panel > Internet Options > click on the General > click Use Default under Home Page. Add the your desired default homepage, then click Apply > click OK. Open a new web browser to check that you have your desired default homepage.

To remove Trojan.Win32.Obfuscated.gx icons on your Desktop, drag and drop them to the

Recycle Bin.
You’ve completed the Trojan.Win32.Obfuscated.gx manual removal instructions!

I hope this article has helped you solve your Trojan.Win32.Obfuscated.gx problems.

No comments: