Removing Virus Heat And Smitfraud-c, What A Pain In The ...!

What is Virus Heat? Virus Heat is a fake anti-spyware giving false virus result. Many popups will open mentioning that you are at risk, infected... It's very annoying. Also, Internet Explorer has it's home page changed to go to their homepage. How I was introduced to Virus Heat? My father told me his computer was infected. At first, I used Adware and then Spybot Search & Destroy. Spybot almost removed it but it was still there. So, I searched a little and found some things here and there on how to remove it manually. I expected to go in Safe Mode anyway. But beware, some solution that I found were selling another software solution. Who can you trust in that case? I tried to find reputable sources but that was harder. At least, most mentioned the same files. I was able to remove Virus Heat 3.9.exe and it's parent folder(C:\Program Files) of the same same. But when I started to search for iinqyl.dll, it was no where to be found. The same was for ecxwp.dll and tvtpwp.dll. Only wuuawkz.dll was found in the C:\WINDOWS\SYSTEM32. But in Safe mode, I was not able to unregistered it because it was in use or not in the registry. That's way I think that Spybot Search & Destroy removed part of it. Smitfraud-c appeared but was not removed. So, I had to reboot in Safe mode with Command Prompt. There, I finally deleted wuuawkz.dll. I scanned again using Spybot Search & Destroy again and Smitfraud-c was still there. What is Smitfraud-c? I thought that Smitfraud-c was part the Virus Heat but it's a trojan that downloaded the Virus Heat or other fake spyware. Yes, when I removed Virus Heat, I had another one. Often, it's downloaded when you go see a video on the web and it ask to download a "special" codec to see the video. My father is using Firefox and the sites when it appeared was about tv actors and he did not used Internet Explorer. So, I don't know how exactly he got infected. I did not want to revisit the sites just in case. I told him to go on imdb.com instead next time. I had to use AVG free(anti-virus) to remove Smitfraud-c and it found C:\Program Files\NetProject\wamdl.dll that was infected. Because I did not know what Netproject was about, I renamed it just in case. Other files included in the folder were: scm.exe, waun.exe, ot.ico, scu.exe, scit.exe. Then I use again Spybot Search & Destroy. Smitfraud-c was still found in the registry. After rebooting, I scanned the computer with Spybot and AVG. That's was for being sure that no residual traces were left in the registry or files. Solution In short, scan with AVG first, scan with Spybot Search & Destroy and reboot and scan again. If you have Windows Defender or other software, it won't hurt to scan with it too. Steps(free way):

1. Open AVG free and make sure it's up to date
2. Scan with AVG
3. Open Spybot(free) and make sure it's up to date
4. Scan with Spybot
5. Restart the computer
6. Scan with other anti spyware if you got one
7. Redo from step 2, skip 3 to make sure that all were removed

If the solution worked great for you, why not Scratch my back (see sidebar) ? It's way cheaper than what it would had cost if you took your computer to the shop . Plus, you get some publicity in return. ;) If you are not sure or the solution did not worked, just buy PC Tools Spyware Doctor(download, 3 PCs) or PC Tools Spyware Doctor(Box) from Amazon.com. With the latter, you will some money but you must be patient while you wait for the box. Read further below about the review is got from PCMag. I also created a "super folder" on the desktop and move all shortcuts in it. So, if my dad see another icon on the desktop, he will know something fishy is going on. I will try that for a time.Otherwise, I will have to create a new account with restricted privilege forcing my dad to login each time. The computer is already slow to boot with one account gaving him time to do other stuff while it was booting. ;) Conclusion Virus Heat was a pain to remove from my dad's computer. Plus, I had Smitfraud-c to deal with at the same time making it harder. But, I did not have to buy any new software. I lost many hours on this and hope you won't by reading this. Reading recent computer magazine sites like PCMag, PC Tools Spyware Doctor(download, 3 PCs) was highly recommended because it was the best to find them. But when I started to read the comments(link above on Amazon) on Spyware Doctor by users, it seemed to slow down the computer. My advice would be to buy it if you want but not install the resident in memory if possible. So, if you think you are infected, just scan the computer or do a scan with Spyware Doctor weekly instead for prevention. Edit 1: AVG has updated the virus signature to better detect Smitfraud-c. The filed in folder(netproject) that I had renamed are now being seen as infected. So, I deleted them. I also, made the instruction more clear now.