Associated Malware Groups
The unsafe files using this name are associated with the malware groups:
- Malicious Software
- Cloaked Malware
File Behavior
SMITFRAUDFIX[n].EXE has been seen to perform the following behavior:
- Found on infected systems and resists interrogation by security products
- Uses low level functions to hide itself from the user and from system/security processes
- This process creates other processes on disk
- Executes a Process
SMITFRAUDFIX[n].EXE has been the subject of the following behavior:
- Created as a process on disk
- Executed as a Process
- Deleted as a process from disk
- Has code inserted into its Virtual Memory space by other programs
- Created by processes which appear to be checking for interception by security products
Country Of Origin
The filename SMITFRAUDFIX[n].EXE was first seen on Feb 4 2008 in the following geographical regions of the Prevx community:
- FRANCE on Feb 4 2008
- LITHUANIA on Feb 4 2008
- CANADA on Sep 16 2008
- SPAIN on Sep 30 2008
- SOUTH AFRICA on Jun 11 2009
File Name Aliases
SMITFRAUDFIX[n].EXE can also use the following file names:
- SMITFRAUDFIX.EXE
- 77962796.EXE
- 65796188.DAT
- 15799031.EXE
- 92893081.EXE
- 22449878.EXE
- SMITFRAUDFIX V2.419.EXE
- SMITFRAUDFIX (REMOVE STUBBORN SPYWARE).EXE
- SMITFRAUDFIX_V2.422.EXE
- DOC.EXE
- RUZMV8LZ.EXE.PART
- 75051093.SVD
- 52258614.SVD
- 39507644.DAT
- 92567652.EXE
- SMITFRAUDFIX (n).EXE
- SMITFRAUDFIX(n).EXE
- SMITFRAUDFIX 2357.EXE
- MB34RNRK.EXE
- 90844584.EXE
- 32664334.EXE
- 36835146.DAT
- SMITFRAUDFIX 2.359.EXE
- SMITFRAUDFIX_SMITFRAUDFIX_2.359_FRANCAIS_253624.EXE
Filesizes
The following file size has been seen:
- 1,212,782 bytes
- 1,884,866 bytes
- 2,880 bytes
- 49,640 bytes
- 1,659,896 bytes
- 1,578,760 bytes
- 1,660,612 bytes
File Type
The filename SMITFRAUDFIX[n].EXE is used by multiple object types including self extracting compressed files,executable programs.
File Activity
One or more files with the name SMITFRAUDFIX[n].EXE creates, deletes, copies or moves the following files and folders:
- Copies fileSmitfraudFix\Process.exe to c:\windows\system32\Process.exe
- Copies fileSmitfraudFix\swreg.exe to c:\windows\system32\swreg.exe
- Copies fileSmitfraudFix\swsc.exe to c:\windows\system32\swsc.exe
- Copies fileSmitfraudFix\SrchSTS.exe to c:\windows\system32\SrchSTS.exe
- Copies fileSmitfraudFix\dumphive.exe to c:\windows\system32\dumphive.exe
- Copies fileSmitfraudFix\swxcacls.exe to c:\windows\system32\swxcacls.exe
- Copies fileSmitfraudFix\VCCLSID.exe to c:\windows\system32\VCCLSID.exe
- Copies fileSmitfraudFix\WS2Fix.exe to c:\windows\system32\WS2Fix.exe
- Copies fileSmitfraudFix\IEDFix.exe to c:\windows\system32\IEDFix.exe
- Copies fileSmitfraudFix\VACFix.exe to c:\windows\system32\VACFix.exe
- Copies fileSmitfraudFix\404Fix.exe to c:\windows\system32\404Fix.exe
- Copies fileSmitfraudFix\AntiXPVSTFix.exe to c:\windows\system32\AntiXPVSTFix.exe
- Copies fileSmitfraudFix\IEDFix.C.e to c:\windows\system32\IEDFix.C.e
- Copies fileSmitfraudFix\IEDFix.C.e to c:\windows\system32\o4Patch.exe
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.