How To Remove convite.exe Win32:Spyware-Gen Infection "convite.exe"

Dangerous: YES

Associated Files:
convite.exe, downloads_r.com, Download_Imagem.zip. Ifn.ini, Mast.ini, sxmc.ini, diagx3d.dll, smastsj.exe, unchsy.exe

File Behavior:
The Process is packed and/or encrypted using a software packing process.
Creation and Registration of a Browser Helper Object in Internet Explorer.
This process creates other processes on disk.
Writes to another Process's Virtual Memory (Process Hijacking).
Can communicate with other computer systems using HTTP protocols.
Installs a browser helper object (BHO).
Creates or uses a background service to access the Internet using HTTP protocols.

Malware Name:
Win32:Spyware-Gen, Win32:Bancos-BLF

Malware Type:
Trojan Horse, Infection, PHISH

File Location:
C:\Windows\Ifn.ini
C:\Windows\system32\smastsj.exe C:\Windows\system32\unchsy.exe C:\Windows\System32\Mast.ini
C:\Windows\System32\sxmc.ini
C:\Windows\System32\DirectX\Dinput\diagx3d.dll

Symptoms:
When you open your mail a friend from your contact list will send you an e-mail saying something like - Example:

OIII...!! TUDO BEM? From:John Doe (JohnDoe@hotmail.com) Sent:  February 5, 2010 6:54:57 PM To:  1 anexoImagem1.jpg (2,5 KB) Oiiii...!! tudo bem? Pois é eu sumi... mas eu não esqueci daquela nossa foto. Pois aqui está a foto que você tanto queria... Tchauuuu!!! Segue abaixo a foto. Visualizar, Baixar ou Imprimir Imagem1.jpg

Then it will open up a file called Downloads_R.com, if this is what you have down and are looking for a solution follow the removal procedure.

Associated Web Sites:

http://mundopumavirtualx02.in http://x02.mundopumavirtualx02.in http://propaganda25.dominiotemporario.com/Downloads_R.com http://dre.direcionex.info/Download_Imagem.zip/Download_Imagem.com http://biglocationx.blogspot.com/feeds/posts/default http://tropa123.freehostwebs.com http://tryppy.freehostwebs.com http://red88.freehostwebs.com http://lotismail.freehostia.com

---

Removal Procedure:

1. Use Prevx 3.0 (Download-PREVXCSIFREE.exe) to try and remove this virus Click Here to select a different language.

2. If Prevx dosen't work for you download ComboFix and save the file to your desktop, rename it from Combofix to Combo-Fix. - It' important you rename it to Combo-Fix during the download and not after or winupgro will corrupte it making it unable to open.

---

Try some online free virus scans:

Kaspersky
ESET Smart Security/ESET NOD32 Antivirus
Trend Micro HouseCall
AVG LinkScanner
F-Secure
BitDefender

>>Report any answers questions & errors in the comment box below