Please print out or copy this page to
Notepad in order to assist you when carrying out the following instructions.
You are running Hijack This from a temporary directory. It needs to be in a permanent folder. Please redownload
HijackThis to your desktop. Create a folder at
C:\HJT and move HijackThis.exe there.
Downloads(make sure to save these in a permanent location)
Please download
SmitfraudFix (by
S!Ri)
Extract the content (a folder named
SmitfraudFix) to your Desktop.
Ewido Anti-Malware- Install Ewido Security Suite
- When installing, under "Additional Options" uncheck..
- Install background guard
- Install scan via context menu
- Double-click the icon on Desktop to launch Ewido
You will need to update Ewido to the latest definition files.
- On the left hand side of the main screen click update.
- Then click on Start Update.
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to
manually update Ewido
When you have finished updating,
EXIT Ewido.
Cleanup! (
Alternate Link)- Install it. You will use this later.
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does not make backups.
Next, please reboot your computer in
Safe Mode by doing the following :
- Restart your computer
- After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
- Instead of Windows loading as normal, a menu with options should appear;
- Select the first option, to run Windows in Safe Mode, then press "Enter".
- Choose your usual account.
Once in Safe Mode, open the
SmitfraudFix folder again and double-click
smitfraudfix.cmd
Select option #2 -
Clean by typing
2 and press "
Enter" to delete infected files.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing
Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if
wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing
Y and press "Enter".
A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually.
Reboot back into Safe Mode.
The tool will create a log named
rapport.txt in the root of your drive, eg: Local Disk C: (
C:\rapport.txt) or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
Open
Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows:
Click
Options
Move the slider button down to
Custom CleanUp!
Check the following:
- Empty Recycle Bins
- Delete Cookies
- Delete Prefetch files
- Cleanup! All Users
Uncheck the following :
- Scan local drives for temporary files
Click
OK, Press the
CleanUp! button to start the program.If prompted to reboot, click No.
Next go to
Control Panel click Display>Desktop>Customize Desktop>Web> Now,
Uncheck Everything and delete if present:
- "Security Info"
- "Warning Message"
- "Security Desktop"
- "Warning Homepage"
- "Desktop Uninstall"
Also make sure the
'Lock desktop items' box is
unticked. Click
OK, and then Click
Apply, then
OK.
Run
Ewido with it's updated definitions:(...it's important that all windows must be closed)
- Click Scanner
- Click Complete System Scan to begin scanning.
- Click OK when prompted to clean files
With the first file it prompts to clean, select the option:
- "Perform action on all infections"
- Choose clean and click OK.
Once finished, click the
Save report button & save the report to your desktop
** This scan may take over an hour, after choosing the action for the first item you do not need to stay at the PC.
Reboot your system in Normal Mode.
Online Scans
Perform an online scan with Internet Explorer with
Panda ActiveScan
**
click on "Free use ActiveScan" located on the top right hand corner- Click Scan your PC & a 'pop up' window shall appear. *ensure that your pop up blocker doesn't block it
- Click Scan Now
- Enter your e-mail address & click Scan Now ...begins downloading 8 MB Panda's ActiveX controls
Begin the scan by selecting
My Computer- If it finds any malware, it may ask you to purchase the program, this is not necessary we will take care of the entries manually.
- At the end of the scan click on see report. Then click Save report
Please post that log in your next reply.
In your next post please include:
- Rapport.txt
- Panda Activescan Log
- A new Hijackthis! Log