Print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.
Download CleanUp!
http://cleanup.stevengould.org/ (Alternate Link if main link don't work -
http://www.greyknight17.com/spy/CleanUp.exe ) and install it. Don't run it yet.
Download Ewido Security Suite at
http://www.ewido.net/en/download/
1. Install Ewido Security Suite.
2. When installing, under 'Additional Options' uncheck:
* Install background guard
* Install scan via context menu
3. Launch Ewido, there should be an icon on your desktop, double click it.
4. The program will now open to the main screen.
5. When you run Ewido for the first time, you might get a warning 'Database could not be found!'. Click OK. We will fix this in a moment.
6. You will need to update Ewido to the latest definition files.
* On the left hand side of the main screen click update.
* Then click on start update.
7. The update will start and a progress bar will show the updates being installed. The status bar at the bottom will display 'Update successful'.
8. Exit Ewido. DO NOT scan yet.
If you are having problems with the updater, you can go to
http://www.ewido.net/en/download/updates/ to update manually.
Download SmitfraudFix http://siri.urz.free.fr/Fix/SmitfraudFix.zip and extract the content (a folder named SmitfraudFix) to your desktop.
Reboot your computer to Safe Mode (if you don't know how, go to
http://www.bleepingcomputer.com/foru...howtutorial=61 ). Login to your usual account.
Once in Safe Mode, open the SmitfraudFix folder. Double-click on smitfraudfix.cmd and select option #2 - Clean by typing 2 and press 'Enter' to delete infected files. You will be prompted 'Registry cleaning - Do you want to clean the registry?' Answer Yes by typing Y and press 'Enter' in order to remove the desktop background and clean registry keys associated with the infection. The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer Yes by typing Y and press 'Enter'.
The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it manually to get back to Normal Mode. A text file will appear onscreen, with results from the cleaning process; copy/paste the content of that report into your next reply. The report can also be found at the root of the system drive, usually at C:\rapport.txt
Warning: running option #2 on a non infected computer will remove your desktop background.
CleanUp! deletes EVERYTHING out of your temp/temporary folders. It does not make backups. If you have any documents or programs that are saved in any Temporary Folders, make a backup of these before running CleanUp!. Run CleanUp! and click on the CleanUp! button. Let it run. After it's done, click the Close button and choose Yes to logoff.
Run Ewido now:
* Click on scanner and then Settings. Under 'What to scan' select 'Scan every file' and hit OK.
* Click on 'Complete System Scan' and the scan will begin.
* While the scan is in progress you will be prompted to clean the first infected file it finds. Choose 'Remove', then put a check next to 'Perform action with all infections' in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK.
* Once the scan has completed, there will be a button located on the bottom of the screen named 'Save report'.
* Click 'Save report'. Save it to your desktop.
Post the rapport.txt, Ewido report and a new HijackThis log here.