Help!!! Smitfraud Dilemma!!!

Unknown

hello all;

i've got a bit of an odd situation here...

i'm operating on a G5 powermac, but my wife is (was) using a machine running windows XP. she managed to get what 'xoftspy' recognized as 'smitfraud', and after running xoftspy in safe mode (the only way i can get her machine to operate now) it said it had been deleted, but everytime i try to re-start her machine normally, it continues to maintain a blocked-wallpaper on the desktop. (there is also no internet access in safe mode, so an online "scan n fix" ain't gonna work.)

since i'm running a G5 and need to fix her XP (ALL of our daughter's photographs from birth to present are on it, otherwise i wouldn't bother) can anyone suggest something i could possibly download on my mac and run in safe mode on her PC?

i'm pretty PC illiterate, so i definitely need the easiest fix available...

ANY help that ANYONE could give would be VERY much appreciated.

thanks ahead of time...
-j. minor

Buckeye_Sam

Delete any of these files/folders that are found on her computer.

C:\wp.exe
C:\wp.bmp
C:\Windows\sites.ini
C:\Windows\popuper.exe
C:\WINDOWS\System32\wldr.dll
C:\Windows\System32\helper.exe
C:\Windows\System32\intmon.exe
C:\Windows\System32\intmonp.exe
C:\Windows\System32\msmsgs.exe
C:\Windows\System32\ole32vbs.exe
C:\Windows\system32\msole32.exe
C:\WINDOWS\system32\shnlog.exe
C:\WINDOWS\system32\oleadm.dll
C:\Windows\System32\Log Files
C:\Program Files\Search Maid
C:\Program Files\Virtual Maid
C:\Program Files\Security IGuard
C:\Program Files\PSGuard




For her desktop try this:

• Click Start>Control Panel>Display
• Go to the Desktop tab and click on the Customise Desktop button.
• Go to the Web tab
• In the web page box, click on the page that is checkmarked and then click the Delete button.
• Ok your way out of the dialog and check your desktop.

These are just basic directions that may or may not help solve your problem. In order for us to give you specific instructions for your particular infection we need to see a hijackthis log.

http://www.short-media.com/download.php?d=245