Options

Please help. Trojan Spyware Blues

Unknown
edited July 2005 in Spyware & Virus Removal
I have tried everything to get rid of this virus and nothing work. Now when I boot up my PC I get a blue screen with no desktop icons no taskbar only the error "A fatal error in IE has occured Error was caused by Trojan-Spy.html.smitfraud.c virus" this is the same in safe mode. The only access I have is the taskmanager the pressing ctrl alt del. which mean I can do any of the things that we were told to do prior to submitting a thread. please help really desparate now.

thank you.

Comments

  • Shadow2018Shadow2018 Northwest Missouri
    edited July 2005
    You are infected with Smitfraud. Please post a Hijack This log.
  • emutou
    edited July 2005
    I don't have acces to anything, so how do I install hijack with no start menu of desktop
  • Shadow2018Shadow2018 Northwest Missouri
    edited July 2005
    Do you have another computer that you can put the hard drive in? That is assuming that your infected computer is a desktop.
  • emutou
    edited July 2005
    Even in Safe Mode I have the same issue no desktop no taskbar. just a black screen that says safe mode. No other PC for hard drive.
  • Shadow2018Shadow2018 Northwest Missouri
    edited July 2005
    How are you posting on here?
  • emutou
    edited July 2005
    I am posting from work? I have tried everything that was required prior to submitting thread.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    I'd say your best option is a repair installation.

    http://www.onecomputerguy.com/windowsxp_tips.htm#repair
  • emutou
    edited July 2005
    Tried to run the repair and received an error that was something to the effect of "invalid software or operating system, can not run repair. Thank you.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    What version of Windows are you running? I assumed it was XP.
  • emutou
    edited July 2005
    Yes XP
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    Either you have a bootlegged copy of Windows XP or you have suffered serious corruption. No matter which one, you are looking at formatting and reinstalling Windows from scratch.
  • emutou
    edited July 2005
    I was able to install Hijackthis and get log files through the task manager.

    Logfile of HijackThis v1.99.1
    Scan saved at 10:40:26 PM, on 07/06/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Portrait Displays\MagicTune\dtsrvc.exe
    c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\mcafee.com\VSO\mcshield.exe
    C:\WINDOWS\System32\taskmgr.exe
    C:\Documents and Settings\Owner\My Documents\downloads\spyware\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
    O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll (file missing)
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
    O4 - HKLM\..\Run: [USB] C:\WINDOWS\system32\usb.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Limeshop0] "C:\Program Files\Lime_Shop\Limeshop0.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
    O4 - HKLM\..\Run: [60ee5b1498de] C:\WINDOWS\System32\activeds.exe
    O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
    O4 - HKLM\..\Run: [SpySpotter] C:\PROGRA~1\SPYSPO~1\SpySpotter.exe -onreboot
    O4 - HKLM\..\Run: [Spyware Stormer] C:\Program Files\Spyware Stormer\SpywareStormer.Exe
    O4 - HKLM\..\Run: [gfsdgj] c:\windows\system32\wostdl.exe
    O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\System32\vidctrl\vidctrl.exe
    O4 - HKLM\..\Run: [uieaglsdkm] c:\windows\system32\uieaglsdkm.exe -start
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitegsu32.exe
    O4 - HKLM\..\RunOnce: [MicrosoftAntiSpywareCleaner] C:\Program Files\Microsoft AntiSpyware\gcASCleaner.exe
    O4 - HKLM\..\RunOnce: [GIANTAntiSpywareCleaner] C:\Program Files\Microsoft AntiSpyware\gcASCleaner.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKCU\..\Run: [Notn] C:\Documents and Settings\Owner\Application Data\wtta.exe
    O4 - HKCU\..\Run: [Tphbibs] C:\WINDOWS\System32\r?ndll32.exe
    O4 - HKCU\..\Run: [Ho5nRff4i] disstab.exe
    O4 - HKCU\..\Run: [zkzm] C:\PROGRA~1\COMMON~1\zkzm\zkzmm.exe
    O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
    O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
    O4 - Global Startup: dcrr.exe
    O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
    O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
    O4 - Global Startup: MagicTune.lnk = C:\Program Files\Portrait Displays\MagicTune\DTHtml.exe
    O4 - Global Startup: NaturalColorLoad.lnk = ?
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZRxdm185XXUS
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_72.dll' missing
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51B2F79DA} - http://www.alwaysupdatednews.com/install/aun_0015.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1118542611796
    O16 - DPF: {99802379-7362-40E2-9D28-8A3B9AF880B7} - http://hotsearchbar.com/toolbar2/winhot32.cab
    O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/SpSp29952.41optYplkOmji/SpySpotterCabInstall.cab
    O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Portrait Displays\MagicTune\dtsrvc.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C:\Program Files\mcafee.com\VSO\mcshield.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    I recommend uninstalling these programs. They are not good programs and may actually cause problems.

    LimeShop
    Spyware Stormer
    SpySpotter



    Please download LQfix batch here:
    http://users.pandora.be/bluepatchy/LQfix.zip
    Unzip it to the desktop but do NOT run it yet.

    Reboot your computer into SAFE MODE



    Once in Safe Mode, please run LQfix.bat.



    Please make sure that you can VIEW ALL HIDDEN FILES.

    Place a checkmark next to these entries, close all browsers and windows, and have HijackThis fix them by clicking Fix Checked:

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
    O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll (file missing)
    O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
    O4 - HKLM\..\Run: [60ee5b1498de] C:\WINDOWS\System32\activeds.exe
    O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
    O4 - HKLM\..\Run: [SpySpotter] C:\PROGRA~1\SPYSPO~1\SpySpotter.exe -onreboot
    O4 - HKLM\..\Run: [Spyware Stormer] C:\Program Files\Spyware Stormer\SpywareStormer.Exe
    O4 - HKLM\..\Run: [gfsdgj] c:\windows\system32\wostdl.exe
    O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\System32\vidctrl\vidctrl.exe
    O4 - HKLM\..\Run: [uieaglsdkm] c:\windows\system32\uieaglsdkm.exe -start
    O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitegsu32.exe
    O4 - HKCU\..\Run: [Notn] C:\Documents and Settings\Owner\Application Data\wtta.exe
    O4 - HKCU\..\Run: [Tphbibs] C:\WINDOWS\System32\r?ndll32.exe
    O4 - HKCU\..\Run: [Ho5nRff4i] disstab.exe
    O4 - HKCU\..\Run: [zkzm] C:\PROGRA~1\COMMON~1\zkzm\zkzmm.exe
    O4 - Global Startup: dcrr.exe
    O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusear...?p=ZRxdm185XXUS
    O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm
    O16 - DPF: {47CD99DF-8BCF-4B9B-94EF-02E51B2F79DA} - http://www.alwaysupdatednews.com/install/aun_0015.exe
    O16 - DPF: {99802379-7362-40E2-9D28-8A3B9AF880B7} - http://hotsearchbar.com/toolbar2/winhot32.cab
    O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spys...rCabInstall.cab




    Then delete these files or directories (Do not be concerned if they do not exist):

    C:\WINDOWS\Nail.exe
    C:\Program Files\E2G
    C:\WINDOWS\cfgmgr52.dll
    C:\WINDOWS\System32\activeds.exe
    C:\PROGRA~1\SPYSPO~1\
    C:\Program Files\Spyware Stormer
    c:\windows\system32\wostdl.exe
    C:\WINDOWS\System32\vidctrl
    c:\windows\system32\uieaglsdkm.exe
    C:\windows\system32\elitegsu32.exe
    C:\Documents and Settings\Owner\Application Data\wtta.exe
    C:\WINDOWS\System32\r?ndll32.exe
    disstab.exe
    C:\PROGRA~1\COMMON~1\zkzm
    dcrr.exe


    Reboot your computer to go back to normal mode and post a new log.
  • emutou
    edited July 2005
    I will have to do this when I get home tonight. But is there a way to view all files and uninstall programs when I can't view my desktop or taskbar in normal or safe mode as I statement in previous emails. The only thing that I can do is CTRL ALT DEL to get to the task manager.

    Thank you for your help.
  • DoctorGeo2008DoctorGeo2008 Flint, MI
    edited July 2005
    From your task manager you can click on FILE then New Task (Run...). Type in explorer.exe and it *should* bring up Windows Explorer.

    Geoff
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    You can also click on Windows + E to bring up explorer. From there you can navigate to your control panel and set hidden files to be visible.
  • DoctorGeo2008DoctorGeo2008 Flint, MI
    edited July 2005
    Buckeye_Sam wrote:
    You can also click on Windows + E to bring up explorer. From there you can navigate to your control panel and set hidden files to be visible.

    Now that is a cool trick Buckeye_Sam!! I never knew you could do that. :)
  • emutou
    edited July 2005
    I have fixd and removed the files that you told me that told me to in you last email. I was not able to the the window-e keys or run explorer from the task manager so I was unable to set my pc to show all files. When I ran it from taxk manager the error was unable to find explorer.exe I also ran the LQfix.bat file. Now when I reboot I dont get the error I just receive a blue screen with nothing on it at all. Here are my new log files.

    Logfile of HijackThis v1.99.1
    Scan saved at 12:02:52 PM, on 07/10/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Portrait Displays\MagicTune\dtsrvc.exe
    c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\mcafee.com\VSO\mcshield.exe
    C:\WINDOWS\System32\taskmgr.exe
    C:\Documents and Settings\Owner\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
    O4 - HKLM\..\Run: [USB] C:\WINDOWS\system32\usb.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Limeshop0] "C:\Program Files\Lime_Shop\Limeshop0.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\RunOnce: [MicrosoftAntiSpywareCleaner] C:\Program Files\Microsoft AntiSpyware\gcASCleaner.exe
    O4 - HKLM\..\RunOnce: [GIANTAntiSpywareCleaner] C:\Program Files\Microsoft AntiSpyware\gcASCleaner.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
    O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
    O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
    O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
    O4 - Global Startup: MagicTune.lnk = C:\Program Files\Portrait Displays\MagicTune\DTHtml.exe
    O4 - Global Startup: NaturalColorLoad.lnk = ?
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_72.dll' missing
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1118542611796
    O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Portrait Displays\MagicTune\dtsrvc.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - C:\Program Files\mcafee.com\VSO\mcshield.exe
    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    Download the following reg file to your desktop by right clicking on the link, and selecting save as.

    http://www.bleepingcomputer.com/files/reg/smitfraud.reg

    Once it has downloaded, double-click on the smitfraud.reg file on your desktop and when it asks if you would like to merge the data, click on the Yes button.

    Reboot your computer and you should now be able to change your desktop settings back to how you would like it. If your desktop still looks strange, go into your display properties and click on the Themes tab. Change the theme to Windows XP and you will now be using the default Windows XP settings. Then change them as you see fit.



    Let me know if this fixes your desktop and any other problems that you are having.
  • emutou
    edited July 2005
    I ran the smithfraud.reg file as you instructed rebooted pc and I still have just a blue screen with no icons. But I don't have the trojan virus error anymore. I tried to right click on the desktop to get to properties but I get nothing. It seem I am close to getting this issue corrected what should I do now.

    Thank you.
  • emutou
    edited July 2005
    can you read through the threads that I have previously posted and tell me what my next step should be. I think I am very close to getting this corrected. I think I can get my pc working tonight if I can get some help.

    Thank you.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    Try this:
    • Click Start>Control Panel>Display
    • Go to the Desktop tab and click on the Customise Desktop button.
    • Go to the Web tab
    • In the web page box, click on the page that is checkmarked and then click the Delete button.
    • Ok your way out of the dialog and check your desktop.
  • emutou
    edited July 2005
    As I stated before I don't have a desktop on menu bar at all. My screen is just blue no icon nothing. I and only get to the task manager by CTRL ALT DEL. What should I do.

    I know I am close to getting this problem corrected just need help to get the rest of the way.

    Thank You.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    Open task manager, click on New Task -> Browse

    Go to C:\Windows\System32\desk.cpl and open it. This should be your display properties.
  • emutou
    edited July 2005
    Buckeye_Sam wrote:
    Open task manager, click on New Task -> Browse

    Go to C:\Windows\System32\desk.cpl and open it. This should be your display properties.

    I was able to get to the display properties using the directions above, I was able to change my theme, but I still do not have any icons or taskbar what should I do now.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    You've got an infected wininet.dll file, which is hooked into explorer. Do you have some way of transferring a small file from your working computer to the infected computer? I'll assume so.

    We'll need to transport some files from the computer you are now using, to your infected computer.

    Download smitRem.zip and save the file to the desktop on the clean computer you are now using.
    Right click on the file and extract it to it's own folder on the desktop.
    So you'll get a new folder called smitrem on your desktop.
    I want you to put that folder on cd, floppy or usb-stick.

    On your infected computer, reboot into Safe mode.



    Once in Safe Mode, open your task manager by pressing Control-Alt-Delete simultaneously.
    Now insert the cd, floppy or usb-stick where you saved the smitrem folder from your clean computer.

    In your Task Manager, click 'applications' (first tab).
    Click the New Task button.
    Cick browse.

    Now browse to the drive where your floppy, usb-stick or cd is present (could be A or D or E or F.. you'll see..)
    Search for that smitrem folder.
    Right click on the smitrem folder and choose: Copy

    Now browse again via Task Manager to My Documents or Program Files.
    Right click somewhere in there, right click and choose: Paste
    Now open the smitrem folder you just copied and pasted and click the file: RunThis.bat
    Then click open.
    In the window where it says 'Create new task', click OK.

    Normally, you'll have to drag the different windows you'll see to left or to right, because normally they will open on top of each other and you wont see the command window the tool starts that is under it.
    You'll see a blue window now.
    Follow the prompts on screen.
    Wait for the tool to complete.

    When done, in Task Manager, click 'shut down' from the menu on top and click restart. Your computer will reboot now.
    Reboot to normal mode and post a hijackthis log in your next reply. Let me know how your desktop looks.
Sign In or Register to comment.