Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.



  • Please log in to reply
2 replies to this topic

#1 Gslice


  • Members
  • 2 posts
  • Local time:07:27 AM

Posted 02 September 2005 - 07:58 PM

Help... I've been reading a lot of instructions on removing this virus which gives me the fake error on boot and disables Windows from displaying the proper desktop.

If I boot in Safe Mode, it just stays a black screen with 'Safe Mode' displayed in each corner. All of the instructions talk about being in Windows to perform functions, but I cannot get to Windows, only the CMD prompt if I boot in Safe Mode with Command Prompt.

I ran HiJackThis.exe from the command prompt but the list it produced did not match any of the ones I've seen on these forums, as far as checking certain selections and running the FIX on them.

What am I doing wrong? Thanks!!

Edited by Gslice, 02 September 2005 - 08:28 PM.

BC AdBot (Login to Remove)


#2 Enthusiast


  • Members
  • 5,898 posts
  • Location:Florida, USA
  • Local time:07:27 AM

Posted 02 September 2005 - 09:14 PM

Run both Adaware and Spybot Search and Destroy from safe mode, updating each program before you scan and setting both to fix what they find.

After doing that I suggest you post a HijackThis log for assistance with your problem.

Read the pinned post in the HijackThis forum, here
Carefully read and follow all directions explicitly.

Following instructions run a log, and post it in the appropriate HJT forum, at this link.

Do not attempt to fix anything by yourself using Hijack This yet.

A member of the HJT Team will analyze the log, make recommendations and offer assistance.

It may take a period of time to get a response to the log you posted because the members of the HJT Team are kept very busy.
Pleasebe patient as this team is manned by volunteers. They will help you as soon as possible.

Once you have posted your HJT log, please DO NOT make any additional posts in the HJT forum until you get a response from a member of the HJT expert team.

The first criteria they have when looking for logs that need replies are posts showing 0 replies. If you make an additional post, it will show as having 1 reply.
A team member, looking to see if a reply has been made might well assume another HJT Team member is already assisting you and might not open the thread to respond.

So, make your post and wait for a response from a team member.

#3 Gslice

  • Topic Starter

  • Members
  • 2 posts
  • Local time:07:27 AM

Posted 03 September 2005 - 06:44 AM

I ran a DOS Batch File called RunThis which finally removed the fake smitfraud.c background. I can now boot directly to Windows (non-safe mode), but the background now blinks on and off from bright to dim (solid color backround, not the one that should be there) and the icons on the desktop are all highlighted as if selected.

If I right-click the desktop and look at Properties, I get a General Tab which say Not Available in the top section with the rest as:

Protocol: File Protocol
Type: HTML Document
Connection: Not Encrypted
Address: file://C:\WINNT\Web\desktop.html
Size: Not Available

This desktop.html does not exist on disk. Not sure if I could put something there with that name or not.

Things work, but it's still not right. I'm going to try getting it back on the internet and downloading Ad-Aware and SpyBot to see what they do.

Any other suggestions for restoring a desktop? Thanks.

Edited by Gslice, 03 September 2005 - 06:48 AM.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users