Hello there and welcome to BleepingComputer. My name is Charles and I will be dealing with your log today.
Please print off a copy of these instructions, and also save them to a Notepad file on your desktop, so they are easily accessible.
We are going to boot into Safe Mode later in the fix, and there is no internet access.
to your Desktop.
Don't run it yet.
Please download SmitfraudFix
Open the file and it will extract the contents (a folder named SmitfraudFix) to your Desktop.
Now, please reboot your computer into Safe Mode
This is done by rebooting Windows and pressing F8
at boot/Windows startup, usually right after the beep.
Then select Safe Mode from the list.
Once in Safe Mode, open the SmitfraudFix
Select option #2 - Clean
by typing 2
and press "Enter
" to delete infected files.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y
and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if wininet.dll
is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y
and press "Enter".
The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txtWarning
: running option #2 on a non infected computer will remove your Desktop background.
Double click HJTsetup.exe
to start the program.
Follow the setup instructions, making sure you put a check by Create a desktop icon
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish
and it will launch HijackThis.
Click on the Do a system scan and save a log file
button. It will scan and then ask you to save the log.
to save the log file and post it in your next reply, along with the contents of rapport.txt.