Re: spyware

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: "Malke" <notreally@xxxxxxxxxxx>


|
| It sounds as though you have a version of the Smitfraud virus. Go
| through the following malware removal steps:
|
| http://www.elephantboycomputers.com/page2.html#Removing_Malware
|
| Depending on the variant you have, you may need to run HijackThis and
| post your log at one of the forums listed on the website above. In the
| meantime, here's how to get rid of the desktop warning being displayed
| by the malware.
|
| Go to the Display applet in Control Panel and look on the Desktop tab.
| Click on Customize Desktop, and then click on the Web tab. You will see
| that there are checkmarks next to "My Current Home Page" and probably
| "Lock Desktop Items". Uncheck these. By highlighting the "My Current
| Home Page" and clicking on the Properties button, you will be able to
| determine the name of the file that is the message. It might be called
| something like "security.html" or the like.
|
| Click Apply and OK out when you've made your changes. Then you want to
| find the *.html malware file and delete it.
|
| If you can't enable desktop backgrounds after a virus, MVP Kelly Theriot
| has a fix. Look under Wallpaper-Desktop-Disable Changing here:
|
| http://www.kellys-korner-xp.com/xp_w.htm
|
| Malke
| --
| Elephant Boy Computers
| www.elephantboycomputers.com
| "Don't Panic!"
| MS-MVP Windows - Shell/User

If it is a Smitfraud Trojan, I have created a specific script that removes the Trojan and
scans the PC using the McAfee command line scanner.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm


.