Hi,

Step 1

  1. If you have version 1.4, go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
  2. Click on Mode > Advanced Mode. When it prompts you, click Yes.
  3. On the left hand side, click on Tools.
  4. Check (tick) this box if it is not yet ticked: Resident.
  5. You will notice that Resident is now added under Tools. Click on Resident.
  6. Uncheck (untick) this box: Resident "TeaTimer" (Protection of over-all system settings) active.
  7. Exit Spybot Search & Destroy.
  8. Restart your computer for the changes to take effect.


Step 2

Please copy this set of instructions or print it out as you will not have internet access during the fix.

Restart the computer in Safe Mode

:!: Let me know if you can't boot into Safe Mode. Do not continue with the fixes.

  1. When you see the BIOS screen, start pressing F8.
  2. A boot menu will appear shortly.
  3. Using the up down arrows, select Safe Mode and press the Enter key.
  4. Windows will now load.
  5. Log in to your usual account.


Once in Safe Mode, double-click on SmitfraudFix.exe.

Press 2 and press Enter to delete infected files.

You will be prompted: Registry cleaning - Do you want to clean the registry ?; press Y and press Enter in order to start cleaning the cleaning process. Your desktop will be gone for a while cleaning.

The tool will now check if wininet.dll is infected. You will be prompted to replace the infected file (if found); press Y and press Enter.

The tool will restart your computer to finish the cleaning process; if it doesn't, please restart manually into Normal Mode.

A text file will appear onscreen, with results from the cleaning process; please copy and paste the contents of that report into your next reply. The report can also be found at the root of the system drive, usually at C:\rapport.txt

Note to users: Running option 2 on a clean machine will remove your desktop background.

Step 3

  1. Please download random's system information tool (RSIT) and save it to your desktop.
  2. Double click on RSIT.exe to run it. RSIT will start running.
  3. Select 3 months from the drop-down list and click on Continue.
  4. RSIT will start running. When done, 2 logs will be produced. The first one, log.txt, will be maximized, the second one, info.txt, will be minimized.
  5. Please post both logs in your next reply.


Step 4

Please post Smitfraudfix log and RSIT logs(log.txt and info.txt).