HELP!!

I've been "had" by a touch of Malware.

I thought I'd managed to get rid of it, but my Home Page is stuck on about:Blank and I can't change it.

There's obviously something like a rogue entry in my Registry stopping me, but how do I indentify the offender and get rid of it, please?

Hya El Cid.

If you follow the instructions in the "Prework" link below in my sig and post the 2 resulting log files then i'll have a look to see what variant it is , and what needs to be done to remove it.

Hi Joe,

Thanks for the prompt response.

Attached are the HJT and Ewido Scan Logs.

Looks like yet an other job for Smitrem , great app.


Download Smitrem to your desktop:
http://noahdfear.geekstogo.com/click...click.php?id=1
Run the installer and then press Start to Extract the
files to the desktop, Do not run it yet.

Reboot into safe mode (Reboot and keep tapping F8 , then
choose safe mode from the list)

Run SmitRem:
Open the SmitRem folder and double click the "RunThis.bat" file to start the tool. Follow the prompts on screen , wait for the tool to complete , and disk cleanup to finish.

The tool will create a log named smitfiles.txt on the drive that you ran Smitrem on, eg; "C:\smitfiles.txt" , or the partition where your operating system is installed on.

Then fix this entry with hjt:

Now please post the Smitrem log , plus a new hjt log.


Note: XP users using the XP theme may ex-perience a change to the Classic Windows theme. This can be changed on the themes tab of desktop properties.


You will need to reload your wallpaper as the SmitRem
tool will reset it, you can do this by right clicking
desktop and choosing properties, First check Theme and
set it to Windows XP then click the Desktop tab and
choose the one you want to use and press apply.

Hi Joe,

Done as requested, thanks for the new tool.

Logs Attached:

> HJT Pre is before the fix
> HJT Post is after
> HJT Reboot is after reboot and the BHO Entry is back
> Plus SmitRem Log

Yup , it came straight back... There are a couple of malware writters very very busy lately.. They keep changing..


download KillBox by Option^Explicit from HERE.

Reboot into safe mode (Reboot and keep tapping F8 , then
choose safe mode from the list)

Run SmitRem:
Open the SmitRem folder and double click the "RunThis.bat" file to start the tool. Follow the prompts on screen , wait for the tool to complete , and disk cleanup to finish.

Then fix this one with hjt:

Double click on Killbox.exe and then check the delete on reboot button.

Enter the following filepath and filename into the Full path of file to delete box:

C:\WINDOWS\system32\dcomcfg.exe

Click the red circle with the white x and allow your computer to reboot.
(if killbox doesn't reboot on its own then please reboot manually)

After your computer has rebooted please run Hijackthis again and post a new Hijackthis log , plus the new Smitrem log.

Hi Joe,

Thanks for the support, this is a bit wearing

Done as suggested and I am now able to reset my Home Page, but . . .

My Desktop Background is still flashing alternately Beige and White.

When I Right Click and select Properties it tells me it is C:\Windows\Desktop.html, which doesn't exist.

Log files attached as requested:

> HJT Post Clean Up and Reboot
> SmitRem Log Post Clean Up.