Download SmitfraudFix (by S!Ri) Extract the content (a folder named SmitfraudFix) to your Desktop.
Then boot up in safemode (hit f8 when booting up)
Once in Safe Mode, open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".
The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please attach that report to your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt
And also post a new hjt log please.
Linear Mode
