I suggest you copy the instructions to your desktop or print them as you will no have access to the internet while conducting the cleanup.
A. Please download/set up the following files:
1. Download SmitfraudFix (© S!Ri) to your Desktop from http://siri.urz.free.fr/Fix/SmitfraudFix.zip . Extract all the files to your Desktop and a folder named SmitfraudFix will be created on your Desktop.
2. Download ewido anti-spyware from www.free.grisoft.com. Save the file to your desktop so you can locate it.
1. Locate the ewido anti-spyware icon on the desktop.
2. Double-click the large yellow "[size=16pt]e[/size]" ewido icon to launch the set up program.
3. The installation will require a restart of the computer.
4. Launch ewido to update to the latest definition files.
5. On the main screen select the "Update" icon
6. Click "Start Update". The update will start and a progress bar will show the updates being installed.
7. If you have problems with the updater, you can use this link to manually update ewido -- ewido manual updates
3. Setup ewido as follows:
1. Select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
2. In the Settings screen click "Recommended actions" and then select "Quarantine".
3. Under "Reports"
* Select "Automatically generate report after every scan"
* DE-Select "Only if threats were found"
* close ewido
4. During this process, please change your settings to show hidden files. You can change the setting back when the cleanup is completed.
1. Click Start.
2. Open My Computer.
3. Select the Tools menu and click Folder Options.
4. Select the View Tab.
5. Under the Hidden files and folders heading select Show hidden files and folders.
6. Uncheck the Hide protected operating system files (recommended) option.
7. Click Yes to confirm.
8. Click OK.
B. Please uninstall the file shown below:
1. Click "start" on the taskbar and then click on the "Control Panel" icon
2. Please double-click the "Add or Remove Programs" icon
3. A list of programs installed will be "populated" this may take a bit of time.
4. In this list please find C:\Program Files\Safety Bar
5. A wizard should then open, which will guide you through the uninstallation.
6. Delete the folder if it was not removed.
C. Restart your computer in Safe Mode.
1. If the computer is running, shut down Windows, and then turn off the power.
2. Wait 30 seconds, and then turn the computer on.
3. Start tapping the F8 key. The Windows Advanced Options Menu will appear. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
4. Ensure that the Safe Mode option is selected.
5. Press Enter. The computer then begins to start in Safe Mode.
6. Login on your usual account.
If you need further assistance with Safe Mode, see target="_blank" class="postlink">Symantec
D. Scanning and system cleaning with ewido.
1. Lauch ewido-anti-spyware by double-clicking the icon on the desktop. IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess.
2. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan"
3. ewido will now begin the scanning process. Be patient as this may take a little time.
4. While scanning, ewido will list any infections found on the left side.
5. When the scan is completed, the recommended action should be set to Quarantine. If not click Recommended Action and set it there. Click the Apply all actions button. Ewido will display "All actions have been applied" on the right side.
6. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).
7. Close ewido.
E. Open the SmitfraudFix folder
1. Double-click smitfraudfix.cmd file to start the tool.
2. Select option #2 - Clean by typing 2 and press Enter.
Warning : running option #2 on a uninfected computer will remove your Desktop background.
3. Wait for the tool to complete and disk cleanup to finish.
4. You will be prompted : "Registry cleaning - Do you want to clean the registry?"
1. Answer Yes by typing Y
2. Hit Enter.
5. The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll.
1. Answer Yes to the question "Replace infected file?" by typing Y
2. Hit Enter.
6. A reboot may be needed to finish the cleaning process. If your computer does not restart automatically please do it yourself manually.
7. Restart in Safe Mode as instructed above.
8. The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
F. Scan with HijackThis, check the any of the following that are remaining and select "Fix Checked:
O2 - BHO: (no name) - {202a961f-23ae-42b1-9505-ffe3c818d717} - C:\Program Files\Media-Codec\isaddon.dll
O2 - BHO: (no name) - {70CAA88C-1ACC-5937-70F1-079C79B97ECD} - C:\WINDOWS\system32\ystjivb.dll
O2 - BHO: (no name) - {7a932ed2-1737-4ab8-b84d-c71779958551} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Protection Bar - {860c2f6b-ca82-4282-9187-beccbb66f0af} - C:\Program Files\Media-Codec\iesplugin.dll
O21 - SSODL: hubbsi - {7b1eeccd-0a6d-4ad5-8ac1-4af5722b3885} - C:\WINDOWS\system32\vwlummc.dll (file missing)
G. Restart in Normal Mode and double-click the HijackThis icon on your desktop. Choose "Do a system scan and save logfile".
H. Post a reply with the following logs and let us know how your PC is doing:
1. C:\rapport.txt
2. ewido log
3. HijackThis log
Thank you.