Download Smitfraud Fix
http://siri.urz.free.fr/Fix/SmitfraudFix.exe
Clean:
Reboot your computer in
Safe Mode
(before the Windows icon appears, tap the
F8 key continually)
Double-click SmitfraudFix.exe
Select
2 and hit Enter to delete infected files.
You will be prompted: Do you want to clean the registry ? answer
Y (yes)
and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? answer
Y (yes) and hit Enter to restore a clean file.
A
reboot may be needed to finish the cleaning process. The report can be found at the root of the system drive, usually at C:\rapport.txt
Optional:
To restore Trusted and Restricted site zone, select 3 and hit Enter.
You will be prompted: Restore Trusted Zone ? answer
Y (yes) and hit Enter to delete trusted zone.
----------------------------------------------------
Additional Steps:
(Start -Run)
sc stop Messenger
sc config Messenger start= disabled
Locate and Remove in Registry (Start Run
Regedit)
[HKEY_USERS\S-1-5-21-1877239962-2024743916-928725530-1189\Software\Microsoft\Search Assistant\ACMru\5603]
" 000"="links.exe"
Restart
