UPDATE: I saw that C. Jane had signed off for the evening, so I desparately followed her advise for another postee, and it WORKED! Thanks Jane. You're a life-saver, even if only indirectly.

Disregard my whine below:

I too seem to have been infected. Came home from being away for the weekend and as soon as I hit the internet, I locked up with a spybot or malware that loops me to antispywarebox

It doesn't just seem to be me, from what I am reading, this seems to be running rampant across the net. Tried cleaning as best I can. I've gotten to the point where I've run HijackThis and have a text log ready.

So, is it all fixed then?

Make sure that you had SmitfraudFix v. 2.59.
It has been updated today for this variant and it may find more files to delete.

If you still have version 2.58 - delete that SmitfraudFix folder and zip file and download the new one and run it again.

1. Download SmitfraudFix (by S!Ri) to your Desktop (Win2k/WinXP only!).
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

How to extract (decompress) zipped or compressed files
http://www.lvsonline.com/compresstut/index.shtml

Note : process.exe is part of the SmitFraudFix tool and is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky, Panda) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.


2. Reboot into Safe Mode
You can usually do this by restarting your computer and continually tapping F8 until a menu appears. Highlight Safe Mode and hit enter.

How to start the computer in Safe mode
http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam

3. Once in Safe mode, open the SmitfraudFix folder and double-click smitfraudfix.cmd

Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually.

4. Once back into normal mode, please scan with HijackThis to produce a log. Post that log into your topic along with the other requested logs named below.

Logs needed in your next post are:

rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed

Fresh HijackThis log

Yes, things are all better. I wanted to work a bit on the system before totally declaring success but things seem to be good.

Thanks again for hosting such a great forum.