SmitFraudFix and Zlob Removal

SmitFraud Removal
This tool will remove Desktop hijacking malware. 

Firstly, download the removal tool from here:

Download Smitfraud Fix Here  Updated January 20th 2008

Disconnect from the internet to stop it from trying to reload itself on to your system. 

Double-click SmitfraudFix.exe to run the first stage of the program. 

On the first screen select 1 and hit Enter, this will create a report of the infected files.

The report can be found at the root of the system drive, which is usually located at C:\rapport.txt 

Secondly, reboot into Safe Mode, keep tapping F8 key before Windows splash screen.

Double click the Smitfraudfix.exe and on the screen that opens type in 2 the hit Enter to delete any infected files.

You will then be prompted with ‘Do you want to clean the registry?’ Type Y and again hit Enter to remove the Desktop background and clean any registry keys that are associated with this infection.

The tool will then check to see if winnet.exe is infected.  If it is you will be asked if you want to replace infected file? Type Y and again hit Enter to restore a clean file entry to the registry.

 You may be required to reboot after the cleaning process, and you can then reconnect to the internet. A full report can be found on your root drive, usually C:\rapport.txt 

Another option is to restore Trusted and Restricted sites, type in 3, hit Enter.

You will then be prompted with ‘Restore Trusted Zone?’  Type Y, hit Enter. 

Some anti-virus programs detect process.exe as a ‘risk’. It is NOT a virus, it is a program used to stop system processes.  

Zlob Removal
Download this file to your desktop
http://www.mvps.org/winhelp2002/DelDomains.inf

Close all browsers, right-click and select: Install  

Disconnect from the internet.

This program doesn’t really install, it just clears all sites in the Domains and Ranges keys.

Afterward’s you will need to immunize again in SpyBotS&D and re-protect again with SpywareBlaster or re-install iespyadds if it’s installed, then the file itself (DelDomains.inf) can be safely deleted.   

Simply use the Search or Find utility to locate it and delete it. 

When your machine is clean, ensure that your Anti-Virus is up to date, I recommend that you use SpyWareGuard, SpyWareBlaster, CCleaner, and AdAware.

VISTA users, please use this tool instead

Please download Rogue Remover and save it to your desktop.
Double-click on rr-free-setup.exe to install in C:\Program Files\RogueRemover.
Navigate to the folder and double click on the file named RogueRemover.exe or use the icon that was created on your desktop.
Once the program runs, select Check for Updates.
When prompted, select Check for Updates.
If prompted again, click Download to receive the latest updates.
When completed, close the update window.
Finally, select Scan and the program will walk you through the remaining steps.