[joe444]

My parents' computer (Windows 98) has a rather nasty case of the smitfrauds. Here is what is happening now.

On start up, a blue screen informs them of the usual (complete with misspellings)

"A fatal error in IE has occurred at 0028:C0011E36 in VXDVMM(01)+00010E36. Error was caused by Trojan-Spy.html.smitfraud.c
*System can not function in normal mode. Please check you security settings.
*Scan your PC with any avaliable antivirus/spyware remover program to fix the problem."

This then becomes the desktop complete with icons, at which point Windows generates an Explorer error:

"This program has performed an illegal operation and will be shut down.

If the problem persists contact the program vendor."

A close box and a details box are offered. Details leads to:

"EXPLORER caused an invalid page fault in module 0LE32.DLL at 0167:7ff21a32.
Registers:
EAX=6ac3806f CS=0167 EIP=7ff21a32 EFLGS=00010212
EBX=00000000 SS=016f ESP=0059f6b4 EBP=00000000
ECX=0059fb2c DS=016f ESI=00000001 FS=2787
EDX=00000008 ES=016f EDI = 7ff2b890 GS=256e
Bytes at CS:EIP:
39 02 74 03 33 c0 c3 8b 41 04 39 42 04 75 f5 8b
Stack dump:
7ff54e37 0059f6f8 0059fb2c 7ff2b890 0059f6b8
7ff501df 0059fb2c 00000001 ffc04e39 0059f868
80000000 0059fb48 00d44658 00d44668 00000000
00d40000"

If close is clicked the box reappears. If enter is pressed the box and icons and error flash off momentarily and reappear.


Nothing is accessible. The only option is to 'hard crash'. Attempts to drag the false desktop down from the right corner fail. Starting in safe mode yields the same results.

They have no recovery disk.

A dandy, huh? My presumption is the real desktop remains accessible if only we can get to it.