[dumbdog]

Hi folks, I have what to me at least is a serious problem, apparently related to the Smitfraud.c trojan-spy. Not only does the standard blue background turn up when I turn on my computer, but when the desktop does appear, I get a dialogue box that says roughly

“Explorer has caused an error in OLE 32 DLL. Explorer will be closed. If the problem continues you should restart the computer.”

When I click on the OK button, it just reappears, preventing me from doing anything but clicking OK again (besides pressing ctrl-alt-del and getting another box that doesn’t seem to help either). This means that I cannot even access my anti-virus programmes.

I managed once to get the computer to turn out the screen that allows me to start it in safe mode, but in that case, the mouse did not work, and I was not able to get beyond the MS security page that appeared. Now, it seems, I can’t even get it to allow me to start in safe mode (usually, I could get the appropriate screen by pulling the electricity plug and then reinserting it before starting the computer).

I have also entered the set-up, but could not find anything to help me there.

I have done most of the things that I have tried disconnected from the Internet. Would it make any difference if I hooked the computer back up to the Net?

As you understand, I am no computer expert. I am writing this from another computer and I’m pretty desperate. Any ideas on how I can proceed to get the problem sorted out?

All the best,
Harry

[Advertisements]

Welcome dumbdog to Geeks to Go!

We'll need to transport some files from the computer you are now using, to your infected computer.

Download smitRem.zip and save the file to your desktop.
Right click on the file and extract it to it's own folder on the desktop.
So you'll get a new folder called smitrem on your desktop.
I want you to put that folder on cd, floppy or usb-stick.

On your infected computer, boot again in safe mode and open your task manager again.
Now insert the cd, floppy or usb-stick where you saved the smitrem folder in your infected computer.

In your Task Manager, click 'applications' (first tab).
Click the New Task button.
Cick browse.

Now browse to the drive where your floppy, usb-stick or cd is present (could be A or D or E or F.. you'll see..)
Search for that smitrem folder.
Right click on the smitrem folder and choose: Copy

Now browse again via Task Manager to My Documents or Program Files.
Right click somewhere in there, right click and choose: Paste
Now open the smitrem folder you just copied and pasted and click the file: RunThis.bat
Then click open.
In the window where it says 'Create new task', click OK.

Normally, you'll have to drag the different windows you'll see to left or to right, because normally they will open on top of each other and you wont see the command window the tool starts that is under it.
You'll see a blue window now.
Follow the prompts on screen.
Wait for the tool to complete.

When done, in Task Manager, click 'shut down' from the menu on top and click restart. Your computer will reboot now.
Reboot to normal mode and post a hijackthis log in your next reply.

[g2i2r4]

Welcome dumbdog to Geeks to Go!

We'll need to transport some files from the computer you are now using, to your infected computer.

Download smitRem.zip and save the file to your desktop.
Right click on the file and extract it to it's own folder on the desktop.
So you'll get a new folder called smitrem on your desktop.
I want you to put that folder on cd, floppy or usb-stick.

On your infected computer, boot again in safe mode and open your task manager again.
Now insert the cd, floppy or usb-stick where you saved the smitrem folder in your infected computer.

In your Task Manager, click 'applications' (first tab).
Click the New Task button.
Cick browse.

Now browse to the drive where your floppy, usb-stick or cd is present (could be A or D or E or F.. you'll see..)
Search for that smitrem folder.
Right click on the smitrem folder and choose: Copy

Now browse again via Task Manager to My Documents or Program Files.
Right click somewhere in there, right click and choose: Paste
Now open the smitrem folder you just copied and pasted and click the file: RunThis.bat
Then click open.
In the window where it says 'Create new task', click OK.

Normally, you'll have to drag the different windows you'll see to left or to right, because normally they will open on top of each other and you wont see the command window the tool starts that is under it.
You'll see a blue window now.
Follow the prompts on screen.
Wait for the tool to complete.

When done, in Task Manager, click 'shut down' from the menu on top and click restart. Your computer will reboot now.
Reboot to normal mode and post a hijackthis log in your next reply.

[dumbdog]

Hi, and thanks. I will try this, it may take some time since the laptop I'm using has no floppy, so I'll need to borrow someone else's computer. And, like I said, I haven't been able to boot in safe mode for some time. But I will certainly make the effort (and I promise a donation if it works).

Harry

[g2i2r4]

Let's clean first.

If this doesn't work, try normal mode.

Take your time (I'll come running as soon as you reply).



EDIT:
As there has been no reply from the original poster for more than two weeks this topic is now closed.

If you are the original poster and still need assistance, please send me a PM.

Edited by g2i2r4, 14 August 2005 - 02:28 PM.