• Announcements

    • LS.Andy

      Support for other products than adaware, ad block, web protection and Web Companion   05/05/2017

      Support for the following products is handled by the Lavasoft support team: Lavasoft Tuneup Kit Lavasoft PC Optimizer Lavasoft Driver Updater Lavasoft Registry Tuner Lavasoft Privacy Toolbox Lavasoft File Shredder Lavasoft Digital Lock

      For help with these products, contact the support team here: http://www.lavasoft.com/support/supportcenter/
Sign in to follow this  

frustrated - Your own topic is here

Recommended Posts

I have the exactly the same malware/adware whatever it is. I am going crazy trying to remove it - used norton internet security and zonealarm - is there any other program i can use - i m not a tech person and scared to start doing all the complicated things u asked the previous poster to do ... but i will do them if that is the ONLY way - i consider myself good with comps but no techie ... PLEASE HELP ME.


This is the problem: I seemed to have pick up some kind of spyware or malware. It created a new toolbar on my current one and also created two new icons on my desktop. They are titled "Online Security Guide" and "Security Troubleshooter. The properties tab reveals "thesecuritypages.com" and "testonsecurity.com" respectively. They do not show up in the add/remove programs. It also installed an icon in my systems tray telling me my computer is infected and to click on the icon to remove the infected files.

Share this post

Link to post
Share on other sites

I ran smitfraudfix and here's what i have from the notepad:


SmitFraudFix v2.81


Scan done at 10:35:21.10, Wed 08/16/2006

Run from C:\Documents and Settings\Najia\Desktop\SmitfraudFix

OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT

Fix ran in normal mode


»»»»»»»»»»»»»»»»»»»»»»»» C:\



»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS



»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system



»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web



»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32



»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles



»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Najia\Application Data



»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND !


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Najia\FAVORI~1



»»»»»»»»»»»»»»»»»»»»»»»» Desktop


C:\DOCUME~1\ALLUSE~1\Desktop\Online Security Guide.url FOUND !

C:\DOCUME~1\ALLUSE~1\Desktop\Security Troubleshooting.url FOUND !


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


C:\Program Files\IntCodec\ FOUND !


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys



»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components


[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]



"FriendlyName"="My Current Home Page"



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler

!!!Attention, following keys are not inevitably infected!!!


SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll






»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection



»»»»»»»»»»»»»»»»»»»»»»»» End


I hope someone can help me .... :)

Share this post

Link to post
Share on other sites

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.


Next, please reboot your computer in Safe Mode by doing the following :

  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.

Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd

Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.


You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.


The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".


The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.

A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply with a new hijackthis log.

The report can also be found at the root of the system drive, usually at C:\rapport.txt


Warning : running option #2 on a non infected computer will remove your Desktop background.

Share this post

Link to post
Share on other sites
Sign in to follow this