Trojan-Spy.HTML.Smitfraud.c, startsearches
Trojan-Spy.HTML.Smitfraud.c, startsearches
Following an obvious attempt to insert a virus, I restarted by computer and saw the following message:



Neither AVG nor Housecall detected the virus.

The taskmanager showed the following abnormal files:
popuper.exe
shnlog.exe
intmon.exe
msmsgs.exe

Since these were running, I rebooted in safe mode, found them with searches and deleted them.

IE worked fine in safe mode

On advice from Googled sites I also found and deleted "msole32.exe" and "bsw.exe"

HiJack showed a search assistant (startsearches.net) to be hijacking my browser.

Microsoft antispyware detected "Easysearchbar", I deleted it, but it continually reappeared.

Searching for "startsearches" in the registry and deleting all "startsearch" entries solved the problem.

The security warning wallpaper is "wp.bmp". Delete this and reinstall your original wallpaper.