Trojan-Spy.HTML.Smitfraud.c, startsearches
Following an obvious attempt to insert a virus, I restarted by computer and saw the following message:
Neither AVG nor Housecall detected the virus.
The taskmanager showed the following abnormal files:popuper.exeSince these were running, I rebooted in safe mode, found them with searches and deleted them.
shnlog.exe
intmon.exe
msmsgs.exe
IE worked fine in safe mode
On advice from Googled sites I also found and deleted "msole32.exe" and "bsw.exe"
HiJack showed a search assistant (startsearches.net) to be hijacking my browser.
Microsoft antispyware detected "Easysearchbar", I deleted it, but it continually reappeared.
Searching for "startsearches" in the registry and deleting all "startsearch" entries solved the problem.
The security warning wallpaper is "wp.bmp". Delete this and reinstall your original wallpaper.
