smitfraudfix - Tools to remove desktop hijack malware

Below are the steps to run smitfraudfix:-

Double-click SmitfraudFix.exe -> type 1 for search -> enter -> it will create a report of the infected files. Report can be found at the root of the system drive, usually at C:\rapport.txt


Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually)
Double-click SmitfraudFix.exe -> type 2 for clean-> enter to delete infect files -> Message "Do you want to clean the registry ?" appeared -> choose Y (yes) -> enter & it'll remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? -> Y (yes) -> enter to restore a clean file -> reboot

Optional:
To restore Trusted and Restricted site zone, select 3 and hit Enter.
You will be prompted: Restore Trusted Zone ? -> Y (yes) -> Enter to delete trusted zone.