Member Avatar for peetrod

I have windows Me and two errors came up. the 1st is in an explorer box that reads. Explorer has caused an error in OLE32.DLL. explorer will now close.
Even after restart it is still there.
The second is on a blue screen that reads.
A fatal error in IE has occured at 0028:C0011E36 in VXD VMM(01)+00010E36 . Error was caused by trojan spy.HTML.smitfraud.c
*System can not function in normal mode, please check your security settings.
*Scan your pc with any available antivirus/spyware remover program to fix the problem.
I can not get the pc to respond to anything, when i try to close the explorer box it reapperes. and I can not run any windows or even shut the pc down. The cd wont respond either. So what do I need to do? Thanks

  • 4 Contributors
  • 3 Replies
  • 207 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by Zorb

Dani AI

Generated

Summary and quick diagnosis: the on-screen “A fatal error in IE … Error was caused by Trojan‑Spy.HTML.Smitfraud.c” message is a classic scareware/desktop‑hijacker trick (the message itself can be faked by a different malware component). Smitfraud‑type infections commonly arrive via fake codec/downloads and then show bogus alerts to pressure victims into buying malware. See the F‑Secure note and a short Smitfraud overview. (f-secure.com)
F‑Secure writeup (explanation of the fake error) — Webopedia summary (how Smitfraud behaves).

If the machine will boot, follow ’s Safe Mode suggestion first (press F8, choose Safe Mode). Use Ctrl+Alt+Delete (the Close Program dialog in Win9x/ME) to End Task on explorer/any obvious unknown process so you can run tools. Run a dedicated Smitfraud cleanup (SmitFraudFix or SmitRem) and save the report they produce, then capture a HijackThis log (as suggested). Those tools and community removal guides describe generating a C:\rapport.txt or similar report for analysis. (majorgeeks.com)
SmitFraudFix details — SmitRem tutorial.

If Safe Mode fails or the desktop locks immediately, don’t pay or enter any info into popups. Boot from a rescue/bootable scanner (for example Kaspersky Rescue Disk) or a Linux Live CD, run an offline antivirus scan, and copy important personal files off the disk before attempting repairs. Offline scanning avoids the malware interfering with removal. (kaspersky.com)
Kaspersky Rescue Disk download/info.

A common complication: some hijackers replace or damage system DLLs such as wininet.dll; Windows 95/98/ME often lack an on‑disk backup copy, so you may need the original OS CD or a vendor patch to restore that file, or — if infection is persistent — consider a clean reinstall after backing up data. Community removal threads explain these steps and fallbacks. (pchell.com)

Practically: collect and post the SmitRem/SmitFraudFix report (C:\rapport.txt) plus a HijackThis log so volunteers can analyse; mention ’s safe‑mode lock behavior when you post. If you can’t get logs, image or remove the drive and scan it from another machine. Do not buy the fake scanner that the popups offer.

Recommended Answers

All 3 Replies

Member Avatar for Catweazle

Hi peetrod, and welcome to Daniweb.

Your problem isn't really a 'Dead machine'. It's a working Windows Me system which has problems after being infected with a 'Net nasty'. I'll move this to the 'Viruyses and Nasties' section, where you'll get assistance with troubleshooting procedures including, I suspect, starting your system in Windows 'Safe mode' so that the nasty critter can be removed!

Cheers.

Member Avatar for dlh6213

Hi peetrod, welcome to DaniWeb :D

Please follow the suggestions in these threads:

http://www.daniweb.com/techtalkforums/thread27519.html

http://www.daniweb.com/techtalkforums/thread27570.html

Get the self-extracting version of HijackThis from here (in line 2):
http://www.malwareremoval.com/downloads.html

Then close any open browser windows, 'Scan and Save Log' with hijackthis, copy the log, and paste it in this thread.

Member Avatar for Zorb

In follow-up to peetrod's post, I have been trying to fix a windows Me machine generating an identical message. In both normal and safe modes, it boots up normally until the repeating fatal error messages. Whilst in safe mode, it was possible to click on programs on the task bar and get them running, however after the first display of the message, the screen then locks. Continued access to some functionality (not explorer-related) of any task bar programs running is possible, however that's about it.
I've tried Ctrl Alt Deleting programs away, including <unknown> before this message appears and was wondering what I might be able to try next?
Failing that, would there be a way that this problem could be fixed in DOS?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.