Here's one way that I find works on many hijacking viruses. Open C:\WINDOWS\SYSTEM.DAT and use the search menu to search for the text, http://nkvd.us which actually redirects to http://smart-finder.biz.

The file tells your software what to add in front of every domain name, and ususally this is http:// but the virus replaces this with http://www.nkvd.us.

Amazingly, the operating system did not let me change the file's contents! Somehow, though, the website you visited changes the content of this file without your permission.

Restart your computer. Type in your password. Let the operating system flash the Windows 98 screen, then the screen turns black. Ctrl+Alt+Delete will restart your computer and give you the opportunity to start in Safe mode. Select the menu item, COMMAND PROMPT ONLY.

At the DOS prompt, key in the following:
CD\WINDOWS
ATTRIB SYSTEM.DAT -H -S -R +A
EDIT SYSTEM.DAT
Now, you CAN change the contents of SYSTEM.DAT and delete every reference to nkvd.us by changing it to blank.

Exit the DOS text editor. At the DOS prompt, key in the following:


ATTRIB USER.DAT -H -S -R +A
EDIT USER.DAT

Change all references to http://www.nkvd.us to http://.

What actually happens next, after rebooting the system, is that the operating system detects "unauthorized" tampering with these files and replaces them with back-ups which are not contaminated with the virus. You may have to reboot the computer yet again.

You may want to check the path C:\WINDOWS\TEMPOR~1\CONTENT.IE5 and see if there is anything in any of the files there which you do not want stored. Hidden files may be lurking there. At the DOS prompt, key in CD\WINDOWS\TEMPOR~1 and key in RD CONTENT.IE5 which will determine whether there are hidden files. The system will tell you if the path is empty or not when you try to delete the subdirectory. The system does not allow you to delete non-empty directories. At the DOS prompt, key in CD CONTENT.IE5 and then ATTRIB -R -H -S +A which should reveal any hidden directories or hidden files. ATTRIB changes the attributes of a file. -R makes it no longer read-only, -H makes it no longer hidden, -S makes it no longer a system file, and +A makes it an archive (normal) file.

You may be startled to see your internet activity archived on your computer, and when you are ready to buy a new computer, you may want to toss your old hard drive into the fire, wiping out everything on it.