Smithfraud-C.Toolbar888 2 Reg values will not remove

[gman1964]

Help!!!

I have 4 computers that are infected with the Smithfraud-C.Toolbar888 adware. I am running spybot 1.3 (because of your button issue that is in 1.4).

I have the latest virus defs and even running in safe mode I cant remove

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\winlogon\notify\LMlinit and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\winlogon\notify\sebring.

Can anyone help?

Thanks,

Kevin

[md usa spybot fan]

Resolution for your button issue:

There is currently a bug in TeaTimer 1.4. Portions of TeaTimer's popup dialog overlay the "Allow change" and "Deny change" buttons. On my system the very top edges of the "Allow change" button (on the left) and "Deny change" button (on the right) are showing and I am still able to select the options. I also can check "Remember this decision" since it is visible. If no portion of the "Allow change" and "Deny change" buttons are showing, you can answer TeaTimer's popup dialog (English language version) by pressing "A" on your keyboard for "Allow change" or "D" for "Deny change". Note: If you close the dialog without answering "Allow change" or "Deny change" the registry change is denied.

If you can't deal with the problem that way until it is fixed, you can:

1. Apply one of the workarounds found in the following pinned (Sticky) thread that fixes the pop-up dialog so the buttons are visible:
   
   • Solution to fix the pop-ups in TeaTimer
     http://forums.spybot.info/showthread.php?t=122
   
   
   There are three (3) fixes published in that thread. They are:
   
   
   
   1. The ResHacker fix published by ElPiedra here:
      
      • http://forums.spybot.info/showpost.p...23&postcount=1
   2. The murdo patch published here:
      
      • http://forums.spybot.info/showpost.p...75&postcount=9
      
      Also republished by RuggeR29 (which I have never tried) here:
      
      • http://www.fureyonline.com/downloads/patch.zip
   3. The patch originally by SyreneD that I published here:
      
      • http://forums.spybot.info/showpost.p...0&postcount=38
      
      Also republished by SyreneD himself here:
      
      • http://forums.spybot.info/showpost.p...&postcount=125
   
   
   
2. Disable TeaTimer as follows:
   • Go into Spybot > Mode > Advanced Mode > Tools > Resident.
   • Uncheck the following:
     • Resident "TeaTimer" (Protection of over-all system settings) Active.

********************

Notes about the patches (b. and c. above):

• If you installed Spybot in the default location:
  
  • C:\Program Files\Spybot - Search & Destroy
  
  The following patch (c.) defaults to that location:
  
  • The patch originally by SyreneD that I published here:
    
    • http://forums.spybot.info/showpost.p...0&postcount=38
    
    Also republished by SyreneD himself here:
    
    • http://forums.spybot.info/showpost.p...&postcount=125
  
  If you use this patch (b.) you have to navigate to the correct location (See Note #1) unless you execute the patch from within the "C:\Program Files\Spybot - Search & Destroy" folder:
  
  • The murdo patch published here:
    
    • http://forums.spybot.info/showpost.p...75&postcount=9
    
    Also republished by RuggeR29 (which I have never tried) here:
    
    • http://www.fureyonline.com/downloads/patch.zip
    
    
    Note# 1: To the right of the Target File (TeaTimer.exe) there is a button that looks like "[ . . . ]". Click on that button, navigate to the correct folder, click "Open" and then "Start".

*****************

See if Spybot 1.4 removes the problem otherwise consider posting in the Malware Removal forum following the instructions outlined here:

• "BEFORE you POST" -Preliminary Steps and scanning with SPYBOT-S&D

[satrow]

Help!!!

I have 4 computers that are infected with the Smithfraud-C.Toolbar888 adware. I am running spybot 1.3 (because of your button issue that is in 1.4).

I have the latest virus defs and even running in safe mode I cant remove

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\winlogon\notify\LMlinit and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\winlogon\notify\sebring.

Can anyone help?

Thanks,

Kevin

Looks like it could be a false positive, Kevin.

See http://forums.spybot.info/showthread.php?t=8668

[lcfalcon]

I am having trouble with this smithfraud as well but am not running a tablet pc. I run spybot and it detects it but will not remove it. should i be alarmed...I am new to all of this and my pc is infected and trying to get it fixed. any help would be great

[Zenobia]

This is an older post,dealing with a false positive where Spybot was detecting HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\winlogon\notify\LMlinit and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\winlogon\notify\sebring
as Smitfraud-C.Toolbar888.It's been fixed for a while.

What Spybot is detecting on yours is probably different.

my pc is infected and trying to get it fixed. any help would be great

If your pc is infected,you might want to go ask for help in malware removal.

The instructions to follow are here:
http://forums.spybot.info/showthread.php?t=288

Malware Removal:
http://forums.spybot.info/forumdisplay.php?f=22