Smithfraud-C.Toolbar888 2 Reg values will not remove

G

gman1964

New member
Help!!!

I have 4 computers that are infected with the Smithfraud-C.Toolbar888 adware. I am running spybot 1.3 (because of your button issue that is in 1.4).

I have the latest virus defs and even running in safe mode I cant remove

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\winlogon\notify\LMlinit and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\winlogon\notify\sebring.

Can anyone help?

Thanks,

Kevin
 
Resolution for your button issue:

There is currently a bug in TeaTimer 1.4. Portions of TeaTimer's popup dialog overlay the "Allow change" and "Deny change" buttons. On my system the very top edges of the "Allow change" button (on the left) and "Deny change" button (on the right) are showing and I am still able to select the options. I also can check "Remember this decision" since it is visible. If no portion of the "Allow change" and "Deny change" buttons are showing, you can answer TeaTimer's popup dialog (English language version) by pressing "A" on your keyboard for "Allow change" or "D" for "Deny change". Note: If you close the dialog without answering "Allow change" or "Deny change" the registry change is denied.

If you can't deal with the problem that way until it is fixed, you can:
  1. Apply one of the workarounds found in the following pinned (Sticky) thread that fixes the pop-up dialog so the buttons are visible:
    There are three (3) fixes published in that thread. They are:


  2. Disable TeaTimer as follows:
    • Go into Spybot > Mode > Advanced Mode > Tools > Resident.
    • Uncheck the following:
      • Resident "TeaTimer" (Protection of over-all system settings) Active.
********************

Notes about the patches (b. and c. above):

*****************

See if Spybot 1.4 removes the problem otherwise consider posting in the Malware Removal forum following the instructions outlined here:
 
gman1964 said:
Help!!!

I have 4 computers that are infected with the Smithfraud-C.Toolbar888 adware. I am running spybot 1.3 (because of your button issue that is in 1.4).

I have the latest virus defs and even running in safe mode I cant remove

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\winlogon\notify\LMlinit and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\winlogon\notify\sebring.

Can anyone help?

Thanks,

Kevin
Click to expand...

Looks like it could be a false positive, Kevin.

See http://forums.spybot.info/showthread.php?t=8668
 
I am having trouble with this smithfraud as well but am not running a tablet pc. I run spybot and it detects it but will not remove it. should i be alarmed...I am new to all of this and my pc is infected and trying to get it fixed. any help would be great
 
This is an older post,dealing with a false positive where Spybot was detecting HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\winlogon\notify\LMlinit and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\winlogon\notify\sebring
as Smitfraud-C.Toolbar888.It's been fixed for a while.

What Spybot is detecting on yours is probably different.

my pc is infected and trying to get it fixed. any help would be great
Click to expand...
If your pc is infected,you might want to go ask for help in malware removal.

The instructions to follow are here:
http://forums.spybot.info/showthread.php?t=288

Malware Removal:
http://forums.spybot.info/forumdisplay.php?f=22
 
Last edited:
You must log in or register to reply here.
Back
Top