Scott010

I have recently found on my computer the malware smitfraud-C.toolbar888 when scanning using spybot search and destroy. Each time i removed this malware it would reinstall itself along with another program i beleive calle "smitfraud" that kept telling me on startup that my computer was infected with spyware and that i should follow a link to download a program to remove it. After disconnecting my pc from the internet i managed to stop smitfraud from being reinstalled but the "smitfraud-C.toolbar888" keeps being reinstalled. I checked the description of the malware in spybot and this is the description it had.
"smitfraud-C.toolbar888 is connecting to malicious website without giving the user a possibility to cancel that process. It also adds a randomly named dll to the Winlogon Notify, which will make it very resistable to removal."
What i need to know is how do i find the dll and stop this program from reinstalling itself?
Thank you and feel free to ask for anymore information and i will do my best to get it for you

Glaswegian

Hi and welcome to TSF.

Please follow these instructions.

Download ComboScan to your Desktop.

1. Close all applications and windows.
2. Double-click on comboscan.exe to run it, and follow the prompts.
3. When the scan is complete, a text file will open - ComboScan.txt
4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of ComboScan.txt in a new thread in the HJT Forum (do not attach it or post it here).
5. A folder, C:\ComboScan, will also open. In it will be another text file, Supplementary.txt.
6. Please attach Supplementary.txt to your post.

Note: some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so.


To attach a file to a new post, simply

1. Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and
2. copy and paste the following into the "Upload File from your Computer" box:

   C:\ComboScanSupplementary.txt
   

3. Click Upload.

We'll then have a look and provide instructions to clean your system, if required. Please note that the HJT forum is constantly busy, so I would ask that you be patient while waiting for a reply.

Scott010

thank you i'll do that now