Help with Smitfraud toolbar888 and Torpig

• ndmmxiaomayi

  8 Jun 07, 18:20

  http://www.sgforums.com/?action=post_display&post_id=6019548
  
  Prevent a re-infection.
  
  Need not to follow everything there, choose what you think is acceptable.
• rpgragnarok

  8 Jun 07, 18:29

  hmm... i just ran another spybot check ,though the smitfraud toolbar 888 is gone , it says im still infected with torpig. Any help..?
• ndmmxiaomayi

  8 Jun 07, 18:30

  Any particular files that it finds?
• rpgragnarok

  8 Jun 07, 18:33

  It is found in C:/Windows/Temp/$_2341233.tmp and C:/Windows/Temp/$_2341234.tmp
• ndmmxiaomayi

  8 Jun 07, 18:34

  http://www.atribune.org/content/view/25/2/
  
  Use ATF Cleaner to clean up the temporary files.
• rpgragnarok

  8 Jun 07, 18:43

  Hmm , used ATF to clean everything le , but scan with spybot and it comes again
• ndmmxiaomayi

  8 Jun 07, 18:47

  Can try in Safe Mode?
• rpgragnarok

  8 Jun 07, 19:11

  If i start in safe mode , im unable to log in to my usual account because i can't choose my server. Even if i log in my administrator and clean it , theres nothing for me to clean it says , then when i run the spybot , it says theres no immediate threat.
  Then i return back to normal mode and scan , the torpig is still there.
• ndmmxiaomayi

  8 Jun 07, 19:12

  Hmm... they are temporary files...
  
  You can try manually deleting the files...
• rpgragnarok

  8 Jun 07, 19:14

  Originally posted by ndmmxiaomayi:

  Hmm... they are temporary files...
  
  You can try manually deleting the files...

  Tried le...It says the file is in use..
• ndmmxiaomayi

  8 Jun 07, 19:27

  Originally posted by rpgragnarok:

  Tried le...It says the file is in use..

  They are all temporary files...
  
  Can get me the list of those files?
• rpgragnarok

  8 Jun 07, 19:32

  Originally posted by ndmmxiaomayi:

  They are all temporary files...
  
  Can get me the list of those files?

  Hmm...Which list of files? Issit the list of files in windows/temp?
  
  If so , then:
  Perflib_Perfdata_df4.dat
  $_2341233.TMP
  $_2341234.TMP
  $b17a2e8.tmp
• ndmmxiaomayi

  8 Jun 07, 19:33

  Originally posted by rpgragnarok:

  Hmm...Which list of files? Issit the list of files in windows/temp?
  
  If so , then:
  Perflib_Perfdata_df4.dat
  $_2341233.TMP
  $_2341234.TMP
  $b17a2e8.tmp

  The list of infected files.
• rpgragnarok

  8 Jun 07, 19:36

  Originally posted by ndmmxiaomayi:

  The list of infected files.

  You mean the list of files spybot scanned and says its infected?
  They are:
  $_2341233.TMP
  $_2341234.TMP
  
  Both are under the name of Torpig
• rpgragnarok

  9 Jun 07, 10:03

  Mayi help help pleaseee....Now one more problem yesterday...Windows media player also got problem le...Whenever i open it , a few sec later then it got error. Tried reinstalling but still happened.
  
  Pic:
  
• rpgragnarok

  9 Jun 07, 13:54

  Big thank you Mayi!!
  Thanks a lot , by the way , here also got teach teach abit how to remove the final piece of Torpig. http://www.bleepingcomputer.com/forums/topic87218.html
  Now i spybot scan also dun have Torpig le..
  Thanks thanks..but can also teach me how to fix that windows media player?? Really paiseh , keep troubling you..
• ndmmxiaomayi

  9 Jun 07, 13:57

  Er... that is memory error. You can try uninstalling and reinstalling Windows Media Player.
  
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b446ae53-3759-40cf-80d5-cde4bbe07999&displaylang=en
• rpgragnarok

  9 Jun 07, 14:01

  Originally posted by ndmmxiaomayi:

  Er... that is memory error. You can try uninstalling and reinstalling Windows Media Player.
  
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b446ae53-3759-40cf-80d5-cde4bbe07999&displaylang=en

  YAY!! No need le , just tried using Windows Media Player , now can be used le , maybe something to do with removing Torpig..
  Give you big big kiss ^_^
  Thanks thanks