BleepingComputer.com: Tibs.vq; Smitfraud-c On My Spybot Search

Jump to content

Forum Rules

When posting your problem, do not run and post a ComboFix log. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.

To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.


If you have not received help after three days, please post a link to your topic HERE.
Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

Tibs.vq; Smitfraud-c On My Spybot Search

#1 User is offline   bennpcidiot 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 6
  • Joined: 31-May 06

Posted 31 May 2006 - 08:31 PM

I am having the hardest time trying to figure out how to get rid of Smitfraud-C and tibs.vq. Spybot identified
them and I can't seem to remove them. Is there some special thing I need to do? I have Adaware; Spybot;
Spyblaster; Symantec Anti-virus on my computer. I am about as non-computer saavy as they come and have no idea where to even start. Any ideas? Please!!! Thanks.

#2 User is offline   Nat Sci 

  • Forum Regular
  • PipPipPip
  • Find Topics
  • Group: Members
  • Posts: 156
  • Joined: 21-March 06

Posted 31 May 2006 - 10:30 PM

You can use the tutorial here and delete it manually or wait for Quietman7 to post the Smipfraudfix tutorial to delete it auto.
Legend has it that... If you put an AOL disc the opposite way and play it you can hear devilish music... Even worse if you put it the right way... IT INSTALLS AOL!
Click here 3 times for $100,000<--- I mean .00001 dollars.

#3 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,518
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 01 June 2006 - 06:48 AM

Those malware files were included in Spybot's defintion updates for April & May. Similar reports have been made at the Spybot forum where they have been detected but not removed.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Please download and install Ewido Anti-Malware v3.5. DO NOT perform a scan yet..
Print out the Ewido Install and Scan Instructions.

Go here and follow the instructions for using SmitfraudFix.
After using the tool reboot again in "SAFE MODE" and

Clean out your Temporary Internet files as follows:
  • Quit Internet Explorer and quit any instances of Windows Explorer.
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click "Delete Files" under Temporary Internet Files.
  • In the Delete Files dialog box, tick the "Delete all offline content check box", and then click "OK".
  • On the General tab, click "Delete Cookies" under Temporary Internet Files, and then click "OK".
  • Click on the Programs tab then click the Reset Web Settings button. Click "Apply" then "OK".
  • Click "OK".
Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click "Ok" then "Apply" and "Ok".

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.

Then perform a scan with Ewido and reboot back to normal mode.
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#4 User is offline   bennpcidiot 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 6
  • Joined: 31-May 06

Posted 01 June 2006 - 01:18 PM

Thanks, I will try the steps when I get home from work tonight.

#5 User is offline   bennpcidiot 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 6
  • Joined: 31-May 06

Posted 01 June 2006 - 08:11 PM

OK, so now I am completely confused. I just got home, re-ran Spybot and neither Smitfraud-C or Tibs.vq showed up. The only thing identified was Casalemedia.

I'm an idiot, but does that mean my computer is clean from this?

Is there a way to determine if my computer is spyware/malware/virus free. I assume if my scans don't show anything it means my computer is clean?

#6 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,518
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 01 June 2006 - 08:17 PM

If you followed my instructions and then performed another Spybot scan afterwards where it found nothing than I would say the fix worked. If you didn't it could also be that Spybot deleted the files afterall.

The only way to be sure is to take a deeper look at your system by creating a hijackthis log. If you want to do this then I suggest you read and follow all instructions in the pinned topic titled Preparation Guide For Use Before Posting A Hijackthis Log.

When you have done that, post a log in the HijackThis Logs and Analysis Forum, not here, for assistance by the HJT Team Experts.

It may take a while to get a response because the HJT Team members are very busy. Please be patient as they are volunteers who will help you out as soon as possible. Once you have made your post, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have no replies as this makes it easier for them to identify those who have not been helped. If you post another response, a team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users