Whoever else whos had this im sure feels my pain.

This spyware randomly creates files in my temp folder in documents and settings and if i do not delete them manually every now and then it will take over my desktop and tell me to install some gay program to remove the spyware. only an idiot noob would download that thing.

at first i only had microsofts antispyware on my computer but it wouldnt fully get rid of it so i got spybot and it got rid of it and fixed my computer, but those .exe files keep coming up in my temp folder and sometimes shows up when i search for spyware in spybot and MS antispyware. does anyone know how i can fully get rid of it. ive searched google but they all talk non-sense ive never heard of.

thanks

3/6/2006 7:20:36 PM

spybot blows ass. it doesnt do anything better than MS antispyware (which you need to update, its in V2 and called windows defender now)

and google for it, theres a looong list of manual steps necessary to actually get rid of it.

3/6/2006 7:25:59 PM

so you think windows defender by itself is good enough? no need for spybot?

3/6/2006 7:29:17 PM

I'm gonna have to disagree with that.


I'm sure Neon means that Defender can be used to replace spybot, NOT to be the sole means of removing spybot on a PC.

And in order to download and use defender, the average joe will need a legit copy of windows. So it's not really an option for a boat load of people.

3/6/2006 9:15:50 PM

spy sweeper got rid of my spy sheriff. that had to be the worst shit in the world to get rid of

3/6/2006 9:59:16 PM

Quote :

"And in order to download and use defender, the average joe will need a legit copy of windows. So it's not really an option for a boat load of people."

have they not figured a way around that yet? I used my MSDN version, but some of my friends have the no-activation version still

3/6/2006 10:09:13 PM

so it goes like this

i got defender up and running, updated to the max, ran a full scan and spysherrif pops up. i choose to remove it.

i run my norton antivirus and it detects 2 spysherrif potential threats and im like wtf


i dont know what to do and those message boards that have people talking about deleting it i have no idea what any of that nonsense means. for the guy who deleted it with spysweeper, did it just detect it, you selected remove and you never heard back from it or what? bc if thats the only program thats truly going to get rid of it im going to do it. couldnt hurt.

3/6/2006 10:22:29 PM

run everythin in safe mode if u arent doing so. clear ur internet cookies, temp files, etc to make sure nothing is residing in there. download and run hijackthis and then post the log file here: http://www.hijackthis.de to analyze the results. then whatever is marked bad, just check the box to get rid of the entries.

3/6/2006 10:41:52 PM

1) disable system restore

2) boot into safe mode

3) run an assload of scans including windows defender, adaware, spybot, antivirus etc. you'll probably have to reboot a couple times in the process

4) if that doesnt work reinstall windows

3/6/2006 10:46:22 PM

im telling you from personal experience.

the ONLY way to completely get rid of Spy Sheriff is to go through the MANUAL removal steps. There is NO TOOL that will COMPLETELY get rid of it.

Symantec+Windows Defender will do most of the work, but yes, you need to reboot in safe mode and do the rest of the cleanup yourself.

3/7/2006 12:09:27 AM

ccleaner + autoruns + regedit + a watchful eye of shit thats not supposed to be in certain places

3/7/2006 10:10:55 AM

Quote :

"Kill the following processes 1950.exe newdial.exe spysheriff.exe uninstall.exe winstall.exe Delete these registry entries SOFTWARE\\spysheriff SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\uninstall\\spysheriff Remove the following files 1950.exe newdial.exe spysheriff.exe uninstall.exe winstall.exe Desktop.html Desktop\\SpySheriff.lnk Remove the following directories Program Files\\spysheriff --------------------------------------------------- you will also find registries of the above files on: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars in one of the {...} folders there will be one named: FilesNamedMRU and there you have plenty of registries to delete: 1950, spysheriff, ... to access regedit just type regedit under command line mode http://www.spywaredb.com/remove-spy-sheriff/ "

Seems like a simple script could be made for this .

3/7/2006 10:26:03 AM

has someone been visiting serials.ws, beacuse thats a bad site to get viruses

3/8/2006 11:22:14 PM

when I got spysherriff, i bit the bullet and formatted my entire hard drive. I wasnt going to deal with the bullshit, i'd rather re-install some shit.

3/9/2006 9:04:43 AM

after about 15 minutes of googling, i found instructions to remove it manually. took about another 45 minutes probably to look through the registry and system folder and delete the files. its really not that hard, though. i didn't even know how to get into safemode before this endeavor.

3/9/2006 7:54:29 PM