spy sheriff help please

  crisp1 19:56 20 Jan 06
Locked

got spy sheriff on my pc thought i d got rid but its come back last time used adaware cleared cookies and it went this time adaware just locks up. hope some one can help its driving me thanks

  GANDALF <|:-)> 19:59 20 Jan 06
  VoG II 20:00 20 Jan 06

Try this click here

  Fruit Bat /\0/\ 20:37 20 Jan 06

1. Open task manager by pressing Ctrl-Alt-Del, and click on the "Processes" tab. Look for Spysheriff there and kill the process if you see it. If you see a process named "winstall" (winstall.exe) then delete this one also.

2. In the control panel goto "Add/ Remove Programs" and remove the "SpySheriff" program. If it says that it cannot uninstall, then you still have it running. It will uninstall once it's not running.

3. Your desktop background will not be restored by that uninstall. Go into the registry by starting RegEdit.exe from the start button

4. Look for this key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop

It will have about 6 values stored that disable certain things. Delete this whole branch ActiveDesktop - the system will work with default values afterwards.
Also delete this branch in your registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

5. Look in your root directory for a file named winstall.exe. Mine was in c:\ and 24064 Bytes in size.
This file is scheduled to execute each time you boot and it will re-install Spysheriff.
Delete that file.
Update:
there may also be additional executable files that were created at the same time as winstall.exe. T
those files may be named 'winstall.exe' and 'ibm00001.exe'.
You should delete those files as well.
If you have this file ibm0001.exe please see the other article regarding ibm0001.exe. at click here

6. Restart your system.

  crisp1 22:17 20 Jan 06

hello friutbat tried the above nothing in task manager its not in add and remove but its in programme files any more ideas thanks

  VoG II 22:18 20 Jan 06

Yes. Run HJT click here and post a log at the Malware Removal forum click here

This thread is now locked and can not be replied to.

Surface Pro (2017) vs Surface Pro 4

20 groundbreaking 3D animation techniques

How to mine Bitcoin on Mac