Databases (73)
Linux (41)
Outside the Cube (4640)
Programming (679)
Web publishing (65)
Windows (431)
Apache (6)
File Types (33)
Internet Explorer (6)
Network (11)
Passwords (6)
Printing
Processes (13)
Programming (318)
Exchange Links
About this site
| |
 |
New related comments
Number of comments in the last 48 hours
How to get into Windows when you lost the Administrator password
1 new comments
Spysheriff blocks my desktop background - how to remove Spysheriff
765 comments. Current rating: 
(299 votes). Leave comments and/ or rate it.
Question:
This morning I came to my computer and found an application named Spysheriff running. It supposedly had found a dozen of problems on my computer and demanded a purchase in order to remove them.It also had changed my desktop background image so that it looked like a error message (see the screenshot):
It tries to tell me that my computer is in really bad shape and I am in danger unless I pay them..
I tried to remove that desktop background image using the control panel but it is disabled! What can I do?
Answer:
|
Spysheriff is malware and should not be used to clean a PC from spyware/ adware/ malware. It's pretty bad e.g. if you try to use System Restore you will find that Spysheriff erased your restore points, so that won't work. SpySheriff does come with an uninstall program which removes SpySheriff, but it will not undo all the other damage your computer has suffered. |
Instead follow these steps:
- Open task manager by pressing Ctrl-Alt-Del, and click on the "Processes" tab. Look for Spysheriff there and kill the process if you see it. If you see a process named "winstall" (winstall.exe) then delete this one also.
- In the control panel goto "Add/ Remove Programs" and remove the "SpySheriff" program. If it says that it cannot uninstall, then you still have it running. It will uninstall once it's not running.
- Your desktop background will not be restored by that uninstall. Go into the registry by starting RegEdit.exe from the start button.
If your registry editor does not work, read this document "I cannot open the registry editor". - Look for this key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
It will have about 6 values stored that disable certain things. Delete this whole branch ActiveDesktop - the system will work with default values afterwards.
Also delete this branch in your registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System - Look in your root directory for a file named winstall.exe. Mine was in c:\ and 24064 Bytes in size.
This file is scheduled to execute each time you boot and it will re-install Spysheriff.
Delete that file.
Update:
As MG from Ottawa comments below, there may also be additional executable files that were created at the same time as winstall.exe. Those files may be named 'winstall.exe' and 'ibm00001.exe'. You should delete those files as well. If you have this file ibm0001.exe please see the other article regarding ibm0001.exe. - Restart your system.
Done.
Some people asked about the company that makes SpySheriff. This is their London address:
Company: SpySheriff Development Team Street address: Tooley 73a City: London Zip: EC1Y 1BL Country: United Kingdom |
|
||||||||
Comments:
| You are on page 48 of 51, other pages: 1 2 3 45 46 47 [48] 49 50 51 | ||
| ||
|
Thanks for the information about the delete&ctrl&alt
I don't think i have spysheriff But i certainly have winstall! I ended the process & put winstall in my receyle bin& delete! But these pops that says 'form 1' sometimes in blue i think keeps popping up then closing quickly.... Please help :S | ||
| ||
|
hahahahaha great! thank you, i have had winstall on my computer since my friend clicked on a link, from using windows messenger, i had deleted many other files that had randomly appeared on my computer after clicking this link but i could not delete 'winstall'. now that i had found this site i was able to delete it
| ||
| ||
|
The address for Spysherriff in London is a fake. The postcode (zipcode) EC1Y 1BL does not exist. (Enter it into www.streetmap.co.uk to check)
| ||
| ||
|
Thanks a lot this really helped
| ||
| ||
|
I'm really desperate... I don't have no idea whatsoever how I got this problem... And neither how to fix it as soon as possible and without any implications, because it's my friend's PC and I don't think it would be such a great gift for her when she's gonna be back from her vacation.
Anyways, the thing is that the only file I could found on my PC, related to this problem, was system32, created today... I deleted it, but the only problem that persists is that the default home page when I start IE is the same, but as the file is deleted, there's a small window popping, saying that there was no such file found. The rest is 'normal', but I wiuld still love to know how I can get rid of it. Thank you very much!!! Diana | ||
| ||
|
yew i rule... i was wondering if anyone would find this solution and yer, im glad that ppl with the problem got it fixed...
if u want help with anything ill try to help, email me at morgaen.l@gmail.com | ||
| ||
|
Diana
i had the same problem as you and I solved it in the following way. Run Regedit, then click the following; hkey_current_user, then click on software, once you are here you should see the spysheriff folder by scrolling down, you should delete all of its contents and the actual folder. once this is done you can change your homepage back to whatever homepage you had before. If you cannot see pictures, click on tools, options, advanced, then make sure the box show pictures is ticked. I hope this helps You. | ||
| ||
|
Hi! Now I really need your help,and please,Im SO SO not good on this computerthing...I´ve got a start-site with the blue warning-thing and IT so irritating! Want to get rid of It but I really can not... There Is no 'winstall thing to delete,neather any Spysherif to find...anywhere....!!? Now I have some problems understanding the forms and stuff In english...I dont know where you mean I should look!!...I understand swedish thow..Can anyone help me please?? thanx a lot!
| ||
| ||
|
It worked, it fix my desktop background.
Thanks | ||
| ||
|
Thanks for the help, 'anonymus' :D As soon as I'll do it I'll let you know if it worked or not :)
Diana | ||
| ||
|
'Anonymus', I did as you said but there is no such 'spysheriff' folder there... The only thing that might be strange (or not...), is that in the Microsoft > Windows > Current Version > Policies > Explorer folder there are 2 archives: one has a little white icon with a red 'a' letter, which says 'by default' (REG_SZ); and another one, with a blue binary (I think) symbol or something (REG_DWORD). I think that I light have changed it's original name when I tried to do something around... so now it's simply 'c' :D
I'm completely lost... And as if that wasn't enough, there's another tricky virus, or a trojan, which is a dialer... something that has in it's name win/bn/32... I don't know what to do with it either... The only solution I found to this one was to change the date on the computer, which helps me that this thing does not intempt connection each 15 minutes, driving the 'Avast' antivirus crazy... So what should I do now???? I'm quite scared, desperate... Thanks a lot to anyone who can help me with these two little bastards running around this PC... Thanks again, british 'anonymus' :) | ||
| ||
|
Thank you so much. This thing has been such a pain in my mainframe.
| ||
| ||
|
Thanks a ton! I wanted to break my computer because of this @#(*%#$*& thing!
| ||
| ||
|
wow I'm feeling fucked right now. I seem to have the more apparently modern version of spysherrif cause none of those things were in my registry and there was no program called wininstall.exe either....... it's showing up in my remove programs which I did... but it's still showing as a red x in my system tray. it says 'you computer is infected' luckily I dont give a fuck about this laptop but I'd sure like to get rid of this shit without a reinstall.,
| ||
| ||
|
Whew! I just got rid of the ill effects of Spysheriff. When it first appeared, I was able to remove it from my computer but it left my wallpaper background blue and It could not be changed. I edited my registry and deleted the entriunder: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVerVersion\Policies\System
and undeHKEY_LOCAL_MACHINE_\ Software\Microsoft|Windows\CurrentVersionion\System I did not find either the winstall.exe or the ibm00001.exe files. Even before I restarted my computer my wallpaper was back to it's original state. I want to thank you for your suggestions. It worked! | ||
| You are on page 48 of 51, other pages: 1 2 3 45 46 47 [48] 49 50 51 |
