Databases (73)
Linux (41)
Outside the Cube (4640)
Programming (679)
Web publishing (65)
Windows (431)
Apache (6)
File Types (33)
Internet Explorer (6)
Network (11)
Passwords (6)
Printing
Processes (13)
Programming (318)
Exchange Links
About this site
| |
 |
New related comments
Number of comments in the last 48 hours
How to get into Windows when you lost the Administrator password
1 new comments
Spysheriff blocks my desktop background - how to remove Spysheriff
765 comments. Current rating: 
(299 votes). Leave comments and/ or rate it.
Question:
This morning I came to my computer and found an application named Spysheriff running. It supposedly had found a dozen of problems on my computer and demanded a purchase in order to remove them.It also had changed my desktop background image so that it looked like a error message (see the screenshot):
It tries to tell me that my computer is in really bad shape and I am in danger unless I pay them..
I tried to remove that desktop background image using the control panel but it is disabled! What can I do?
Answer:
|
Spysheriff is malware and should not be used to clean a PC from spyware/ adware/ malware. It's pretty bad e.g. if you try to use System Restore you will find that Spysheriff erased your restore points, so that won't work. SpySheriff does come with an uninstall program which removes SpySheriff, but it will not undo all the other damage your computer has suffered. |
Instead follow these steps:
- Open task manager by pressing Ctrl-Alt-Del, and click on the "Processes" tab. Look for Spysheriff there and kill the process if you see it. If you see a process named "winstall" (winstall.exe) then delete this one also.
- In the control panel goto "Add/ Remove Programs" and remove the "SpySheriff" program. If it says that it cannot uninstall, then you still have it running. It will uninstall once it's not running.
- Your desktop background will not be restored by that uninstall. Go into the registry by starting RegEdit.exe from the start button.
If your registry editor does not work, read this document "I cannot open the registry editor". - Look for this key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
It will have about 6 values stored that disable certain things. Delete this whole branch ActiveDesktop - the system will work with default values afterwards.
Also delete this branch in your registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System - Look in your root directory for a file named winstall.exe. Mine was in c:\ and 24064 Bytes in size.
This file is scheduled to execute each time you boot and it will re-install Spysheriff.
Delete that file.
Update:
As MG from Ottawa comments below, there may also be additional executable files that were created at the same time as winstall.exe. Those files may be named 'winstall.exe' and 'ibm00001.exe'. You should delete those files as well. If you have this file ibm0001.exe please see the other article regarding ibm0001.exe. - Restart your system.
Done.
Some people asked about the company that makes SpySheriff. This is their London address:
Company: SpySheriff Development Team Street address: Tooley 73a City: London Zip: EC1Y 1BL Country: United Kingdom |
|
||||||||
Comments:
| You are on page 49 of 51, other pages: 1 2 3 46 47 48 [49] 50 51 | ||
| ||
|
thanks a lot it works
| ||
| ||
|
okay im in the registry all the way up to current vision except I went into Internet settings and I got all these weird things like EnableAutodial REG_DWORD 0x00000001 and stuff like that with the blue icon with the 1's and 0's on it.This REG_DWORD is there anythingfishy about it??
| ||
| ||
|
check under explorer and system, sometimes other policies are there too
| ||
| ||
|
REG_DWORD is microsoft stuff, dont delete that key
| ||
| ||
|
You need to delete the REG_DWORD and REG_FWORD keys, because they are data files set up by spysheriff. If you also see a REG_SWORD keys, you should also delete them too. Also, delete any registry keys that have the words 'Windows Explorer', or 'Critical System Files'.
Finally, download the program 'MSBAG V1.02'. It tricks your computer into thinking its sexy, forgetting about such things as hidden virus exe files that regenerate winstall.exe. Profesor Cunthor | ||
| ||
|
Sorry this is Cunthor again. I just heard that MSBAG V1.02 is unstable when run under a windows environment. I will update on latest. Meanwhile, why don't you stick your head inside the freezer for entertainment purposes (mine)
| ||
| ||
|
My hat is off to you. I spent an hour on the phone with McAfee 'Tech Support' and they had no clue how to fix it
| ||
| ||
|
Norton Antivirus removed spy sheriff, but it still says that there is an user called administrator that was created by spysheriff. I cannot find this Administrator under users, but the Norton Security Inspector says there is an adminstrator user still here nad it has a weak password, how do I find and remove it? As stated before, there is no Administrator under users.
| ||
| ||
|
I also had spy sheriff, but it has blocked me from seeing anything BUT my background. I do not have access to my task bar, desktop icons, or the start menu. THe only way to access limited items is by going through the Windows Task Manager. Any suggestions for this?? Thanks!!
| ||
| ||
|
Hey I removed the program SpySheriff awhile back ago but I still can't change my wallpaper. I am computer illiterate and don't know what I am doing but is there anyway I can restore this feature?
| ||
| ||
|
Spot on! Ta for the advice. All tickety-boo now :)
| ||
| ||
|
to enable or disable the task manager, go to start menu and run, type gpedit.msc after that the group policy will appear. Open User configuration-administrative templates-system-ctrlAltdel options-remove task manager. If you choose Enabled the task manager is disable, and choosing Disabled will enable the task manager. Hope this will help.
| ||
| ||
|
Thank you very much. I got this problem all of sudden when I started my computer.
All I had to do is stop the spysheriff process and remove the program from add/remove program and it was gone. I need to get rid of 211 infected files it got on my computer though. I couldn't see the registry entries under policies folder though. Please post some comment about that. thanks Mahesh | ||
| ||
|
Thank you so much, you saved me :)
| ||
| ||
|
the one I have is:bravesentry (BS 2.0) does the same trick to my pc. my desktop background id desable, i am still fighting it, now i have to restore my Desktop bg, anyone have a suggestion let me know how to restore my desktop bg
| ||
| You are on page 49 of 51, other pages: 1 2 3 46 47 48 [49] 50 51 |
