DelphiFAQ Home Search:

Spysheriff blocks my desktop background - how to remove Spysheriff


comments775 comments. Current rating: 5 stars (300 votes). Leave comments and/ or rate it.


This morning I came to my computer and found an application named Spysheriff running. It supposedly had found a dozen of problems on my computer and demanded a purchase in order to remove them.
It also had changed my desktop background image so that it looked like a error message (see the screenshot):

screenshot of spysheriff

It tries to tell me that my computer is in really bad shape and I am in danger unless I pay them..

I tried to remove that desktop background image using the control panel but it is disabled! What can I do?


Spysheriff is malware and should not be used to clean a PC from spyware/ adware/ malware. It's pretty bad e.g. if you try to use System Restore you will find that Spysheriff erased your restore points, so that won't work.
SpySheriff does come with an uninstall program which removes SpySheriff, but it will not undo all the other damage your computer has suffered.

Instead follow these steps:
  1. Open task manager by pressing Ctrl-Alt-Del, and click on the "Processes" tab. Look for Spysheriff there and kill the process if you see it. If you see a process named "winstall" (winstall.exe) then delete this one also.
  2. In the control panel goto "Add/ Remove Programs" and remove the "SpySheriff" program. If it says that it cannot uninstall, then you still have it running. It will uninstall once it's not running.
  3. Your desktop background will not be restored by that uninstall. Go into the registry by starting RegEdit.exe from the start button.
    If your registry editor does not work, read this document "I cannot open the registry editor".
  4. Look for this key:
    It will have about 6 values stored that disable certain things. Delete this whole branch ActiveDesktop - the system will work with default values afterwards.
    Also delete this branch in your registry:
  5. Look in your root directory for a file named winstall.exe. Mine was in c:\ and 24064 Bytes in size.
    This file is scheduled to execute each time you boot and it will re-install Spysheriff.
    Delete that file.
    As MG from Ottawa comments below, there may also be additional executable files that were created at the same time as winstall.exe. Those files may be named 'winstall.exe' and 'ibm00001.exe'. You should delete those files as well. If you have this file ibm0001.exe please see the other article regarding ibm0001.exe.
  6. Restart your system.


Some people asked about the company that makes SpySheriff. This is their London address:

Company:         SpySheriff Development Team
Street address:  Tooley 73a 
City:            London 
Zip:             EC1Y 1BL 
Country:         United Kingdom

Content-type: text/html


You are on page 52 of 52, other pages: 1 2 3 49 50 51 [52]
2010-01-15, 02:13:59
wanwan from Japan  
Fake(rogue) anti-virus like '' secuirty tool '' is coming to Japan and they are starting to destroy our computers now! It is so serious. Be careful ! My boys ! If your computer is Windows XP,be careful !
1) update your Windows OS
2) if you use '' adobe '' ,update those stuff quicker !
Plus see your adobe reader then stop the function '' Java Script ''( you must OFF Java Script).

This fucking rogue anti-virus '' security tool '' tries to hijack your browser then you can not control your browser.
If your PC is hijacked by this rogue anti-virus,you will try to get Windows to boot into safe mode .
You can use this tool ,here
This image was also posted here:
Is this Russian girl scamming me? How to recognize scammers

2012-12-19, 00:03:28
anonymous from China  
<a href=' http://www.wonderfu..>ibeats earphones</a> is characterized by its solid housing,sllyjfdibeats balanced sound quality and purest sound producing. Monster Ibeats have Solid metal housing resists vibrations for purest sound without sonic side effects ControlTalk on-cable mic for convenient hands-free calling with iPhones and smartphones ControlTalk track seeking capabilities without touching your iPod or music phone. This <a href=' http://www.wonderfu..>ibeats earphones</a> unlike ordinary in-ear headphones,ibeats earphones are constructed from solid metal housing.With the <a href=' http://www.hotmusic..'>beats by dre mixr</a>, you can freely enjoy the beautiful music without being disturbed by the outside noise.We supply all kinds of beautiful Monster <a href=' http://www.wonderfu..'>Beats by dre</a>, such as ibeats earphones,<a href=' http://www.wonderfu..l'>solo hd bluetooth</a>,<a href=' http://www.hotmusic..'>beats studio headphones</a> and <a href=' http://www.hotmusic..>purple beats by dre</a>
2015-02-01, 01:34:31
Superbly ilitainmulng data here, thanks!
2015-02-01, 05:38:09
anonymous from Woodbridge, United States  
Thanks for sttnriag the ball rolling with this insight.
2015-02-01, 05:38:09
anonymous from Woodbridge, United States  
Thanks for sttnriag the ball rolling with this insight.
2015-02-01, 09:08:12
A little rationality lifts the quality of the debate here. Thanks for cogitrbutinn!
2015-05-11, 18:39:33 from Indonesia  
Kami sekelurga mengucapkan banyak trimah kasih kpada AKI NUGROHO atas bantuanya no 4d (3167) benar2 tembus 100% bila mau bukti hubungi AKI NUGROHO di nmr ini ;0823=1920=8865; Trma ksh.Jika anda mau megubah nasip anda lebih baek di bandin saat ini,silahkan minta ANGKA Ritual AKI NUGROHO,Pake sayarat-sayarat,untuk dapat Angka Jitunya,lakukan aja persaratnya Hilankan keraguan anda sama AKI,ya saya yakin anda tidak bakalan menyesal,Bergabun degan beliyuo,banyak'ya Dukun Aku Tlpn anya omong kosong aja,tapi AKI NUGROHO Hasil Ritual Angkaya benar-benar,Top 100%Insya ALLAH Anda Pasti Mengubah Nasib Dalam Waktu Sekejab Tepat & Terbukti !!! ,
This image was also posted here:
DelphiFAQ Site wide search function
DelphiFAQ Site wide search function
DelphiFAQ Site wide search function
DelphiFAQ Site wide search function

2015-05-11, 19:50:35
anonymous from Blora, Indonesia  
kami sekeluarga tak lupa mengucapkan puji syukur kepada ALLAH S,W,T
dan terima kasih banyak kepada AKI atas nomor togel.nya yang AKI
berikan 4 angkah 3167 alhamdulillah ternyata itu benar2 tembus AKI.
dan alhamdulillah sekarang saya bisa melunasi semua utan2 saya yang
ada sama tetangga.dan juga BANK BRI dan bukan hanya itu AKI. insya
allah saya akan coba untuk membuka usaha sendiri demi mencukupi
kebutuhan keluarga saya sehari-hari itu semua berkat bantuan AKI..
sekali lagi makasih banyak ya AKI… bagi saudara yang suka main togel
yang ingin merubah nasib seperti saya silahkan hubungi AKI NUGROHO,,di
0823 1920 8865,, insya allah anda bisa seperti saya…menang togel 175
juta, wassalam.

dijamin 100% jebol saya sudah buktikan...sendiri....

Apakah anda termasuk dalam kategori di bawah ini !!!!

1'Dikejar-kejar hutang

2'Selaluh kalah dalam bermain togel

3'Barang berharga anda udah habis terjual Buat judi togel

4'Anda udah kemana-mana tapi tidak menghasilkan solusi yg tepat

5'Udah banyak Dukun togel yang kamu tempati minta angka jitunya
tapi tidak ada satupun yang berhasil..

Solusi yang tepat jangan anda putus aza....AKI NUGROHO akan membantu
anda semua dengan Angka ritwal/GHOIB:
butuh angka togel 2D3D4D SGP / HKG / MALAYSIA / TOTO MAGNUM / dijamin
100% jebol
Apabila ada waktu
silahkan Hub: AKI NUGROHO DI NO: (((082319208865)))

angka GHOIB: singapur 2D/3D/4D/

angka GHOIB: hongkong 2D/3D/4D/

angka GHOIB; malaysia

angka GHOIB; toto magnum 4D/5D/6D/

angka GHOIB; laos


2017-05-14, 06:29:47
Jill from Taipei, Taiwan  
Inspiring story there. What happened after? Thanks!
2017-07-22, 14:46:58
anonymous from Indonesia  
Ass,,,Saya Ibu Fatimah Di Singapore - Saya Mengutarakan Kalau Saya Menang Togel Lagi,Itu Atas Bantuan NYAI RONGGENG Terimah Kasih Banyak Yaa NYAI YAng Telah Memberikan Angka Jitu Nya Kepada Saya Yaitu 6053 Dan Alhamdulillah Berhasil,Berkat Bantuan NYAI Saya Sudah Bisa Membahagiakan Kedua Orang Tua Saya,Bahkan Semua Hutang-Hutang Saya Bersama Hutan Kedua Orang Tua Saya Semuanya Pada Lunas Dan Bahkan Saya Juga Sudah Bisa Membuka Usaha Kecil-Kecilan,Bagi Anda Yg Ingin Seperti Saya Silahkan Hub Nomor NYAI RONGGENG Di : 0821 8948 1547,,Karena Cuma Angka Ghoib NYAI RONGGENG Saja Yg Memberikan Bukti YAng Lain Maa Cuma Menghabiskan Uang Saja,Nomor Ritual NYAI RONGGENG Memang Selalu Tepat Dan TerBukti.;';';';';';'
You are on page 52 of 52, other pages: 1 2 3 49 50 51 [52]



NEW: Optional: Register   Login
Email address (not necessary):

Rate as
Hide my email when showing my comment.
Please notify me once a day about new comments on this topic.
Please provide a valid email address if you select this option, or post under a registered account.

Show city and country
Show country only
Hide my location
You can mark text as 'quoted' by putting [quote] .. [/quote] around it.
Please type in the code:

Please do not post inappropriate pictures. Inappropriate pictures include pictures of minors and nudity.
The owner of this web site reserves the right to delete such material.

photo Add a picture: