SpySheriff

DVNT

Hi all

Ok I had something really strange happen to my xp pro the other day. After logging on a new icon popped up in the notification area saying that windows had detected a spyware infection on my computer and that it would download the latest anti-spyware software when I clicked on the bubble. The icon was a red circle with a white X inside.
After clicking on the bubble a program named SpySheriff was downloaded and started running and true enough it found 3 instances of spyware and 1 trojan. Unfortunately the software only provided scanning capabilities and I was required to subscribe to the service before it would allow me to delete the infected files. I ran Norton and found no such infections. After manually deleting the infections and restarting I kept getting the same popup and there was no way to cancel it. I ran spybot and found a process called "wininstall.exe" which I deleted and the popup dissapeared.
My questions are:
1. Does Windows now use 3rd party software (SpySheriff)
2. Was the warning popup legitimate?
3. Has anyone else had this problem?

Thanks
DVNT
Evil or Very Mad

johanfh

I have seen this before. As far as I know it's not from microsoft and it's ordinary spyware. On http://users.pandora.be/marcvn/spyware/1191344.htm you can read more about it.

JohanFH

DVNT

Thanks Johan, I will have to improve my dutch skills though if I want to fully understand that page.
But yeah it seems to be a spyware/trojan scam. Quite well done though.

yjwong

Microsoft's Antispyware was from GIANT. So it does not concern the SpySheriff. (Microsoft Antispyware is now named Windows Defender.)

jaysen

You just fell into a trap my friend.... spysherrif is a rogue spywere program that infected your computer for the simple purpose as to try to get you to buy software that DOES NOT WORK. and you fell for it hook line and sinker.

i found this for you...
Follow these removal steps to remove this software from your computer:

1. Reboot the computer to Safe Mode (Press F8 when Windows start)
2. Delete the following files ( Before doing this make sure you can see hidden files and folders):

C:\Windows\Desktop.html
C:\Winstall.exe
3. Delete the folder 'C:\Program Files\SpySherrif\' and all the contents within it.
4. Click Start > Run, type 'regedit' to open the Registry Editor.
5. Navigate to and delete the following registry subkey (if exist):

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
Exit Registry Editor.
6. Go to Start > Run, type %temp% to open the %temp% folder. Delete all the files with the %temp% folder.
7. Reboot the computer.

DVNT

Hi all
Yeah I removed the spyware and the trojan using spybot which got rid of all the above mentioned files.
And thanks Jaysen for not making me sound like a complete spaz...lol.
Confused

Can't stop an executable from running on startup.....

[Official] Security: Anti-Spyware/Virus, & Firewall

[soft]Gmail: Esto les ha pasado???