• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Spyware

R

RealMentalCase

Limp Gawd
Joined
Nov 7, 2004
Messages
281
I just got hit with something called Spy Sheriff :eek: and it locked up my PC !!!

it got passed all my spy and Antivirus software !

How the HELL did it do that :confused:

Has anyone one heard of it

I deleted it and ran all my spy / Antivirus software and it didn't find anything
and YES it's all up to date !!!

Do you know if it's still hiding in my PC ? HELP !!!! :(
 
My best friend's comp did that yesterday. Can't figure out how to wipe it out myself either. AdAware purportedly has detection rules for that piece of shit. But it won't find it, nor will Spybot. If anyone else has had to remove this let me know.
 
try the microsoft one..

it's clunky, slow and did i mention slow?

but it seems to me to be the best spyware program out there
 
Ad-aware and spybot are always the first two programs that I try. If those fail me, the Microsoft Antispyware is good and webroot offers spysweeper trials.
 
I did a system restore and its working again but i know its floating around in there some where !!!

This is FUCK UP !!!!! :mad:

I found out that Spy sheriff is a ANTI spyware program that hijacks your PC and changes alot of your settings and tells you that you have a SHIT load of problems that you don't have !!!

The best part is it won't let you fix any of the problems in less you
BUY spy sheriff !!!!!!!!!!!!!!!

I would love to know where these guys are that make spy sheriff are because i think
cabela's is having a sale on scopes !!! :D
 
Boot to safe mode, disable system restore and run hijackthis ??

Hope that helps

0ldMX
 
http://www.geekstogo.com/forum/index.php?act=ST&f=37&t=35376 ??
or
http://translate.google.com/transla...firefox&rls=org.mozilla:en-US:unofficial&sa=G

1, computer in the secured mode raised (safe mode?)
2, regedit and entries deleted
- hkey_local_machine\software\spysheriff
- hkey_local_machine\software\microsoft\cu rrentversion\run (or runonce)
dns and winstall (dns winstall.exe can be also from nem other virus and
for it responsible the thing is installed again and again)
3, draw-eat on c:\program files\spysheriff delete
4, c:\winstall.exe delete



might do it
its might even have been installed with a BitTorrent distro
http://www.spywareinfo.com/articles/p2p/
http://www.vitalsecurity.org/2005/06/aurora-install-source-revealed-and-175.html

since I saw Aurora mentioned in conjuncture a few times (might be coincidence)
 
I think my friend got it on his comp from running a version of LimeWire laced with the program. He only installed it on his user account on the machine and neither myself nor another friend who also has an account have had a problem with it.
 
After i did a restore everything was good but guess what came back !!!

Now i'm really SCREWED !!! :mad:

My PC kept locking up and icons changing and i lost any restore points i had !!!

I said the HELL with this so i tried to do a repair and i can't even do that
because theres no repair option anymore !!! :eek:

HELP ME !!! :(

I can't format because i have alot of important stuff on the drive !!! :(
 
have you installed anything in the last few days? Try and think of what it could have came with, do you use Firefox or IE? If you have another computer or a cd/dvd burner i would back everything up and format as this thing is gonna leave parts of itself scattered all over your computer. :(
 
LOL

restore points :p

you lost nothing you typically turn them off and ditch them anyway

1. backup your data to media, you should already have adequate backup
you can test it for infections after you have a secured system

2. install processguard if it will let you
(freeware version) more or less a firewall for the kernal

install it, reboot, rightclick on the taskbar icon (or desktop icon) > Main Tab uncheck learning mode > security tab remove all > protection tab remove all > close reboot and start approving processes your sure of

here are the W2K\XP Default Processes
add in your browser and research the rest as they are requested
(you make a rule for each process, if you dont check the box your either allowing or denying that process only once, just like a rule based firewall)

3. Disable all script execution (in case its employing it somehow) while there are many aps that will do thus, Id recommend doig it at the file assobiation level

disable the execution of ALL such files is from within Windows Explorer. Right-click on a .vbs file (of Type “VBScript Script File”) and select Open With. Instead of being executed by the “Microsoft Windows Based Script Host” program, Choose Program... and select a program that cannot execute files, such as “Notepad” or “Wordpad”. This will cause the script file to be opened for editing.

This action changes the Open registry key under HKEY_CLASSES_ROOT\ VBSFile\ Shell to

%SystemRoot%\System32\Notepad.exe %1 rather than
%SystemRoot%\System32\CScript.exe "%1" %*

With this change, if you need to execute a VBScript, in MS Windows Explorer, right click on the file it and select Execute VBScript.

Repeat the above actions for two other extensions:

.js (in Reg. key HKCR\JSFile)
.wsh (in Reg. key HKCR\WSHFile)

4. the objective here is to disript the reinfection process in an effort to locate and disinfect the components responsible for reinfection
install some heavy hitting trialware, see > http://hardforum.com/showthread.php?t=768776


the registry keys in the post above where deleted?
and are now back agaon?
 
Ice Czar said:
LOL

restore points :p

you lost nothing you typically turn them off and ditch them anyway

1. backup your data to media, you should already have adequate backup
you can test it for infections after you have a secured system

2. install processguard if it will let you
(freeware version) more or less a firewall for the kernal

install it, reboot, rightclick on the taskbar icon (or desktop icon) > Main Tab uncheck learning mode > security tab remove all > protection tab remove all > close reboot and start approving processes your sure of

here are the W2K\XP Default Processes
add in your browser and research the rest as they are requested
(you make a rule for each process, if you dont check the box your either allowing or denying that process only once, just like a rule based firewall)

3. Disable all script execution (in case its employing it somehow) while there are many aps that will do thus, Id recommend doig it at the file assobiation level

disable the execution of ALL such files is from within Windows Explorer. Right-click on a .vbs file (of Type “VBScript Script File”) and select Open With. Instead of being executed by the “Microsoft Windows Based Script Host” program, Choose Program... and select a program that cannot execute files, such as “Notepad” or “Wordpad”. This will cause the script file to be opened for editing.

This action changes the Open registry key under HKEY_CLASSES_ROOT\ VBSFile\ Shell to

%SystemRoot%\System32\Notepad.exe %1 rather than
%SystemRoot%\System32\CScript.exe "%1" %*

With this change, if you need to execute a VBScript, in MS Windows Explorer, right click on the file it and select Execute VBScript.

Repeat the above actions for two other extensions:

.js (in Reg. key HKCR\JSFile)
.wsh (in Reg. key HKCR\WSHFile)

4. the objective here is to disript the reinfection process in an effort to locate and disinfect the components responsible for reinfection
install some heavy hitting trialware, see > http://hardforum.com/showthread.php?t=768776


the registry keys in the post above where deleted?
and are now back agaon?
Click to expand...


Thanks for all that info but i feel bad now that you wrote all that because i can't even get into the drive anymore to install or change anything !!! :(
 
RealMentalCase said:
Thanks for all that info but i feel bad now that you wrote all that because i can't even get into the drive anymore to install or change anything !!! :(
Click to expand...

what exactly does that mean?
are you able to login to the OS? the BIOS? where exactly is the hang.
you may have borked that OS entirely especially if the old restore point contained older drivers or simply erased the drives with the attempted repair
in which case try to simplfy the physical config removing components whose drivers (or lack thereof) might be hanging

do you have a 2nd HDD?
a parallel OS install and sebsequent rescue if your data would be the best solution at this point
possibly the only one that will rescue the data dependant on what you mean by unable to access the OS
 
You must log in or register to reply here.
Back
Top