SpySherriff

[Andrea]

OK, school is just about to start, and my son, on his lap-top, just ran Norton and found SpySherriff. It did not have the usual option of Fix, but only Exclude (bad) and Review (which I don't remember ever seeing before).

I started looking up information and am "thrilled" at the options. There is so much information and disinformation and contradiction in the posts on this malware, that I think it's better to seek advice on removal.

One more thing to mention: since the last Norton scan he checked his e-mail and played RUNESCAPE - so we think we know who the culprit is...

Andrea

[Admin]

Hi Andrea, you have definitely one of the most stickiest Malware problem known to us. SpySherrif is a pain in the behind to remove and a lot more trickier to spot. Good job on spotting it but unfortunately the process for removing it will be painful.

Here is an excellent article on how to do it from Major Geeks

SpySheriff (also known as SpywareNo) Removal

If you are among the hundreds of lucky people who have some how been infected with this malware, try the steps below and let us know the results.

1) Make sure you have run all the Steps this Sticky thread READ & RUN ME FIRST Before Asking for Support

2) Open Control Panel and select Add/Remove programs. Look for SpySheriff and uninstall if found.

3) Download HijackThis 1.99.1 www.majorgeeks.com/download3155.html


- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

If you have problems understanding how to install and run HijackThis, a more detailed procedure is given here: forums.majorgeeks.com/showthread.php?t=74216

4) Now Run HijackThis and select Do a system scan only. Look for the below lines (you may not always find both of them) and select them but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [SNInstall] C:\winstall.exe
O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe

After clicking Fix, exit HJT.

5) Boot into safe mode and use Windows Explorer to delete (if found):
C:\winstall.exe
C:\WINDOWS\Web\wallpaper.html
C:\WINDOWS\Web\desktop.html
C:\Windows\Desktop.html
C:\wp.exe
C:\wp.bmp
C:\Program Files\SpySheriff <--- the whole folder
C:\Documents and Settings\username\Start Menu\Programs\SpySheriff <-whole folder
C:\Documents and Settings\username\Application Data\Install.dat

Note: replace username with the actual user name for the account your are cleaning. Like C:\Documents and Settings\chaslang\Start Menu\Programs\SpySheriff


6) Now run Ccleaner (installed while running the READ & RUN ME FIRST in step 1). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

7) Now reboot in normal mode and continue with the below.

8) Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixadt.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixadt.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.
Quote:
REGEDIT4

[HKEY_CURRENT_USER\Control Panel\Desktop]
"Wallpaper"=-
"WallpaperStyle"=-

[HKEY_CURRENT_USER\Control Panel\Colors]
"Background"="0 78 152"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoChangingWallPaper"=-
"NoComponents"=-
"NoAddingComponents"=-
"NoDeletingComponents"=-
"NoEditingComponents"=-
"NoHTMLWallpaper"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoViewContextMenu"=-
"NoActiveDesktop"=-
"NoActiveDesktopChanges"=-
"ForceActiveDesktopOn"=-
"NoSaveSettings"=dword:00000000
"ClassicShell"=dword:00000000
"NoThemesTab"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispAppearancePage"=-
"Wallpaper"=-
"WallpaperStyle"=-
"NoDispBackgroundPage"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ThemeManager]
"ThemeActive"="1"
"DllName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,72,00,65,00,73,00,6f,00,75,00,72,00,63,00,65,00,73,00,5c,\
00,54,00,68,00,65,00,6d,00,65,00,73,00,5c,00,6c,00,75,00,6e,00,61,00,5c,00,\
6c,00,75,00,6e,00,61,00,2e,00,6d,00,73,00,73,00,74,00,79,00,6c,00,65,00,73,\
00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Desktop\General]
"WallpaperFileTime"=-
"WallpaperLocalFileTime"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoViewContextMenu"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"notepad.exe"=-
"notepad2.exe"=-
"winlogon.exe"=-
"paint.exe"=-

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser Helper Objects\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Browser Helper Objects\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="Search Bar"="http://search.msn.com/intl/searchpane/en-au/prov2.htm"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"
"Use Custom Search URL"= dword:00000000
"Use Search Asst"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}]
[-HKEY_CLASSES_ROOT\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}]
[-HKEY_CLASSES_ROOT\CLSID\{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA}]
[-HKEY_CLASSES_ROOT\CLSID\{357A87ED-3E5D-437d-B334-DEB7EB4982A3}]
[-HKEY_CLASSES_ROOT\CLSID\VMHomepage]
[-HKEY_CLASSES_ROOT\CLSID\VMHomepage.1]
[-HKEY_CLASSES_ROOT\Interface\{1E1B2878-88FF-11D2-8D96-D7ACAC95951F}]
[-HKEY_CLASSES_ROOT\TypeLib\{1E1B286C-88FF-11D2-8D96-D7ACAC95951F}]
[-HKEY_CLASSES_ROOT\VMHomepage]
[-HKEY_CLASSES_ROOT\VMHomepage.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\HTTP\Parameters\S]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\HTTP\Parameters\S]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\r]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Intel system tool"=-
"WindowsFZ"=-
9) Reboot your system and check to see how things are working. If still having problems, create a thread indicating you have followed all the steps in the SpySheriff Removal sticky and post your current HijackThis log as an attachment only.

Let me know if it work or if you dare to do it. Personally if I had gotten it and I have time in my hands like 2 hours or so I will reinstall the operating system as I dont know what else is in there that that particular nasty had brouhgt in.

Let me know what you decide and sorry it took so long to reply to you, work has been hell.

Cheers

Faizul

[Andrea]

I think my son may have been luckier than we thought.

Norton kept finding it, but not giving us the option to remove or quarantine, but only Review and Exclude. Review never appeared to do anything, as SpySheriff was still there after rebooting.

I then thought of actually looking into SpySheriff on Norton, and followed the instructions on their Removal, using Disable System Restore:
www.symantec.com/security_response/writeup.jsp?docid=2005-122910-4625-99&tabid=3

Even though the scan gave us again only the two choices of Review and Exclude, this time around Review lead us to a screen saying that the computer needed to be rebooted for the fix to be complete.

After rebooting, the scan came up clean .

We still went ahead through all steps 1-6 but came up clean every time . Would you still recommend doing the steps that follow. It is that part where things get really convoluted and involved

My son was actually ready to stop checking out after the first clean scan, but I made him go through the rest of the steps, and he is really happy that none of the nasties appear to be there...

Thanks,
Andrea

[Admin]

Hi Andrea, good work on finding that Norton site,

If you have followed the Norton Intructions to the letter and also removed the registry entries that it had suggested in the correct order after you disable system restore then I would presume that you did good.

This shows that there is always more than one way to skin a cat or in this scenario spyware.

But for safety sake do run spybot search and destroy and adware SE just to be certain.

Good Job

Cheers
Faizul