No, I did not do hijackthis in safe mode becausehttp://www.bleepingcomputer.com/forums/t/22402/how-to-remove-spysheriff-winstallexe-spysheriffexe/
Step 8 says to reboot back to normal mode after the ewido scan completes. It then goes on in step 13 to say:
# Make sure you are disconnected from the Internet and that all programs and windows are closed. Run HijackThis and press the Scan button. Place a check next to the following items, if found, and click FIX CHECKED:
O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Program Files\Daily Weather Forecast\weather.exe
# Close HiJackThis.
I was disconnected from the internet and had no programs opened when I ran hijackthis. However, I was probably connected to the internet when I tried to delete Daily Weather Forecast, so maybe that's why it wouldn't delete. My hijackthis log showed daily weather forecast and I fixed it. I'll check the hijackthis log in a couple of days and see how it goes.