Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Slow Computer And Persisting Virus


  • Please log in to reply
1 reply to this topic

#1 gpstracking2001

gpstracking2001

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:48 PM

Posted 12 January 2007 - 05:57 PM

My computer has been running so slow since I was on a joke site. And every time I open my IE it changes my home page and my Norton Internet Security 2007 says there have been multiple attemps to change my home page. I have already scanned it my computer with Norton,Smith Fraud, Spy subtract and it wont go away. It finds spysheriff and so to speak deletes it. But when I restart my computer its back. Is there anything to completely wipe out this virus. :thumbsup:

BC AdBot (Login to Remove)

 


#2 nigglesnush85

nigglesnush85

  • Members
  • 4,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:08:48 PM

Posted 12 January 2007 - 06:17 PM

Hello,

The link below will tell you how to remove smith fraud,

http://www.spywareremove.com/removeSmith_fraud.html

did some research into getting rid of spysherriff

1. Open task manager by pressing Ctrl-Alt-Del, and click on the "Processes" tab. Look for Spysheriff there and kill the process if you see it. If you see a process named "winstall" (winstall.exe) then delete this one also.
2. In the control panel goto "Add/ Remove Programs" and remove the "SpySheriff" program. If it says that it cannot uninstall, then you still have it running. It will uninstall once it's not running.
3. Your desktop background will not be restored by that uninstall. Go into the registry by starting RegEdit.exe from the start button.
If your registry editor does not work, read this document "I cannot open the registry editor".
4. Look for this key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
It will have about 6 values stored that disable certain things. Delete this whole branch ActiveDesktop - the system will work with default values afterwards.
Also delete this branch in your registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
5. Look in your root directory for a file named winstall.exe. Mine was in c:\ and 24064 Bytes in size.
This file is scheduled to execute each time you boot and it will re-install Spysheriff.
Delete that file.
Update:
As MG from Ottawa comments below, there may also be additional executable files that were created at the same time as winstall.exe. Those files may be named 'winstall.exe' and 'ibm00001.exe'. You should delete those files as well. If you have this file ibm0001.exe please see the other article regarding ibm0001.exe.
6. Restart your system.
Done.
Regards,

Alan.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users