Spy Sheriff got me - how do I recover the background?

[Guest]

Someone got to a site and Spy Sheriff nailed their login. Now the stupid
Infection background is on all the time for that login. How do I recover from
this malicious stuff? The Display Properties dialog > Desktop is disabled for
that user. They can no longer select a different background. How do I enable
it again?

IMHO, these people (responsible for spy sheriff and the like) should occupy
a jail cell for awhile for this sort of behavior.

 

[Guest]

Hello liamb,

How to remove the Spysheriff
http://www.bleepingcomputer.com/for...Sheriff_Winstallexe_Spysheriffexe-t22402.html

Subject: Spy Sheriff
From: "PG"
Sent: 9/8/2005 12:39:45 PM
GENERAL

Follow this thread: Smitrem and Ewido remºval.

http://forums.techguy.org/printthread.php?t=376692

Also use CCleaner for junk removal www.ccleaner.com

Best luck and let us know if it wºrks.

Engel

 

[Lews]

If you have SpyAxe, PSGuard, Smitfraud, Spy Sheriff, Sinnaka Advertisments
or detections for Puper or Alemod that can not seem to be removed
automatically, please try this automated removal tool.

AntiPuper v1.1 by secured2k
http://secured2k.home.comcast.net/tools/AntiPuper.exe

What does this tool do?
This tool will attempt to delete several known Trojan files. These files are
modified by the malware authors and encrypted to avoid detection.
Fortunately, many of these tend to use the exact same file names. If the
files are in use, locked, protected, etc, this program will schedule Windows
to remove the files upon restarting.

This program will also remove some common security policies that are changed
by viruses and worms. Policies that lock out your desktop changes, windows
update, Windows Firewall, Explorer Run policies, Registry editing, and more
are all reset.

Finally, if you have an infected Alemod WININET.DLL file, this program will
try to copy a clean version from your Windows File Protection folder and
replace the bad copy on restart. If a backup copy can not be found, the tool
will quickly look for McAfee Antivirus files and attempt to clean a copy of
the file to replace the bad one on reboot. If all of this fails, you will
need to manually replace/clean your WININET.DLL file.

This tool unlocks the ability to change or disable the desktop background
image or active web desktop background. You will need to manually change
your desktop background.

Go to Control Panel > Display > Desktop Tab > Customize Desktop > Web Tab.
If you see any entries that are checked, uncheck them. Click OK.