Computer Help: Adsheriff won't go away,

http://www.freerepublic.com ^ | 2/13/2006 | The Detroit Metalhead

[MetalHeadConservative35]

annoying spyware/virus called adsheriff won't go away

Ive tried using AVG,AVAST,Adaware,Xoftspy, and my adminstrator account in safe mode, none work

ive even installed windows formatting my harddrive and it showed up first time i logged on after installing.

[MetalHeadConservative35]

im going to kill the little 14-year old mama's boy for a hacker that came up with this, little punks arelucky i cant find em, if i could, id spend my leisure time pummeling them

[MetalHeadConservative35]

BTTT

[Smokin' Joe]

I can't help, but I can bump the thread for you! Good luck, FRiend.

[Terpfen]

If you did a complete reformat and Windows reinstall, but the thing still popped up, it sounds like another computer on your network is infected, and is in turn infecting you.

[MetalHeadConservative35]

im not networked to anybody, i get my connection from a router but its not networked to me.

[decal]

After using the regular antispyware programs like Ad-Aware and Spybot, you might want to install SpywareBlaster; I haven't seen RedSherif or AdSherif since.

[A Balrog of Morgoth]

Hmmm, too bad you reformatted. Rolling back with system restore(?) might have done the trick for you.

[de Buillion]

I would go buy the biggest and best Norton Suite from Symantec that's available. They were the best, once upon a time, good luck, and I don't guarantee anything!

[conservative in nyc]

McAfee on Adsheriff:

Distribution

This is not a virus or a trojan. It is detected as a "potentially unwanted program." This is an anti-spyware application claiming to remove unwanted malicious spyware programs but requires paid registration before any issues found can be fixed or any many other features enabled (on access protections, etc.) It creates a shortcut in the Start Menu Startup folder to ensure it is launched and performs a scan at each system startup. In order to clean or delete any elements identified as threats, the software requires you purchase the full version. If any elements are identified during a scan, an "always on top" warning window appears which cannot be dismissed without pressing the "Register" button, which opens a new browser window to the purchase page for the software. Additionally, neither AdwareSheriff buttons on the task bar (for the main application or the alert window) may be closed via right-click -> Close in the context menu (the menu simply doesn't appear).

More at the link:
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=138377

[A CA Guy]

If you reformatted and reinstalled from another drive in the same computer, then the backup drive is corrupt and you need to either use a cd to install a new operating system after full format or Fix for adware.

People will try and sell you a fix, but if it is spyware and you are already infected, then you could go to their home site.

I think by some laws in some countries they have to offer the removal tool for the spyware on their site.

You can also look at task manager and google all processes running till you find which one is the problem. Then follow that process back to where it is and google those files in search of the fix.

[cabojoe]

http://vil.nai.com/vil/content/v_138377.htm I would look under system changes on this page and delete the files listed, and delete the registry keys listed under registry and reboot. I can't see how it could survive a reformat though. Good luck.

[A CA Guy]

There is supposed to be a free removal file on their home site if they are under the law to do so.

I have removed three different types for people this way.

[Havoc]

Have you tried replacing your MBR? Reformatting the drive will not necessarily force replacement of the MBR. And if this thing has tied itself to the master boot record, it must be replaced or you will continue to have problems no matter how many times you reformat.

Here's something that might help:
http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prkd_tro_ldau.asp

[MetalHeadConservative35]

i installed spyware blaster but it wont let me scan?

[Texas_Jarhead]

Yea, adsherriff.... I've had to deal with that one. I was able to clean it once using MS anti-spyware, Trend Micro A/V software, and manually editing registry. Try those and see what happens. I wish you luck.

[Terpfen]

You're replying to the wrong guy.

[A CA Guy]

Whoops, I hope the right guy is reading the whole thread.

Sorry about the misdirected post.

[Paul C. Jesup]

Okay, the key here is that you need to make sure that the spyware is not actively running while you are scanning.

To do this, go into Windows Task Manager in the "Processes" tab, and find out which .exe running is Adsheriff and end that .exe (becareful when doing this, if you shutdown the wrong .exe you can crash windows.

I suggest using www.liutilities.com to search which .exe needs to be shutdown.

Once you have done this, run the anti-spyware programs and it should delete the program completely.

[bad company]

http://www.pandasoftware.com/products/activescan.htm


Try that scan. If that doesn't work try the instructions below.


http://vil.nai.com/vil/content/v_138377.htm#RemovalInstructions

[The Red Zone]

Spyware that spies on spyware: meta-spyware