[MetalHeadConservative35]

im going to kill the little 14-year old mama's boy for a hacker that came up with this, little punks arelucky i cant find em, if i could, id spend my leisure time pummeling them

[MetalHeadConservative35]

BTTT

[Smokin' Joe]

I can't help, but I can bump the thread for you! Good luck, FRiend.

[Terpfen]

If you did a complete reformat and Windows reinstall, but the thing still popped up, it sounds like another computer on your network is infected, and is in turn infecting you.

[decal]

After using the regular antispyware programs like Ad-Aware and Spybot, you might want to install SpywareBlaster; I haven't seen RedSherif or AdSherif since.

[de Buillion]

I would go buy the biggest and best Norton Suite from Symantec that's available. They were the best, once upon a time, good luck, and I don't guarantee anything!

[conservative in nyc]

McAfee on Adsheriff:

Distribution

This is not a virus or a trojan. It is detected as a "potentially unwanted program." This is an anti-spyware application claiming to remove unwanted malicious spyware programs but requires paid registration before any issues found can be fixed or any many other features enabled (on access protections, etc.) It creates a shortcut in the Start Menu Startup folder to ensure it is launched and performs a scan at each system startup. In order to clean or delete any elements identified as threats, the software requires you purchase the full version. If any elements are identified during a scan, an "always on top" warning window appears which cannot be dismissed without pressing the "Register" button, which opens a new browser window to the purchase page for the software. Additionally, neither AdwareSheriff buttons on the task bar (for the main application or the alert window) may be closed via right-click -> Close in the context menu (the menu simply doesn't appear).

More at the link:
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=138377

[cabojoe]

http://vil.nai.com/vil/content/v_138377.htm I would look under system changes on this page and delete the files listed, and delete the registry keys listed under registry and reboot. I can't see how it could survive a reformat though. Good luck.

[Havoc]

Have you tried replacing your MBR? Reformatting the drive will not necessarily force replacement of the MBR. And if this thing has tied itself to the master boot record, it must be replaced or you will continue to have problems no matter how many times you reformat.

Here's something that might help:
http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prkd_tro_ldau.asp

[Texas_Jarhead]

Yea, adsherriff.... I've had to deal with that one. I was able to clean it once using MS anti-spyware, Trend Micro A/V software, and manually editing registry. Try those and see what happens. I wish you luck.

[bad company]

http://www.pandasoftware.com/products/activescan.htm


Try that scan. If that doesn't work try the instructions below.


http://vil.nai.com/vil/content/v_138377.htm#RemovalInstructions

[Eddie01]

Pummel BTTT.

FWIW: I use Norton System Works with live update, it is indestructable and has alerted me to full blown attacks, not just spyware adware stuff.

[DB]

Do you have more than one hard drive in your computer?

If not, then either something you're loading contains the virus or you have a hole in your router's firewall allowing someone from the outside to infect you. I'd recommend disconnecting the computer from the Internet and trying again. After you have it securely configured then connect it back.

[Ichneumon]

There have been several good responses on this thread (including the warning that the Master Boot Record on your drive might be infected, which would cause re-infection upon reboot even after you had formatted the primary partition).

But I'd like to address another angle: Are you sure you actually have the malware in question, or might you just be getting a false positive from your virus scanner? What are your "symptoms", if any, aside from the virus scanner raising a flag?

[kenth]

Ad sheriff is terrible. It's basically extortion. It highjacks your pc and holds it hostage, all under the guise of getting rid of ad ware. It even puts this ridiculous banner on your desktop, then alters your desktop security profile so that you can't change it readily.