Posted on 12/27/2006 7:23:19 PM PST by Graybeard58
When I turn on my comp I get a big display that says "Spy Marshal"
I try to uninstall it and I get a window that tells me I must exit the program before I can uninstall it. There's the problem, there's no way to exit it. The only option is to purchase it.
It covers most of the icons on my screen including the fire fox one I usually use. I went into "my documents" where Netscape is stored and got here with it.
Yes, I'm logged on.
You use Fire Fox?
One of the cookies just found by spy bot was "spy Sherrif" and I had never seen that one before.
When I uninstalled Spy Marshal I did it from the "add or remove programs" The icon is gone from the desk top and I can't find anything related to it in my program files.
You started it, dude. Like, totally.
Yes.
I noted in a later reply that my daughter was here over the holidays and most likely used IE on my comp, for which I will throughly castigate her, the next time I talk to her.
Silence, idiot.
Hit CTL-ALT-DEL and bring up the task manager. Hopefully, you will spot Spy Marshall on the processes tab. If something looks obviously "Spy Marshall-ish" on the list, right-click on the entry and select "end process". If nothing looks obvious, you may have to Google the ones you don't recognize. Once the process is stopped, you should be able to run the uninstaller. Make a note of the process name. If the little bugger reinstalls itself, and yes, they do that sometimes, you may need to find it in the registry. (From the start menu, click "Run..." and then enter "regedit".) From there, you can rip it out by the roots.
(The standard disclaimer about messing with Regedit and turning your machine into a doorstop applies. YMMV. Void where prohibited. Do not use while operating heavy machinery. Discontinue use if a rash develops. May cause constipation.)
Oh, I see. We have misunderstood each other. I apologize as well for the insult, however unintended.
Communicating via text only is proving to be a challenge for me.
I was recently in an exchange in which I was insulted multiple times and then asked about a sock puppet. I never did understand that one.
If the problem comes back in 24-48 hours, let me know, maybe I can help. Below is a sample fix for Spy sherrif at Geeks To Go forum. It can be a rather nasty, stubborn infection:
http://www.geekstogo.com/forum/lofiversion/index.php/t46794.html (the instructions/fix appear more complicated than they actually are).
Done and it worked. Thanks.
Thanks for #29.
It can be removed with virus scanners, Ad-aware, Spybot S&D, HijackThis and Windows Defender and a lot of hunting files and registry entries. I removed one from a network machine once and it took a lot of work. The key was finding the install time and date and looking at what files were changed/added at that time. I had to clean registry entries for every user that had logged on while the program was active.
The good news is that it probably doesn't install any real viruses/trojans that propagate other than itself but wants to make you think you have them so you buy the program. So you will probably be safe saving what you can and doing a re-install of the OS.
To prevent this stuff from being installed in the first place, consider SpywareBlaster (100% free). I've used it for 2-3 years now.
Malware in general attacks Windows because there are weaknesses to attack. It's not a question of popularity; it's a question of quality. MSFT has some serious QC issues.
The only observable option was to buy it, but I got rid of it as noted earlier. Also ran spy bot after uninstalling the program.
Get yourself a good antispyware program like CounterSpy from Sunbelt Software (http://www.sunbeltsoftware.com/CounterSpy-Download.cfm). That should clean that up for you.
I also suggest you upgrade to IE 7 to prevent this sort of thing from happening again.
Next time you reboot, check to see if that process reappears when doing a CTRL + ALT + DELETE. Hopefully it's gone for good.
I saw a few mentions fo this on CNet and a few other blogs. Try searching with one less "l", as in "Spy Marshal"
I just down loaded SpywareBlaster and there's an icon for it on my desk top. Is it active at all times the comp is running?
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.