SpySheriff

Printable View

December 14th, 2005, 11:39 AM
warriorfan808

SpySheriff

My irritating myspace junkie of a sister has been using one of my computers for the last month and ended up installing kazaa. Well, she also picked up SpySheriff and now I'm having trouble removing this thing. So far I went into safemode and ran adaware; SBS&D and AVG. Didn't kill it. Do people on this site help out with Malware? If I download hijackthis or some other program like it, will someone help me get rid of this thing? So far, got rid of the background and all that stuff, but the SpySheriff is still there.
December 14th, 2005, 11:45 AM
The Texan

http://www.spywareinfo.com/~merijn/downloads.html

http://labs.paretologic.com/spyware....ove=SpySheriff

The first link is for HijackThis, the 2nd is how to removed spysheriff.... took me about 10 seconds to find on google. if you have anymore probs let me know.
December 14th, 2005, 11:48 AM
warriorfan808

Thanks, I googled it too and found hijackthis. In fact, I already had it. There were some other sites that people post their logs on and people help them find the exploits. I just figured that people do that here too.
December 14th, 2005, 11:51 AM
The Texan

http://www.delphifaq.com/faq/windows_user/f850.shtml - try this link to remove spysheriff if the link i gave you doesnt work. if you post ur hijack this log i will take a look at it for u
December 14th, 2005, 11:59 AM
warriorfan808

Thanks. I ran it and got rid of the exploits that were told to be bad. Still there though. Man, it's one in the morning here. I'll give that link a crack and see if I can get this thing out before I sleep. Thanks for the help.
December 14th, 2005, 12:12 PM
warriorfan808

Got it. Thanks the link worked. Also, went to this Coyote site that went over all the fields for hijackthis for me.

Here is a copy of what I have now:

Anything else you think I should kill?

Logfile of HijackThis v1.99.1
Scan saved at 12:53:55 AM, on 12/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\RMClient\PMClient.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\Avant Browser\avant.exe
D:\Documents and Settings\liz\My Documents\HiJackThis\hijackthis\HijackThis.exe
D:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AnyDVD] D:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: SmartNetMonitor for Client.lnk = D:\Program Files\RMClient\PMClient.exe
O8 - Extra context menu item: Add to AD Black List - D:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - D:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Highlight - D:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page... - D:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open In New Avant Browser - D:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Search - D:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - D:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{A84AD514-EC6A-414A-911F-5C4F7AD6229E}: NameServer = 192.168.1.1
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
December 14th, 2005, 12:45 PM
s0nIc

hmm well i checked sophos for SpySheriff and it seems it has diff variants.
but sophos gives u a good analysis of the rogue, like which keys it inserted, files, and behaviour of the malware.

http://www.sophos.com/search/search-...rch=spysheriff

check that link out.
December 14th, 2005, 12:48 PM
The Texan

IMO, i would kill: O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll

because those are BHO ( browser hijack objects) and those arent good..... The only toolbar I have is the Google Toolbar so if i were you i would uninstall the msn and yahoo toolbars. The google toolbar is a BHO also but to my knowledge it doesnt do any harm to your system. and you also dont need the Adobe BHO because really how often do you use Adobe? you dont need it to run on your system all the time, just open adobe when you need it and close it when your done. when u get into Hijack This just put a checkmark next to the things i listed then click "Fix this" but, just in case make sure to make a System Restore Point before you do anything. goodluck.
December 14th, 2005, 12:57 PM
s0nIc

hmm no offense but id like to correct a minor missconception here..

BHO stands for Browser Helper Object...

Its just an add-on installed by programs to make u access their features easily via the browzer.. i.e. with Yahoo, u can check ur mail with a click of a button..

but The Texan is correct, if u dont really NEED them, then dont keep them. coz one of em might be exploitable. As far as i remember, there WAS an exploit that uses Google Toolbar.
December 14th, 2005, 01:06 PM
The Texan

ok my bad, thanx for the corrections Sonic.... To Err is human :)
December 14th, 2005, 01:36 PM
dalek

Quote:

SpySheriff spysheriff.com
spy-sheriff.com
spyware-cash.com
antispynow.com aggressive advertising, reported stealth-installs (1, 2); false positives work as goad to purchase; inadequate scan reporting; same app as SpyDemolisher, SpyTrooper, & SpywareNo [A: 6-1-05 / U: 6-1-05]

This is what Spyware Warrior says about spysheriff and other apps, you might want to bookmark this link for future reference before downloading programs that look flashy.

From Lavasoft:

Quote:

Description:
SpywareNo! And SpySheriff claim to be antispyware solutions that offer free trials to the user that will detect content but not remove what is found (they also offer similar three day trial software that claims to remove the content discovered and shows that this was removed) before purchasing. Both applications detect and remove (as described) similar content that does not exist in an attempt to deceive the user into purchasing the software.

TAC (Threat Assessment Chart) Rating: 7.3* *Reported as a TAC of 7 in Ad-Aware

Behavior
- Program masks as doing one thing, but does another 1.8 points

As described, the software claims to be antispyware solutions that will detect and remove content discovered. The content detected is not present on the system and though they claim to uninstall the content detected (in the three day trial version) nothing is actually removed though the software claims that the removal was successful.

Lavasoft

Some more info on Spysheriff:

Sleazy

Ran your log over at Highjack Analyzer

It came back with some questionable content, but nothing overly serious.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
Internet Start Page
This is where you go when you first open IE. Should be something like google.com or iamnotageek.com if theres a site you don't know here clean this line!

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR

These (R1) can be removed/fixed it does give your "02's" a clean bill of health, down to user pref if you want these removed.

Best bet is to submit your log to either AUMHA

Tomcoyote

and have someone have a look at it, and they will be able to determine what you should or shouldn't remove.

Luck ;)
December 14th, 2005, 10:29 PM
Sjdoughboy

my kid go spysheriff that one was a pain in the butt atleast on his computer got into his "hidden" Recycler file. after a few day of farting with it it wa just easer for me to wipe th edrav and start fresh.... all i say is keep a eye on it it might begone..... for me it keep coming back like a bad case of VD's have fun
December 14th, 2005, 10:35 PM
warriorfan808

On the bright side. At least it got me to look at some programs I had installed and get rid of the programs that I don't use anymore. Took a bit of time, but things are looking good now.
December 15th, 2005, 12:12 AM
rapier57

Just a heads up, that DHO for AcroIE-whatever. If you remove that, your Acrobat Reader will no longer open PDF files in your browser. If you already blew that away, you can download the current Acrobat Reader and reinstall.

Some helpers are OK, but you should know which ones are on your system and keep track of them.
December 15th, 2005, 04:24 AM
ShagDevil

I just recently delt with a similar s.o.b. of a malware program known as SpyAxe. I checked everywhere for methods on how to remove it and none of them worked. This malware was even popping up in safe mode(for current user). I eventually removed it by logging on to the PC as a local admin in safe mode (this is a PC on a LAN) and ran ad-aware, ewido, and M$ AS and finally Norton Corp Edition AV. This method worked to remove it.

Quote:

...has been using one of my computers for the last month and ended up installing kazaa...

I just assumed you've got some kind of network. Hopefully your sister is not setup for an admin account? Maybe you can boot into safemode, logon as a local admin and try your scans again?
December 15th, 2005, 06:00 AM
warriorfan808

Quote:

Originally posted here by ShagDevil
I just recently delt with a similar s.o.b. of a malware program known as SpyAxe. I checked everywhere for methods on how to remove it and none of them worked. This malware was even popping up in safe mode(for current user). I eventually removed it by logging on to the PC as a local admin in safe mode (this is a PC on a LAN) and ran ad-aware, ewido, and M$ AS and finally Norton Corp Edition AV. This method worked to remove it.

I just assumed you've got some kind of network. Hopefully your sister is not setup for an admin account? Maybe you can boot into safemode, logon as a local admin and try your scans again?

She isn't anymore. She saw me using ERD command a while back and then got her hands on it. Booted in and set herself a user. I hardly use the computer, so I really didn't know until everything was messed up.