spysheriff removal

[Lisa Simpson]

Anybody got a sure fire way to remove this pest? I've tried hijackthis,
ewido, superantispyware, panda antivirus, xoftspy, avg, & manual deletion
from the registry, and it just keeps coming back

[SJP]

"Lisa Simpson" <none@none.com> wrote in message
news:45926dd1$0$20083$4c368faf@roadrunner.com...
> Anybody got a sure fire way to remove this pest? I've tried hijackthis,
> ewido, superantispyware, panda antivirus, xoftspy, avg, & manual deletion
> from the registry, and it just keeps coming back
>
>
http://siri.geekstogo.com/SmitfraudFix.php

[Beauregard T. Shagnasty]

Lisa Simpson wrote:

> Anybody got a sure fire way to remove this pest? I've tried
> hijackthis, ewido, superantispyware, panda antivirus, xoftspy, avg, &
> manual deletion from the registry, and it just keeps coming back

Did you find this page in your searching for answers?

http://www.bleepingcomputer.com/forums/topic22402.html

--
-bts
-Motorcycles defy gravity; cars just suck

[Lisa Simpson]

Shoulda mentioned, tried smitfraud as well, NFG . . .

"SJP" <someone@somewhere.invalid> wrote in message
news:S_adnfD7y91P8g_YRVnytwA@bt.com...
>
> "Lisa Simpson" <none@none.com> wrote in message
> news:45926dd1$0$20083$4c368faf@roadrunner.com...
> > Anybody got a sure fire way to remove this pest? I've tried hijackthis,
> > ewido, superantispyware, panda antivirus, xoftspy, avg, & manual
deletion
> > from the registry, and it just keeps coming back
> >
> >
> http://siri.geekstogo.com/SmitfraudFix.php
>
>

[Lisa Simpson]

yep, no relief . . .

"Beauregard T. Shagnasty" <a.nony.mous@example.invalid> wrote in message
news:xkukh.586874$QZ1.456740@bgtnsc04-news.ops.worldnet.att.net...
> Lisa Simpson wrote:
>
> > Anybody got a sure fire way to remove this pest? I've tried
> > hijackthis, ewido, superantispyware, panda antivirus, xoftspy, avg, &
> > manual deletion from the registry, and it just keeps coming back
>
> Did you find this page in your searching for answers?
>
> http://www.bleepingcomputer.com/forums/topic22402.html
>
> --
> -bts
> -Motorcycles defy gravity; cars just suck

[Nick Skrepetos]

Lisa Simpson wrote:
> Anybody got a sure fire way to remove this pest? I've tried hijackthis,
> ewido, superantispyware, panda antivirus, xoftspy, avg, & manual deletion
> from the registry, and it just keeps coming back

Submit me a diagnostic using the link below from the infected machine
and I will see why we didn't remove it - I don't know of any variants
we don't currently remove, and if this is one, I will update our
definitions right away.
http://www.superantispyware.com/diag....html?id=nicks

I would also be careful about using any "batch files" that just delete
the files without signature verification and/or quarantining.

Nick Skrepetos
SUPERAntiSpyware.com
http://www.superantispyware.com

[Nick Skrepetos]

pcbutts1 wrote:
> Use Spyerase, it's fast and free. It now has over 1500 signatures to remove
> all
> variants of Virusburst, Spy sheriff and others. This tool is designed to
> specifically
> remove all variants. Scan time is about 2 minutes. Designed for Windows
> 2000/XP only.
> First read this page http://www.pcbutts1.com/downloads then download
> spyerase from here http://www.pcbutts1.com/downloads/spyerasesetup.zip
>
>
> Let me know how it works. Send feedback here
> http://pcbutts1-therealtruth.blogspot.com/
>
>
> --
>
> Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
> The list grows. Leythos the stalker,David H. Lipman, Max M Wachtell III aka
> What's in a Name?,Fitz,Rhonda Lea Kirk,Meat Plow, F Kwatu F, George Orwell
>
>
>
> "Lisa Simpson" <none@none.com> wrote in message
> news:45926dd1$0$20083$4c368faf@roadrunner.com...
> > Anybody got a sure fire way to remove this pest? I've tried hijackthis,
> > ewido, superantispyware, panda antivirus, xoftspy, avg, & manual deletion
> > from the registry, and it just keeps coming back
> >
> >

Does SpyErase quarantine the files to allow them to be restored should
it accidentally delete the wrong files?

-Nick

[pcbutts1]

Spyerase does not delete the wrong files. There are no false positives. The
files that are removed by Spyerase are known bad files which are 100%
verified before being added to the database. Any new variants That I
discover or are sent to me are also checked and verified. Don't start with
me Nick if you find a file in my database that is removed by Spyerase that
you feel is wrong then post it here and I will prove that it is a bad file.
Put up or shut up Nick and stop trying to invent flaws in my program, there
are none.

--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker,David H. Lipman, Max M Wachtell III aka
What's in a Name?,Fitz,Rhonda Lea Kirk,Meat Plow, F Kwatu F, George Orwell



"Nick Skrepetos" <nskrepetos@yahoo.com> wrote in message
news:1167240911.647296.240310@79g2000cws.googlegro ups.com...
>
> pcbutts1 wrote:
>> Use Spyerase, it's fast and free. It now has over 1500 signatures to
>> remove
>> all
>> variants of Virusburst, Spy sheriff and others. This tool is designed to
>> specifically
>> remove all variants. Scan time is about 2 minutes. Designed for Windows
>> 2000/XP only.
>> First read this page http://www.pcbutts1.com/downloads then download
>> spyerase from here http://www.pcbutts1.com/downloads/spyerasesetup.zip
>>
>>
>> Let me know how it works. Send feedback here
>> http://pcbutts1-therealtruth.blogspot.com/
>>
>>
>> --
>>
>> Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
>> The list grows. Leythos the stalker,David H. Lipman, Max M Wachtell III
>> aka
>> What's in a Name?,Fitz,Rhonda Lea Kirk,Meat Plow, F Kwatu F, George
>> Orwell
>>
>>
>>
>> "Lisa Simpson" <none@none.com> wrote in message
>> news:45926dd1$0$20083$4c368faf@roadrunner.com...
>> > Anybody got a sure fire way to remove this pest? I've tried
>> > hijackthis,
>> > ewido, superantispyware, panda antivirus, xoftspy, avg, & manual
>> > deletion
>> > from the registry, and it just keeps coming back
>> >
>> >
>
> Does SpyErase quarantine the files to allow them to be restored should
> it accidentally delete the wrong files?
>
> -Nick
>

[Default User]

On 27 Dec 2006 09:35:11 -0800, "Nick Skrepetos" <nskrepetos@yahoo.com>
wrote:

>Does SpyErase quarantine the files to allow them to be restored should
>it accidentally delete the wrong files?
>
>-Nick

Of course not. It doesn't even check the file to see whether or not it's
malicious; it simply deletes files that match the names of suspected
malware. A very dangerous way to clean a machine IMHO, and knowing butts
he doesn't have a clue how it works because he didn't write it.

[Default User]

On Wed, 27 Dec 2006 13:54:41 -0500, Default User <default@user1.invalid>
wrote:

>On 27 Dec 2006 09:35:11 -0800, "Nick Skrepetos" <nskrepetos@yahoo.com>
>wrote:
>
>>Does SpyErase quarantine the files to allow them to be restored should
>>it accidentally delete the wrong files?
>>
>>-Nick
>
>Of course not. It doesn't even check the file to see whether or not it's
>malicious; it simply deletes files that match the names of suspected
>malware. A very dangerous way to clean a machine IMHO, and knowing butts
>he doesn't have a clue how it works because he didn't write it.

Nick,

Here is a snippet from "spyerase" that should demonstrate the method used.

"IF EXIST "%SystemDrive%\124842.exe" echo "%SystemDrive%\124842.exe"
IF EXIST "%SystemDrive%\124842.exe" echo
"%SystemDrive%\124842.exe">>spyerase.txt
IF NOT EXIST "%SystemDrive%\124842.exe" GOTO S1
attrib -h -r -s "%SystemDrive%\124842.exe"
DEL /F /Q "%SystemDrive%\124842.exe"
IF NOT EXIST "%SystemDrive%\124842.exe" echo successfully deleted
124842.exe
IF NOT EXIST "%SystemDrive%\124842.exe" echo successfully deleted
124842.exe>>spyerase.txt
IF NOT EXIST "%SystemDrive%\124842.exe" GOTO S1
Tskill /a "%SystemDrive%\124842.exe"
DEL /F /Q "%SystemDrive%\124842.exe"
IF NOT EXIST "%SystemDrive%\124842.exe" echo successfully deleted
124842.exe
IF NOT EXIST "%SystemDrive%\124842.exe" echo successfully deleted
124842.exe>>spyerase.txt
IF NOT EXIST "%SystemDrive%\124842.exe" GOTO S1
IF EXIST "%SystemDrive%\124842.exe" echo unable to delete 124842.exe -
will delete on reboot
IF EXIST "%SystemDrive%\124842.exe" echo unable to delete 124842.exe -
will delete on reboot>>spyerase.txt
echo DEL /F /Q "%SystemDrive%\124842.exe">>%SystemDrive%\delrb.tx t"

This is repeated over and over with a differnet file name inserted for each
test.