spysheriff removal

[Lisa Simpson]

Anybody got a sure fire way to remove this pest? I've tried hijackthis,
ewido, superantispyware, panda antivirus, xoftspy, avg, & manual deletion
from the registry, and it just keeps coming back

[SJP]

"Lisa Simpson" <none@none.com> wrote in message
news:45926dd1$0$20083$4c368faf@roadrunner.com...
> Anybody got a sure fire way to remove this pest? I've tried hijackthis,
> ewido, superantispyware, panda antivirus, xoftspy, avg, & manual deletion
> from the registry, and it just keeps coming back
>
>
http://siri.geekstogo.com/SmitfraudFix.php

[Lisa Simpson]

Shoulda mentioned, tried smitfraud as well, NFG . . .

"SJP" <someone@somewhere.invalid> wrote in message
news:S_adnfD7y91P8g_YRVnytwA@bt.com...
>
> "Lisa Simpson" <none@none.com> wrote in message
> news:45926dd1$0$20083$4c368faf@roadrunner.com...
> > Anybody got a sure fire way to remove this pest? I've tried hijackthis,
> > ewido, superantispyware, panda antivirus, xoftspy, avg, & manual
deletion
> > from the registry, and it just keeps coming back
> >
> >
> http://siri.geekstogo.com/SmitfraudFix.php
>
>

[Beauregard T. Shagnasty]

Lisa Simpson wrote:

> Anybody got a sure fire way to remove this pest? I've tried
> hijackthis, ewido, superantispyware, panda antivirus, xoftspy, avg, &
> manual deletion from the registry, and it just keeps coming back

Did you find this page in your searching for answers?

http://www.bleepingcomputer.com/forums/topic22402.html

--
-bts
-Motorcycles defy gravity; cars just suck

[Lisa Simpson]

yep, no relief . . .

"Beauregard T. Shagnasty" <a.nony.mous@example.invalid> wrote in message
news:xkukh.586874$QZ1.456740@bgtnsc04-news.ops.worldnet.att.net...
> Lisa Simpson wrote:
>
> > Anybody got a sure fire way to remove this pest? I've tried
> > hijackthis, ewido, superantispyware, panda antivirus, xoftspy, avg, &
> > manual deletion from the registry, and it just keeps coming back
>
> Did you find this page in your searching for answers?
>
> http://www.bleepingcomputer.com/forums/topic22402.html
>
> --
> -bts
> -Motorcycles defy gravity; cars just suck

[Nick Skrepetos]

Lisa Simpson wrote:
> Anybody got a sure fire way to remove this pest? I've tried hijackthis,
> ewido, superantispyware, panda antivirus, xoftspy, avg, & manual deletion
> from the registry, and it just keeps coming back

Submit me a diagnostic using the link below from the infected machine
and I will see why we didn't remove it - I don't know of any variants
we don't currently remove, and if this is one, I will update our
definitions right away.
http://www.superantispyware.com/diag....html?id=nicks

I would also be careful about using any "batch files" that just delete
the files without signature verification and/or quarantining.

Nick Skrepetos
SUPERAntiSpyware.com
http://www.superantispyware.com

[Lisa Simpson]

I would if I could, but I cannot get the offending files to reveal
themselves no matter what I do; all I get to see is the fact that
secure32.html keeps being set as the default IE page. HJT sees it & allows
me to "fix" it, but a rescan immediately after doing so shows it right back.
Doing everything in safe mode as administrator brings brief relief, but as
soon as you reboot it's right back. A real bugger, this. I think I'll just
reformat/reload . . .

"Nick Skrepetos" <nskrepetos@yahoo.com> wrote in message
news:1167240221.916142.284960@i12g2000cwa.googlegr oups.com...
>
> Lisa Simpson wrote:
> > Anybody got a sure fire way to remove this pest? I've tried hijackthis,
> > ewido, superantispyware, panda antivirus, xoftspy, avg, & manual
deletion
> > from the registry, and it just keeps coming back
>
> Submit me a diagnostic using the link below from the infected machine
> and I will see why we didn't remove it - I don't know of any variants
> we don't currently remove, and if this is one, I will update our
> definitions right away.
> http://www.superantispyware.com/diag....html?id=nicks
>
> I would also be careful about using any "batch files" that just delete
> the files without signature verification and/or quarantining.
>
> Nick Skrepetos
> SUPERAntiSpyware.com
> http://www.superantispyware.com
>

[Nick Skrepetos]

Lisa Simpson wrote:
> I would if I could, but I cannot get the offending files to reveal
> themselves no matter what I do; all I get to see is the fact that
> secure32.html keeps being set as the default IE page. HJT sees it & allows
> me to "fix" it, but a rescan immediately after doing so shows it right back.
> Doing everything in safe mode as administrator brings brief relief, but as
> soon as you reboot it's right back. A real bugger, this. I think I'll just
> reformat/reload . . .
>
> "Nick Skrepetos" <nskrepetos@yahoo.com> wrote in message
> news:1167240221.916142.284960@i12g2000cwa.googlegr oups.com...
> >
> > Lisa Simpson wrote:
> > > Anybody got a sure fire way to remove this pest? I've tried hijackthis,
> > > ewido, superantispyware, panda antivirus, xoftspy, avg, & manual
> deletion
> > > from the registry, and it just keeps coming back
> >
> > Submit me a diagnostic using the link below from the infected machine
> > and I will see why we didn't remove it - I don't know of any variants
> > we don't currently remove, and if this is one, I will update our
> > definitions right away.
> > http://www.superantispyware.com/diag....html?id=nicks
> >
> > I would also be careful about using any "batch files" that just delete
> > the files without signature verification and/or quarantining.
> >
> > Nick Skrepetos
> > SUPERAntiSpyware.com
> > http://www.superantispyware.com
> >

Lisa - just run the diagnostic on the infected machine - it will show
all

[Lisa Simpson]

SAS does not even see/show the infection . . .

"Nick Skrepetos" <nskrepetos@yahoo.com> wrote in message
news:1167273411.630905.68450@48g2000cwx.googlegrou ps.com...
>
> Lisa Simpson wrote:
> > I would if I could, but I cannot get the offending files to reveal
> > themselves no matter what I do; all I get to see is the fact that
> > secure32.html keeps being set as the default IE page. HJT sees it &
allows
> > me to "fix" it, but a rescan immediately after doing so shows it right
back.
> > Doing everything in safe mode as administrator brings brief relief, but
as
> > soon as you reboot it's right back. A real bugger, this. I think I'll
just
> > reformat/reload . . .
> >
> > "Nick Skrepetos" <nskrepetos@yahoo.com> wrote in message
> > news:1167240221.916142.284960@i12g2000cwa.googlegr oups.com...
> > >
> > > Lisa Simpson wrote:
> > > > Anybody got a sure fire way to remove this pest? I've tried
hijackthis,
> > > > ewido, superantispyware, panda antivirus, xoftspy, avg, & manual
> > deletion
> > > > from the registry, and it just keeps coming back
> > >
> > > Submit me a diagnostic using the link below from the infected machine
> > > and I will see why we didn't remove it - I don't know of any variants
> > > we don't currently remove, and if this is one, I will update our
> > > definitions right away.
> > > http://www.superantispyware.com/diag....html?id=nicks
> > >
> > > I would also be careful about using any "batch files" that just delete
> > > the files without signature verification and/or quarantining.
> > >
> > > Nick Skrepetos
> > > SUPERAntiSpyware.com
> > > http://www.superantispyware.com
> > >
>
> Lisa - just run the diagnostic on the infected machine - it will show
> all
>

[Nick Skrepetos]

Lisa Simpson wrote:
> SAS does not even see/show the infection . . .
>
> "Nick Skrepetos" <nskrepetos@yahoo.com> wrote in message
> news:1167273411.630905.68450@48g2000cwx.googlegrou ps.com...
> >
> > Lisa Simpson wrote:
> > > I would if I could, but I cannot get the offending files to reveal
> > > themselves no matter what I do; all I get to see is the fact that
> > > secure32.html keeps being set as the default IE page. HJT sees it &
> allows
> > > me to "fix" it, but a rescan immediately after doing so shows it right
> back.
> > > Doing everything in safe mode as administrator brings brief relief, but
> as
> > > soon as you reboot it's right back. A real bugger, this. I think I'll
> just
> > > reformat/reload . . .
> > >
> > > "Nick Skrepetos" <nskrepetos@yahoo.com> wrote in message
> > > news:1167240221.916142.284960@i12g2000cwa.googlegr oups.com...
> > > >
> > > > Lisa Simpson wrote:
> > > > > Anybody got a sure fire way to remove this pest? I've tried
> hijackthis,
> > > > > ewido, superantispyware, panda antivirus, xoftspy, avg, & manual
> > > deletion
> > > > > from the registry, and it just keeps coming back
> > > >
> > > > Submit me a diagnostic using the link below from the infected machine
> > > > and I will see why we didn't remove it - I don't know of any variants
> > > > we don't currently remove, and if this is one, I will update our
> > > > definitions right away.
> > > > http://www.superantispyware.com/diag....html?id=nicks
> > > >
> > > > I would also be careful about using any "batch files" that just delete
> > > > the files without signature verification and/or quarantining.
> > > >
> > > > Nick Skrepetos
> > > > SUPERAntiSpyware.com
> > > > http://www.superantispyware.com
> > > >
> >
> > Lisa - just run the diagnostic on the infected machine - it will show
> > all
> >

Lisa - this is why I want you to run the diagnostic from the INFECTED
machine - I can update our definitions to detect and remove what we
apparently did not catch on your system:

http://www.superantispyware.com/diag....html?id=nicks

The diagnostic let's me "see" what is running and what we missed.......

Nick Skrepetos
SUPERAntiSpyware.com
http://www.superantispyware.com