Manual removal instructions for SpySheriff

The following instructions have been created to help you to get rid of "SpySheriff" manually.
If this guide was helpful to you, please consider donating towards this site.

Categories:

• malware

Description:

This malware pretends to be a valid antispyware solution. But it only exaggerates the results, and also shows intentional false positives to make the user pay for the full version, which is heavily advertised by the Smitfraud-C. malware. Usually a trial version of SpySheriff gets installed without user consent along with other malware like Smitfraud-C.

Supposed Functionality:

Supposed to be an antispyware software

Desktop:

Please remove the following files from your desktop.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.

• Shortcuts named "SpySheriff.lnk" and pointing to "C:\Program Files\SpySheriff\SpySheriff.exe".
• Shortcuts named "SpySheriff.lnk" and pointing to "*\SpySheriff.exe".
• Shortcuts named "SpySheriff.lnk" and pointing to "<$PROGRAMFILES>\SpySheriff\SpySheriff.exe".
• Shortcuts named "SpySheriff.lnk" and pointing to "C:\Program Files\SpySheriff\SpySheriff.exe".
• Shortcuts named "SpySheriff.lnk" and pointing to "C:\Program Files\SpySheriff\SpySheriff.exe".

Start Menu:

Please remove the following items from your start menu.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.

• Items named "SpySheriff.lnk" and pointing to "C:\Program Files\SpySheriff\SpySheriff.exe".
• Items named "SpySheriff.lnk" and pointing to "C:\Program Files\SpySheriff\SpySheriff.exe".
• Items named "SpySheriff.lnk" and pointing to "C:\Program Files\SpySheriff\SpySheriff.exe".

Quicklaunch area:

Please remove the following items from your start quick launch area text to the "Start" button in the taskbar at the bottom.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.

• Quicklaunch symbols named "SpywareSheriff.lnk" and pointing to "<$PROGRAMFILES>\SpywareSheriff\spysheriff.exe".

Autorun:

Please use Spybot-S&D, RunAlyzer or msconfig.exe to remove the following autorun entries.

• Entries named "Windows installer" and pointing to "C:\winstall.exe".
• Entries named "Explorer32".
• Entries named "SpySheriff" and pointing to "*\SpySheriff.exe".
• Entries named "SNInstall" and pointing to "*.exe".
• Entries named "SpySheriff" and pointing to "<$PROGRAMFILES>\SpySheriff\SpySheriff.exe".
• Entries named "SpySheriff" and pointing to "c:\Program Files\SpySheriff\SpySheriff.exe".
• Entries named "Windows installer" and pointing to "C:\winstall.exe".
• Entries named "SpySheriff" and pointing to "C:\Program Files\SpySheriff\SpySheriff.exe".
• Entries named "SpySheriff" and pointing to "C:\Program Files\SpySheriff\SpySheriff.exe".
• Entries named "CBACK.EXE" and pointing to "*\CBACK.EXE".
• Entries named "GAELICUM.EXE" and pointing to "*\GAELICUM.EXE".
• Entries named "PayTime" and pointing to "<$SYSDIR>\paytime.exe".
• Entries named "SpySheriff" and pointing to "C:\Program Files\SpySheriff\SpySheriff.exe".
• Entries named "Windows installer" and pointing to "C:\winstall.exe".

Installed Software List:

You can try to uninstall products with the names listed below; for items identified by other properties or to avoid malware getting active again on uninstallation, use Spybot-S&D or RunAlyzer to locate and get rid of these entries.

• Products that have a key or property named "SpywareSheriff_is1".
• Products that have a key or property named "Spy Sheriff".
• Products that have a key or property named "SpySheriff".

Files:

Please use Windows Explorer or another file manager of your choice to locate and delete these files.

• The file at "<$SYSDIR>\msmsgr.exe".
• The file at "<$SYSDIR>\spools.exe".
• The file at "<$SYSDIR>\xbccd.log".
• The file at "<$SYSDIR>\xee32.dll".
• A file with an unknown location named "hmod16.exe".
• A file with an unknown location named "mtrslib2.js".
• A file with an unknown location named "diantzpt.exe".
• The file at "<$COMMONPROGRAMS>\SpywareSheriff\SpywareSheriff entfernen.lnk".
• The file at "<$COMMONPROGRAMS>\SpywareSheriff\SpywareSheriff im Internet.lnk".
• The file at "<$COMMONPROGRAMS>\SpywareSheriff\SpywareSheriff.lnk".
• The file at "<$PROGRAMFILES>\SpywareSheriff\pkill.exe".
• The file at "<$PROGRAMFILES>\SpywareSheriff\spysheriff.exe".
• The file at "<$PROGRAMFILES>\SpywareSheriff\bz.dll".
• The file at "<$PROGRAMFILES>\SpywareSheriff\spysheriff.url".
• The file at "<$LOCALAPPDATA>\SpywareSheriff\DB\spyware.db".
• The file at "<$DESKTOP>\SpywareSheriff.lnk".
• The file at "<$STARTUP>\spysheriff.lnk".
• A file with an unknown location named "spysheriff.exe".
• A file with an unknown location named "spywaresheriff.exe".
• A file with an unknown location named "spywaresheriff.exe".
• The file at "<$SYSDIR>\svcp.csv".
• The file at "c:\winstall.exe".
• The file at "<$WINDIR>\secure32.html".
• The file at "c:\secure32.html".
• The file at "<$WINDIR>\hosts".
• The file at "<$WINDIR>\Temp\$_2341234.TMP".
• The file at "c:\Program Files\SpySheriff\SpySheriff.exe".
• The file at "c:\Program Files\SpySheriff\Uninstall.exe".
• The file at "c:\Program Files\SpySheriff\heur000.dll".
• The file at "c:\Program Files\SpySheriff\heur001.dll".
• The file at "c:\Program Files\SpySheriff\heur002.dll".
• The file at "c:\Program Files\SpySheriff\heur003.dll".
• The file at "c:\Program Files\SpySheriff\IESecurity.dll".
• The file at "c:\Program Files\SpySheriff\ProcMon.dll".
• The file at "c:\Program Files\SpySheriff\SpySheriff.dvm".
• The file at "c:\Program Files\SpySheriff\base.avd".
• The file at "c:\Program Files\SpySheriff\base001.avd".
• The file at "c:\Program Files\SpySheriff\base002.avd".
• The file at "<$SYSDIR>\efsdfgxg.exe".
• The file at "<$SYSDIR>\vxgame4.exe".
• The file at "<$LOCALSETTINGS>\Temp\2.qtdfmp".
• The file at "<$LOCALSETTINGS>\Temp\5.qtdfmp".
• The file at "<$LOCALSETTINGS>\Temp\6.qtdfmp".
• The file at "<$LOCALSETTINGS>\Temp\7.qtdfmp".
• The file at "<$SYSDIR>\vxgame1.exe".
• The file at "<$SYSDIR>\vxh8jkdq2.exe".
• The file at "<$SYSDIR>\vxh8jkdq5.exe".
• The file at "<$SYSDIR>\vxh8jkdq6.exe".
• The file at "<$SYSDIR>\vxh8jkdq7.exe".
• The file at "c:\winstall.exe".
• The file at "<$SYSDIR>\birdihuy.dll".
• The file at "c:\Program Files\SpySheriff\base.avd".
• The file at "c:\Program Files\SpySheriff\SpySheriff.exe".
• The file at "c:\Program Files\SpySheriff\base.avd".
• The file at "c:\Program Files\SpySheriff\IESecurity.dll".
• The file at "c:\Program Files\SpySheriff\ProcMon.dll".
• The file at "c:\Program Files\SpySheriff\SpySheriff.dvm".
• The file at "c:\Program Files\SpySheriff\Uninstall.exe".
• The file at "<$SYSDIR>\vx.tll".
• The file at "<$SYSDIR>\birdihuy32.dll".
• The file at "<$SYSDIR>\vxgame3.exe".
• The file at "c:\Program Files\SpySheriff\SpySheriff.dvm".
• The file at "<$FAVORITES>\Gambling\Best BlackJack Strategy.url".
• The file at "<$FAVORITES>\Gambling\Best table games.url".
• The file at "<$FAVORITES>\Gambling\Casino's tips and tricks.url".
• The file at "<$FAVORITES>\Gambling\Find Online-Casino for fun.url".
• The file at "<$FAVORITES>\Gambling\Free Card games.url".
• The file at "<$FAVORITES>\Gambling\Free Poker.url".
• The file at "<$FAVORITES>\Gambling\Horses.url".
• The file at "<$FAVORITES>\Gambling\Lotto.url".
• The file at "<$FAVORITES>\Gambling\Play Texas Holdem.url".
• The file at "<$FAVORITES>\Gambling\Sports betting.url".
• The file at "<$FAVORITES>\Gambling\Ultimate Roulette Strategy.url".
• The file at "<$FAVORITES>\Leisure\Anime sites.url".
• The file at "<$FAVORITES>\Leisure\Dating online.url".
• The file at "<$FAVORITES>\Leisure\Favourite Web Cams.url".
• The file at "<$FAVORITES>\Leisure\Flowers online.url".
• The file at "<$FAVORITES>\Leisure\Home Business.url".
• The file at "<$FAVORITES>\Leisure\Latest movies.url".
• The file at "<$FAVORITES>\Leisure\Mobile ringtones.url".
• The file at "<$FAVORITES>\Leisure\MP3 Archives.url".
• The file at "<$FAVORITES>\Leisure\Music store.url".
• The file at "<$FAVORITES>\Leisure\My horoscope.url".
• The file at "<$FAVORITES>\Leisure\Online books market.url".
• The file at "<$FAVORITES>\Leisure\Online shopping.url".
• The file at "<$FAVORITES>\Leisure\Play online games.url".
• The file at "<$FAVORITES>\Leisure\Swingers Evenings.url".
• The file at "<$FAVORITES>\Leisure\Tabloids.url".
• The file at "<$FAVORITES>\Leisure\Top rated video games.url".
• The file at "<$FAVORITES>\Leisure\World Travels.url".
• The file at "<$FAVORITES>\Pharmacy\Breast Enlargement.url".
• The file at "<$FAVORITES>\Pharmacy\Diet Pills.url".
• The file at "<$FAVORITES>\Pharmacy\Euro Pharmacy Shops.url".
• The file at "<$FAVORITES>\Pharmacy\Free Prescriptions Shops.url".
• The file at "<$FAVORITES>\Pharmacy\Loof for Hydrocodone.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Ambien.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Cialis.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Lexapro.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Phentermine.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Propecia.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Soma.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Tramadol.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Ultram.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Valium.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Viagra.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Wellbutrin.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Xanax.url".
• The file at "<$FAVORITES>\Pharmacy\Look for Zyrtec.url".
• The file at "<$FAVORITES>\Pharmacy\Penis Enlargement.url".
• The file at "<$FAVORITES>\Security\Check new antiviruses.url".
• The file at "<$FAVORITES>\Security\Data encryption.url".
• The file at "<$FAVORITES>\Security\Free virus scan.url".
• The file at "<$FAVORITES>\Security\Mail worms.url".
• The file at "<$FAVORITES>\Security\PopUp Blocker.url".
• The file at "<$FAVORITES>\Security\Protect your finances.url".
• The file at "<$FAVORITES>\Security\Read about new viruses.url".
• The file at "<$FAVORITES>\Security\Your personal firewall.url".
• The file at "<$FAVORITES>\Sports\Auto racing.url".
• The file at "<$FAVORITES>\Sports\Baseball news.url".
• The file at "<$FAVORITES>\Sports\Basketball news.url".
• The file at "<$FAVORITES>\Sports\Billiard.url".
• The file at "<$FAVORITES>\Sports\Foosball.url".
• The file at "<$FAVORITES>\Sports\Football news.url".
• The file at "<$FAVORITES>\Sports\Hockey news.url".
• The file at "<$FAVORITES>\Sports\Make a bet.url".
• The file at "<$FAVORITES>\Sports\Water sport.url".
• The file at "<$FAVORITES>\Sports\Winter sport.url".
• The file at "c:\vx.tlllll".
• The file at "c:\winstall.exe".
• The file at "<$WINDIR>\..\wmeayl32.dll".
• The file at "<$COMMONDESKTOP>\Blowjob.url".
• The file at "<$COMMONDESKTOP>\Car Insurance.url".
• The file at "<$COMMONDESKTOP>\Cigarettes Discount.url".
• The file at "<$COMMONDESKTOP>\Credit Card.url".
• The file at "<$COMMONDESKTOP>\Forex Trading.url".
• The file at "<$COMMONDESKTOP>\Free Ringtones.url".
• The file at "<$COMMONDESKTOP>\Gift Ideas.url".
• The file at "<$COMMONDESKTOP>\Group Sex.url".
• The file at "<$COMMONDESKTOP>\Home Loan.url".
• The file at "<$COMMONDESKTOP>\Mp3 Download.url".
• The file at "<$COMMONDESKTOP>\Online Casino.url".
• The file at "<$COMMONDESKTOP>\Online Dating.url".
• The file at "<$COMMONDESKTOP>\Phentermine.url".
• The file at "<$COMMONDESKTOP>\Play Poker.url".
• The file at "<$COMMONDESKTOP>\PopUp Blocker.url".
• The file at "<$COMMONDESKTOP>\Porn Dvd.url".
• The file at "<$COMMONDESKTOP>\Real Estate.url".
• The file at "<$COMMONDESKTOP>\Sport Betting.url".
• The file at "<$COMMONDESKTOP>\Spyware Remover.url".
• The file at "<$COMMONDESKTOP>\Texas Holdem.url".
• The file at "<$COMMONDESKTOP>\Viagra.url".
• The file at "<$COMMONSTARTMENU>\PopUp Blocker.url".
• The file at "<$COMMONSTARTMENU>\Spyware Remover.url".
• The file at "<$WINDIR>\efefdfddfsdh.tmp".
• The file at "<$WINDIR>\stchost.exe".
• The file at "<$SYSDIR>\cvxh8jkdq1.exe".
• The file at "<$SYSDIR>\cvxh8jkdq2.exe".
• The file at "<$SYSDIR>\cvxh8jkdq5.exe".
• The file at "<$SYSDIR>\cvxh8jkdq6.exe".
• The file at "<$SYSDIR>\cvxh8jkdq7.exe".
• The file at "<$SYSDIR>\cvxh8jkdq8.exe".
• The file at "<$SYSDIR>\init32m.exe".
• The file at "<$SYSDIR>\maxd1.exe".
• The file at "<$SYSDIR>\thn.dll".
• The file at "<$SYSDIR>\thn32.dll".
• The file at "<$SYSDIR>\vxgamet1.exe".
• The file at "<$SYSDIR>\vxgamet2.exe".
• The file at "<$SYSDIR>\zhfsduiu.ghj".
• The file at "<$SYSDIR>\zksdfnsuidfsdiu.jhk".
• The file at "<$SYSDIR>\zolker005.dll".
• The file at "<$SYSDIR>\ztoolb005.dll".
• The file at "<$COMMONDESKTOP>\Blowjob.url".
• The file at "<$COMMONDESKTOP>\Car Insurance.url".
• The file at "<$COMMONDESKTOP>\Cigarettes Discount.url".
• The file at "<$COMMONDESKTOP>\Credit Card.url".
• The file at "<$COMMONDESKTOP>\Forex Trading.url".
• The file at "<$COMMONDESKTOP>\Free Ringtones.url".
• The file at "<$COMMONDESKTOP>\Gift Ideas.url".
• The file at "<$COMMONDESKTOP>\Group Sex.url".
• The file at "<$COMMONDESKTOP>\Home Loan.url".
• The file at "<$COMMONDESKTOP>\Mp3 Download.url".
• The file at "<$COMMONDESKTOP>\Online Casino.url".
• The file at "<$COMMONDESKTOP>\Online Dating.url".
• The file at "<$COMMONDESKTOP>\Phentermine.url".
• The file at "<$COMMONDESKTOP>\Play Poker.url".
• The file at "<$COMMONDESKTOP>\PopUp Blocker.url".
• The file at "<$COMMONDESKTOP>\Porn Dvd.url".
• The file at "<$COMMONDESKTOP>\Real Estate.url".
• The file at "<$COMMONDESKTOP>\Sport Betting.url".
• The file at "<$COMMONDESKTOP>\Spyware Remover.url".
• The file at "<$COMMONDESKTOP>\Texas Holdem.url".
• The file at "<$COMMONDESKTOP>\Viagra.url".
• The file at "<$COMMONSTARTMENU>\PopUp Blocker.url".
• The file at "<$COMMONSTARTMENU>\Spyware Remover.url".
• The file at "c:\Program Files\SpySheriff\SpySheriff.exe".
• The file at "<$WINDIR>\installer2.exe".
• The file at "<$SYSDIR>\appwiz.dll".
• The file at "<$SYSDIR>\maxd1.exe".
• The file at "<$SYSDIR>\zhfsduiu.ghj".
• The file at "<$SYSDIR>\zksdfnsuidfsdiu.jhk".
• The file at "c:\Program Files\SpySheriff\SpySheriff.exe".
• A file with an unknown location named "CBACK.EXE".
• A file with an unknown location named "dl.exe".
• A file with an unknown location named "GAELICUM.EXE".
• The file at "<$SYSDIR>\cvxh8jkdq1.exe".
• The file at "<$SYSDIR>\cvxh8jkdq5.exe".
• The file at "<$SYSDIR>\cvxh8jkdq7.exe".
• The file at "<$SYSDIR>\cvxh8jkdq8.exe".
• The file at "<$SYSDIR>\init32m.exe".
• The file at "<$SYSDIR>\maxd1.exe".
• The file at "<$SYSDIR>\vxgamet1.exe".
• The file at "<$SYSDIR>\zhfsduiu.ghj".
• The file at "<$SYSDIR>\zksdfnsuidfsdiu.jhk".
• A file with an unknown location named "win32.exe".
• The file at "c:\Program Files\SpySheriff\found.wav".
• The file at "c:\Program Files\SpySheriff\IESecurity.dll".
• The file at "c:\Program Files\SpySheriff\notfound.wav".
• The file at "c:\Program Files\SpySheriff\ProcMon.dll".
• The file at "c:\Program Files\SpySheriff\removed.wav".
• The file at "c:\Program Files\SpySheriff\SpySheriff.dvm".
• The file at "c:\Program Files\SpySheriff\SpySheriff.exe".
• The file at "c:\Program Files\SpySheriff\SpySheriff_1.dat".
• The file at "c:\Program Files\SpySheriff\SpySheriff_2.dat".
• The file at "c:\Program Files\SpySheriff\Uninstall.exe".
• The file at "c:\124714.exe".
• The file at "c:\winstall.exe".
• The file at "<$LOCALSETTINGS>\Temp\kbfppomd.exe".
• The file at "<$WINDIR>\desktop.html".
• The file at "<$WINDIR>\hosts".
• The file at "<$WINDIR>\ms2.exe".
• The file at "<$WINDIR>\ms3.exe".
• The file at "<$WINDIR>\ms4.exe".
• The file at "<$WINDIR>\tool1.exe".
• The file at "<$WINDIR>\tool2.exe".
• The file at "<$SYSDIR>\drct16.dll".
• The file at "<$SYSDIR>\mszx23.exe".
• The file at "<$SYSDIR>\newdial.exe".
• The file at "<$SYSDIR>\p2.ini".
• The file at "<$SYSDIR>\paydial.exe".
• The file at "<$SYSDIR>\paytime.exe".
• The file at "<$SYSDIR>\ps.a3d".
• The file at "<$SYSDIR>\redir.a3d".
• The file at "<$SYSDIR>\tibs.exe".
• The file at "<$SYSDIR>\tnfl.a3d".
• The file at "<$LOCALAPPDATA>\Microsoft\Internet Explorer\Desktop.htt".
• The file at "<$SYSDIR>\cz.dll".
• The file at "<$SYSDIR>\hz.sys".
• The file at "<$SYSDIR>\winlow.sys".
• The file at "<$SYSDIR>\wz.sys".
• The file at "<$SYSDIR>\vdmt16.sys".

Make sure you set your file manager to display hidden and system files. If SpySheriff uses rootkit technologies, use our RootAlyzer or our Total Commander anti-rootkit plugins.
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!

Important: There are more files that cannot be safely described in simple words. Please use Spybot-S&D to remove them.

Folders:

Please use Windows Explorer or another file manager of your choice to locate and delete these folders.

• The directory at "<$LOCALAPPDATA>\SpywareSheriff".
• The directory at "<$LOCALAPPDATA>\SpywareSheriff\DB".
• The directory at "<$LOCALAPPDATA>\SpywareSheriff\DB\run_backup".
• The directory at "<$LOCALAPPDATA>\SpywareSheriff\DB\snapshots".
• The directory at "<$LOCALAPPDATA>\SpywareSheriff\Logs".
• The directory at "<$LOCALAPPDATA>\SpywareSheriff\Quarantine".
• The directory at "<$LOCALAPPDATA>\SpywareSheriff\Settings".
• The directory at "<$PROGRAMFILES>\SpywareSheriff".
• The directory at "<$PROGRAMFILES>\SpywareSheriff\interface".
• The directory at "<$PROGRAMFILES>\SpywareSheriff\sounds".
• The directory at "c:\Program Files\SpySheriff".
• The directory at "<$PROGRAMS>\SpySheriff".

Make sure you set your file manager to display hidden and system files. If SpySheriff uses rootkit technologies, use our RootAlyzer or our Total Commander anti-rootkit plugins.
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!

Registry:

You can use regedit.exe (included in Windows) to locate and delete these registry entries.

• Delete the registry key "SpySheriff" at "HKEY_LOCAL_MACHINE\Software\".
• Delete the registry key "{2E246FAE-8420-11D9-870D-000C2917DE7F}" at "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\".
• Delete the registry key "LAWGA" at "HKEY_CURRENT_USER\Software\".
• Delete the registry key "63.219.181.7" at "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\".
• Delete the registry key "{44BC250D-89F1-4E11-BB30-6CE81B588792}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry key "{A3C417E5-1C12-4883-8AC2-DBE99BBF24F3}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry key "{AC6A7F92-296D-4CF6-A7C3-B1C58E1E4874}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry key "{0C81EA61-20F8-4ddc-81BF-AF0923078398}" at "HKEY_CURRENT_USER\Software\Classes\CLSID\".
• Delete the registry key "{0C81EA61-20F8-4ddc-81BF-AF0923078398}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry value "{0C81EA61-20F8-4ddc-81BF-AF0923078398}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\".
• Delete the registry key "SNO2" at "HKEY_CURRENT_USER\Software\".
• Delete the registry key "{2E246FAE-8420-11D9-870D-000C2917DE7F}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\".
• Delete the registry value "(Default)" at "HKEY_USERS\S-1-5-21-117609710-790525478-839522115-1000_Classes\CLSID\{0656A137-B161-CADD-9777-E37A75727E78}\InProcServer32\".
• Delete the registry key "{0656A137-B161-CADD-9777-E37A75727E78}" at "HKEY_CURRENT_USER\Software\Classes\CLSID\".
• Delete the registry key "{0656A137-B161-CADD-9777-E37A75727E78}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry key "{89C5061C-12D3-0FDD-1C37-0B6BD8857674}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry key "moto" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\".
• Delete the registry key "moto" at "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\".
• Delete the registry key "{2E246FAE-8420-11D9-870D-000C2917DE7F}" at "HKEY_CLASSES_ROOT\CLSID\".
• Delete the registry value "phid" at "HKEY_LOCAL_MACHINE\SOFTWARE\Windows\".
• Delete the registry key "SNO" at "HKEY_CURRENT_USER\Software\".
• Delete the registry key "SpySheriff" at "HKEY_CURRENT_USER\Software\".
• Delete the registry key "drct16" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\".
• Delete the registry key "vdmt16" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\".
• Delete the registry key "winlow" at "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\".
• Delete the registry key "vdmt16" at "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\".
• Delete the registry key "winlow" at "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\".

If SpySheriff uses rootkit technologies, use our RegAlyzer, RootAlyzer or our Total Commander anti-rootkit plugins.

Browser:

The following browser plugins or items can either be removed directly in your browser, or through the help of e.g. Spybot-S&D or RunAlyzer.

• Please check your bookmarks for links to "c:\secure32.html".
• Please check your bookmarks for links to "195.95.218.172/index.php".

If you have any further questions, please ask in our forum.