"spy sheriff" dang it I had now Trouble

[Crank]

XP Pro, I got this virus spy sheriff and i use microsoft antispyware to remove it but now my desktop is stuck on a warning taht says you are infected by spyware and when i try to change my display picture it seems to be locked out . it wont let me change the display picture. now what

[Sterling_Aug]

Try another anti-spyware program such as Adware Away or an online one like Trend Micro Housecall. I often use 6 to 10 different programs to clean out my clients machines.

[Crank]

as my computer boots it goes to my original background but then flashes to the spyware add and stays there. My display properties seem to be locked or the active destop is taking control.

[fancyf]

as my computer boots it goes to my original background but then flashes to the spyware add and stays there. My display properties seem to be locked or the active destop is taking control. I would also suggest you run other programs to make sure it's off your system.

HijackThis (http://www.spywareinfo.com/~merijn/downloads.html), some online scans (http://www.sysopt.com/forum/showthread.php?t=161595) and also this could be helpful: MWAV (http://www.mwti.net/products/mwav/mwav.asp)

As for your desktop...

This - if tabs are missing from the Display Properties:

XP Tweaks (http://www.kellys-korner-xp.com/xp_tweaks.htm) <- line 128
http://www.kellys-korner-xp.com/regs_edits/desktoptab.reg <- direct download link

Or this:

Mosaic1: This is a script to clean up desktop when users have had spywad and other pests that change desktop and the AV has killed the files ( it also restores the no right click that spywad etc breaks)

This fix is only for XP & Windows 2000

Download and Save Cleandesktop to your computer from this link: http://www.thespykiller.co.uk/files/cleandesktop.exe and double click on the cleandesktop.exe

It will automatically extract to c:\desktopclean where it needs to be to run and will automatically run the cleandesktop.vbs script

If it doesn't open then go to c:\desktopclean and double click on the cleandesktop.vbs Do not run any other file from there please unless asked to

If you have script blocking enabled you will get a warning about a malicious script wanting to run. Please allow this script to run. It is not malicious.

If you get a message when you first run it "Can not find script file "blah blah blah" then don't worry just doubleclick the cleandesktop.vbs script again you sometimes get that message when a script blocker blocks the script

It will then kill Explorer. You will lose your taskbar and desktop. It will repair the registry entries returning your normal desktop and context menu functions.

It will restart Explorer.

Once you have performed the big cleanup, each of the other Users on the System needs to be signed in to clean up their desktop and regain the right click.

I have included another vbs to do this. It is named Other Profiles Regfix.vbs

Have each User sign in and run Other Profiles Regfix.vbs
Open C:\ (Go to Start>Run and type C: Press enter) and Open the c:\desktopclean folder. Double click on Other Profiles Regfix.vbs

Explorer will be ended and that user's active desktop registry entries will be repaired. Explorer will be restarted.

To restore the desktop to whatever picture you normally have right click on a blank part of desktop & select properties/desktop & select your prefered picture press apply & then ok to exit and then press F5

You will need to do this step for every user account

source (http://forums.maddoktor2.com/index.php?showtopic=3924)
.ƒ.

[Crank]

wow thanks bu t i did a systems restore took it back a week. Was that the wrong thing to do . You really fixed me up here and i want my system right again should i go ahead and do this fix or let it go.

[fancyf]

Well, did system restore fixed the desktop problem or not?

I would still run the online scans & hijackthis to make sure everything's gone.


[ As for prevention: Download, install and update SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html) ; no need to let it run, just update from time to time and close. ]