need help with adware.sheriff

[animemanga]

hi
ihave pros with an annoying adware.sheriff. my norton anti virus doen not detect it. any 1 help.

 

[howard_hopkinso]

Hello and welcome to Techspot.

Your system is infected with the SmitFraud infection, amongst other things.

First go HERE and follow the instructions exactly.

Then, go HERE and do likewise.

Post a fresh HJT log into this thread, only after doing the above.

Regards Howard :wave: :wave:

 

[Tedster]

spysherriff virus removal info is located in the best collection sticky.

 

[howard_hopkinso]

Hi Tedster.

animemanga doesn`t have the spysheriff infection. Instead he has one of the new variants of the Smitfraud infection. I think it`s probably the W32.Myzor.FK@yf infection.

Regards Howard

 

[Tedster]

Hi Tedster.

animemanga doesn`t have the spysheriff infection. Instead he has one of the new variants of the Smitfraud infection. I think it`s probably the W32.Myzor.FK@yf infection.

Regards Howard

hmmm. must be a variant..... this is new.... interesting....

 

[animemanga]

hi
like u told me i went to the first place. but there is a problem i downloaded
smitfraudfix. but it wont open. i extract the folder like told. but when i try to open. its say that another programme is currently using it. i felt my pc on the whole night waiting for a change but nothing. rebooted but still nothing

i dnt get wat is going on

 

[howard_hopkinso]

Ok, skip that for now and follow the instructions in the second link I gave you.

Regards Howard

 

[animemanga]

i retried the first link with safe mode and i managed to get it through. i aslo did wat was needed for the second link.so far so good.i regained my home page. but weirdly ewido found 1085 infected files is that normal or my pc is way too sick. here are both the new hjk log and the ewido report.



wat i am not allowed to post my ewido report as txt format cause it's 2 big. am in a hurry now. so can any 1 answer wats going on i will just post my hjk log for now

 

[howard_hopkinso]

Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Goto add remove programmes in your control panel and uninstall anything to do with(if there).

ULi5287

Close contol panel.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

RecoverFromReboot.exe
ULi5287.exe

Close task manager.

Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy1@equinxsolution.com:80<Fix this, if you don`t know what it is, or you have not set this yourself.

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll

F2 - REG:system.ini: Shell=

O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll

O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\system32\hp100.tmp (file missing)

O2 - BHO: Nothing - {6ab7158b-4bff-4160-ad7d-4d622df548cf} - C:\WINDOWS\system32\hp100.tmp (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_03\bin\ssv.dll (file missing)

O4 - HKLM\..\Run: [ULiRaid] C:\Program Files\ULi5287\ULi5287.exe

O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe

Fix all 016-DPF entries.

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\WINDOWS\Temp\RecoverFromReboot.exe
C:\Program Files\ULi5287\ULi5287.exe

Reboot into normal mode and turn system restore back on.

Please post a fresh HJT log.


Regards Howard

 

[RUDEBWOY]

i would try and download kaspersky net seucirty 6.0 is great everyone that had virus or spyware probs i recomended this prog to and it worked great 1 of the best av/fire wall out there right now.

 

[animemanga]

chattin to howard.

hi
thanx for everything. am on what u told me. but just few question.
why do i uninstall. ULI5287, and everthing involved with it.? i don't even know what it does but, u know its just one of those thing that i never messed wiv and probably never messed wiv me. I FOUND ULI LAN DRIVER AND ULI SATA DRIVER.

I GOT THE PROXY1@EQUINXSOLUTIONS FROM SOMEONE COZ MY PC SEEMED TO NOT CONNECTED.

thanx alot howard. so far so gooooooooood. i got mi home page n i dnt see silly pop ups no more.

 

[howard_hopkinso]

I can find very little info for ULi5287.exe. If you know what it is and think it`s safe, then by all means keep it.

If you don`t want to uninstall it, then maybe you should just let HJT fix the entries. If it causes any problems, you can always restore them.

Regards Howard

 

[animemanga]

ok

sounds great to me. so i will just follow the instruction you posted ealier.
does ULI seem to be disturbing my system ???

 

[howard_hopkinso]

does ULI seem to be disturbing my system ???

Because I can find very little info for the process, I don`t know if it`s safe or nasty. If in doubt get rid of it.

Regards Howard

 

[animemanga]

aaah!
i have been told that ULI is used to propaly store drives. or something. i almost never use it. but my mate doesn't want me to mess wiv it. so i don't know what to do know. your earlier instructions involve deleting ULI raid.

any other thing i need to do

thanx for all

 

[howard_hopkinso]

If you`re not having anymore problems, then keep the ULi5287 programme.

Regards Howard

 

[animemanga]

ok i will keep it for now thanx so much.
since infected by the virus my pc started to sound like a vacuum(almost)
i don't understand why it's giving that horrible sound. and it doesn't seem to coop with UTORRENt no more(it's a programme used by my roomate to download music.) i can't do a simple task why that programme is running. is there any explanation??? . it seemed to go well before i was infected. thanx again

 

[howard_hopkinso]

Mmm strange. It could just be a coincidence. However, I`d like you to post a fresh HJT log please.

Regards Howard

 

[animemanga]

it's indeed very starnge...
Utorrent worked good before infection but now goes very slow and makes everything slow as well. the weird sound comes sometimes and is like a vacuum
anyway here's the fresh hjk log

 

[howard_hopkinso]

Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

RecoverFromReboot.exe

Close task manager.

Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy1@equinxsolution.com:80

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll

F2 - REG:system.ini: Shell=

O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\system32\hp100.tmp (file missing)

O2 - BHO: Nothing - {6ab7158b-4bff-4160-ad7d-4d622df548cf} - C:\WINDOWS\system32\hp100.tmp (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_03\bin\ssv.dll (file missing)

O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe

O4 - HKLM\..\Run: [Workflow] D:\Workflow.exe

O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.google.com

Fix all 016-DPF entries

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\WINDOWS\Temp\RecoverFromReboot.exe

Reboot into normal mode and turn system restore back on.

I`m still suspicious of C:\Program Files\ULi5287\ULi5287.exe and also this entry as well. R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy1@equinxsolution.com:80



Regards Howard

 

[animemanga]

if the expert say he's suspicious, then there must be wrong with that programm.
i dnt need proxy1@eqiun........
but what about uli raid. if i delete it will i be able to recover it. if the deleting doesn't make any change???

 

[howard_hopkinso]

Don`t uninstall the uli programme, just let HJT fix the uli entries. If you then have problems, you can always restore the HJT entries for that programme.

Regards Howard