View Full Version : Trouble with "SpySheriff"


arpinl
01-21-2007, 10:01 AM
I have had to remove a spyware "program" (I'm a layman) called SpySheriff at least four times in the last three days. Here's the sequence of events: I turn on the computer, open an Internet browser, and I get a pop-up message from my anti-virus software alerting me that spyware has been detected. So I run a scan, take their suggestion to remove it, and then restart my computer. The last two times I had SpySheriff end up on my computer, I had *just* surfed to mouseplanet.com.

Is it possible that a third-party advertiser on MousePlanet is somehow responsible? (I don't mean to sound accusatory--just wondering; I obviously wouldn't still be visiting this site if I thought it were at all unscrupulous.) I am a pretty light PC user these days (i.e., no computer games, no Internet downloads, no online chatting), so I had thought I was relativley low-risk for spyware (though I understand no one is 100% safe).

I realized that I had turned off my pop-up blocker in order to remotely access an application I needed for work; once I turned the pop-up blocker back on, I stopped getting SpySheriff messages. Any theories as to what was/is going on? :confused:

Andrew
01-21-2007, 11:23 AM
I realized that I had turned off my pop-up blocker in order to remotely access an application I needed for work; once I turned the pop-up blocker back on, I stopped getting SpySheriff messages. Any theories as to what was/is going on? :confused:
Detailed information on removing SpySherrif can be found here: http://www.wikihow.com/Get-Rid-of-SpySherrif-and-Spyaxe-Malware

arpinl
01-21-2007, 01:00 PM
But I've run full system scans with my anti-virus/Internet security software, and I am not getting messages about SpySherrif anymore. Do I still need to follow those removal instructions; if so, why?

Andrew
01-21-2007, 01:14 PM
But I've run full system scans with my anti-virus/Internet security software, and I am not getting messages about SpySherrif anymore. Do I still need to follow those removal instructions; if so, why?
I do not know as my machines have never been infected with it. However, the available information suggests that this class of malware can hide itself from spyware scans.

As to whether it's coming from MousePlanet ads, while I as MousePlanet's system engineer find this unlikely I would like to investigate it. Please PM me with the following:

Operating system and service pack level (Windows Key + Pause/Break)
Web browser and version (Help - About)
Name and version of whatever anti-malware tools you've tried
Specific MousePlanet URLs or banner ads that seem to be causal to reinfection