R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

O9 – Extra 'Tools' menuitem: Show &Related Links – {c95fe080–8f5d–11d2–a20b–00aa003c157a}
O9 – Extra button: Related – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:\WINDOWS\web\related.htm –
O2 – BHO: CSPIEEvents Class – {84B71424–B020–11D4–B198–000102C6D473} – C:\WINDOWS\SurfPlus.dll C:\WINDOWS\web\related.htm Files\SpySheriff\SpySheriff.exe
O2 – BHO: CSPIEEvents Class – {84B71424–B020–11D4–B198–000102C6D473} – C:\WINDOWS\SurfPlus.dll

daj loga z hijacka to sie spr. czy nie załapałes syfu

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
D:\Adam–dokumenty\MyPrivacy\MyPrivacy\mpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\Adam–dokumenty\MyPrivacy\MyPrivacy\MyPrivacyNT.exe
C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
C:\Program Files\Messenger\msmsgs.exe
E:\Programy\memturbo\memturbo.exe
C:\Program Files\SpySheriff\_SpySheriff.exe
C:\Program Files\Gadu–Gadu\gg.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\wincmd\WINCMD32.EXE
E:\Programy\Spybot – Search & Destroy\!Inne\HijackThis.exe

R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/
R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 – REG:win.ini: run=C:\Program Files\Advanced StartUp Manager\explorer.exe
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – D:\Adobe\Acrobat Reader 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 – BHO: CSPIEEvents Class – {84B71424–B020–11D4–B198–000102C6D473} – C:\WINDOWS\SurfPlus.dll
O2 – BHO: AcroIEToolbarHelper Class – {AE7CD045–E861–484f–8273–0445EE161910} – D:\Adobe\Acrobat Reader 6.0\Acrobat\AcroIEFavClient.dll
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 – BHO: OsbornTech Popup Blocker – {C68AE9C0–0909–4DDC–B661–C1AFB9F5AE53} – D:\Adam–dokumenty\MyPrivacy\MyPrivacy\PopupBlocker.dll
O4 – HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 – HKLM\..\Run: [Openwares LiveUpdate] "C:\Program Files\LiveUpdate\LiveUpdate.exe"
O4 – HKLM\..\Run: [Startup Manager Scanner] "E:\Programy\Startup Mechanic\StartupScanner.exe"
O4 – HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 – HKLM\..\Run: [MyPrivacy] "D:\Adam–dokumenty\MyPrivacy\MyPrivacy\MyPrivacyNT.exe"
O4 – HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup"
O4 – HKLM\..\Run: [WheelMouse] "C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe"
O4 – HKLM\..\Run: [Symantec NetDriver Monitor] "C:\PROGRA~1\SYMNET~1\SNDMon.exe " /Consumer
O4 – HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 – HKCU\..\Run: [MyPrivacy] "E:\Programy\My Privacy\MyPrivacy\MyPrivacyNT.exe"
O4 – HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe
O4 – Startup: MemTurbo.lnk = E:\Programy\memturbo\memturbo.exe
O4 – Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 – Extra context menu item: &Download with &DAP – D:\DAP\dapextie.htm
O8 – Extra context menu item: Download &all with DAP – D:\DAP\dapextie2.htm
O9 – Extra button: (no name) – {0D555BC6–E331–48b3–A60E–AAC0DF79438A} – D:\Adam–dokumenty\MyPrivacy\MyPrivacy\PopupBlocker.dll
O9 – Extra 'Tools' menuitem: Popup Blocker – {0D555BC6–E331–48b3–A60E–AAC0DF79438A} – D:\Adam–dokumenty\MyPrivacy\MyPrivacy\PopupBlocker.dll
O9 – Extra button: Related – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:\WINDOWS\web\related.htm
O9 – Extra 'Tools' menuitem: Show &Related Links – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:\WINDOWS\web\related.htm
O17 – HKLM\System\CCS\Services\Tcpip\..\{D57BD20C–7177–4CDE–9314–A91DB00F249F}: NameServer = 217.30.129.149,217.30.137.200
O23 – Service: Symantec Event Manager (ccEvtMgr) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 – Service: Symantec Proxy Service (ccPxySvc) – Symantec Corporation – C:\Program Files\Norton Internet Security\ccPxySvc.exe
O23 – Service: Norton AntiVirus Auto Protect Service (navapsvc) – Symantec Corporation – C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 – Service: Norton Internet Security Accounts Manager (NISUM) – Symantec Corporation – C:\Program Files\Norton Internet Security\NISUM.EXE
O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:\WINDOWS\System32\nvsvc32.exe
O23 – Service: Omniquad MyPrivacy – Unknown owner – D:\Adam–dokumenty\MyPrivacy\MyPrivacy\mpsvc.exe
O23 – Service: ScriptBlocking Service (SBService) – Symantec Corporation – C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 – Service: Symantec Network Drivers Service (SNDSrvc) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 – Service: SymWMI Service (SymWSC) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

SpySheriff Agresywnie reklamowany głównie poprzez Fałszywe tapety na Pulpicie. Instalowany bez zgody i wiedzy zwykle w komplecie innych szpiegów. Fałszywe alarmy by namówić do zakupu. Zupełnie niewiarygodne wyniki skanu. Identyczna aplikacja jak inni oszuści: SpyDemolisher & SpywareNo .