Spy Sheriff - now will only boot in safe mode

Hello, I have a XP-home computer with 512 mg of RAM, and a 20 gig hdd. I was infected with Spy Sheriff. I have used Spy-Bot, SmitRem, Ewido & HiJack This to try to get rid of all traces of Spy Sheriff. My HiJack this log came up with only medium threats in the HiJack This analyzer.

I think I have removed most traces of the malware, but my computer will not boot normally, only in safe mode. Also, task manager is completely useless, you can bring it up, but it won't do anything, and you can't close it.

Is there anything I can do, short of re-formatting?
When I have tried to go to last known good configuration, Spy Sheriff basically controlls the machine and I can't do anything. All of my XP rollback dates have apparently been erased by Spy Sheriff because they are not recognized.

Thanks for the help.

 

Welcome to Majorgeeks tracyvc!

The HJT log analyzer is based on user input and as such may not be accurate, also Spyware often generates a random name for itself as it installs so most analyzers are no help with the modern more nasty varietys.

You also need to bear in mind that HJT isn't a tool for fixing malware, it should more be thought of as a tool to inform and investigate infections.

It sounds as though you have more than one infection here. Don't format just yet, we havn't come across much (if anything) that we couldn't fix with some manual removal steps.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

• Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
• Make sure you check version numbers and get all updates.
• Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

• After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

​

• When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
  • runkeys.txt - the log from GetRunKey.bat
  • newfiles.txt - the log from ShowNew.bat[/B]
  • CounterSpy - ONLY IF you were not able to run Windows Defender
  • Bitdefender - from step 6
  • Panda Scan - from step 6
  • HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

I know you have already run some of the tools but please go through the steps and run them in the order we request as this will help us get your machine into a specific state and we can sort a fix from there.