Member Avatar for J☼E

every time i run adaware and spybot i always get tracking cookies every time i scan even if i delte them and beside them they say "Red Sheriff tracking cookie" and i need to know how to get rid of Red Sheriff please help

  • 6 Contributors
  • 15 Replies
  • 320 Views
  • 4 Months Discussion Span
  • Latest Post Latest Post by Catweazle

Dani AI

Generated

A persistent "Red Sheriff" cookie usually means something is recreating it, not that your scanner missed a one-off file. If a local registry cleanup (the RSnet keys @J☼E found) stopped the cookie, that strongly suggests a component on the PC — an installed program, a Browser Helper Object, service or scheduled task — was writing the cookie every time you browsed. The fixes suggested earlier are good first steps; here is a focused way to find the actual source and stop it from coming back.

Reproduce and watch: clear the cookie, open the browser dev tools (F12) and use the Network panel while you reload pages. Look for a Set-Cookie header or a request to a third-party domain that matches the cookie name. If the cookie appears even when you are not browsing, it is almost certainly created locally. To catch which process writes the file, run Process Monitor (Procmon) and filter for writes to your Cookies folder or for the string rsnet/redsheriff. That will tell you the executable or service responsible.

Remove and harden: once you identify the culprit, uninstall the program or disable its startup entry (use Autoruns or msconfig if needed). Export and back up any registry keys before deleting them; if you are unsure, rename or export then remove. As a containment measure you can block the tracking domain at the OS level by adding a 127.0.0.1 tracking-domain line to C:\Windows\System32\drivers\etc\hosts (replace with the actual domain you found) and run ipconfig /flushdns. Also use browser privacy settings to block third-party cookies and consider a script/ad blocker to stop embedded trackers from loading.

Cautions: always back up the registry and files before deleting, and work from Safe Mode if the component resists removal. If identification is unclear, save an Autoruns or process log and share it — that makes it possible to advise exactly which entries to remove without guessing.

Recommended Answers

All 15 Replies

Member Avatar for caperjack

The wonders of .

Member Avatar for J☼E

that doesnt help though i just want to get rid of this thing i heard its a java script added to every webpage you visit to track where your going and :cry:

Member Avatar for crunchie

Download & install spywareblaster & update. Go to the cookie manager & block it from there also.

Member Avatar for J☼E

well i have spyware blaster and i did that but it still doesnt work theres still a few cookies that still show up every single time i do the scan

Member Avatar for WEATHER CHANNEL

Harden IE and run on a limited account.
Assuming XP,Boot into safe mode to remove it.

Member Avatar for caperjack

First please get Spybot S&D to clear out most of the spyware.

Short tutorial and download link here:

Fix everything SpybotSD labels in red.

Then after reboot:
Download 'Hijack This!'. http://www.tomcoyote.org/hjt/
Unzip to a permanent folder, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, load it in Notepad, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.
then post the log here

Member Avatar for J☼E

i have spybot adaware and i run them frequently

Member Avatar for caperjack

i have spybot adaware and i run them frequently

ok so what you are saying is they didn't help !:)
Ok go here and get hijackthis ,and follow the instruction above.

Member Avatar for J☼E

ok i fixed it i now have no tracking cookies, the red sheriff thing was uninstalled but i ran registry cleaner and found the entries that had "RSnet" in them and delted them and now im good ;)

Member Avatar for caperjack

Thats Great .They will likely be Back:)

Member Avatar for J☼E

:sad:

Member Avatar for caperjack

If you want ,Download and run hijackthis from my signature and run it and save the log and post it here ,don't fix anything yet .I'll have a look for any baddies !

Member Avatar for J☼E

ok i have that thing already tho lol

Member Avatar for saaraa

I was wondering if someone could please help me, I have the same problem with this guy, The red sherriff cookie shows up every time i scan adaware, Whats the best way to solve this??
Thanks
Sarah
:sad:

Member Avatar for Catweazle

Keep removing them at regular intervals. That's the reason we use Spyware detection an removal tools - to keep the 'passengers' we pick up from web browsing cleaned out regularly. You should run those programs every day, for preference.

It's sorta like why we have a sleep at night, then wake up, shower and breakfast - to keep ourselves in shape and on top of things! :D

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.