SpySheriff (also known as BraveSentry 2.0, among other names) is
malware
Malware (a portmanteau of ''malicious software'')Tahir, R. (2018)A study on malware and malware detection techniques . ''International Journal of Education and Management Engineering'', ''8''(2), 20. is any software intentionally designed to caus ...
that
disguises itself as
anti-spyware software. It attempts to mislead the user with false security alerts, threatening them into buying the program.
Like other rogue antiviruses, after producing a list of false
threats
A threat is a communication of intent to inflict harm or loss on another person. Intimidation is a tactic used between conflicting parties to make the other timid or psychologically insecure for coercion or control. The act of intimidation fo ...
, it prompts the user to pay to remove them. The software is particularly difficult to remove,
since it nests its components in System Restore folders, and also blocks some system management tools. However, SpySheriff can be removed by an experienced user,
antivirus software
Antivirus software (abbreviated to AV software), also known as anti-malware, is a computer program used to prevent, detect, and remove malware.
Antivirus software was originally developed to detect and remove computer viruses, hence the name ...
, or by using a rescue disk.
Websites
SpySheriff was hosted at both www.spysheriff.com and www.spy-sheriff.com,
which operated from 2005 until their shutdown in 2008. Both domains are now parked. Several other similarly-named websites also hosted the program but have all been shut down.
Features of a SpySheriff infection
* SpySheriff is designed to behave like genuine antispyware software. Its user interface features a
progress bar
A progress bar is a graphical control element used to visualize the progression of an extended computer operation, such as a download, file transfer, or installation. Sometimes, the graphic is accompanied by a textual representation of the progre ...
and counts allegedly found threats, but its scan results are deliberately false, with cryptic names such as "Trojan VX …" to mislead and scare the user.
* Removal attempts may be unsuccessful and SpySheriff may reinstall itself.
* The desktop background may be replaced with an image resembling a
Blue Screen of Death
The blue screen of death (BSoD) or blue screen error, blue screen, fatal error, bugcheck, and officially known as a stop erroris a fatal system error, critical error screen displayed by the Microsoft Windows operating systems to indicate a cr ...
, or a notice reading, "SPYWARE INFECTION! Your system is infected with spyware. Windows recommends that you use a spyware removal tool to prevent loss of data. Using this PC before having it cleaned of spyware threats is highly discouraged."
* Attempts to remove SpySheriff via
Add or Remove Programs in Control Panel either fails or causes the computer to restart unexpectedly.
* Attempts to connect to the
Internet
The Internet (or internet) is the Global network, global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a internetworking, network of networks ...
in any
Web browser
A web browser, often shortened to browser, is an application for accessing websites. When a user requests a web page from a particular website, the browser retrieves its files from a web server and then displays the page on the user's scr ...
is blocked by SpySheriff. Spy-Sheriff.com becomes the only accessible website, and can be opened through the program's control panel.
* Attempts to remove SpySheriff via
System Restore
System Restore is a feature in Microsoft Windows that allows the user to revert their computer's state (including system files, installed applications, Windows Registry, and system settings) to that of a previous point in time, which can be used ...
are blocked as it prevents the
calendar
A calendar is a system of organizing days. This is done by giving names to periods of time, typically days, weeks, months and years. A calendar date, date is the designation of a single and specific day within such a system. A calendar is ...
and restore points from loading. Users can overcome this by undoing the previous restore operation, after which the system will restore itself, allowing for easier removal of SpySheriff.
* SpySheriff can detect certain antispyware and antivirus programs running on the machine, and disable them by ending their processes as soon as it detects them. This may prevent its detection and removal by legitimate antivirus programs.
* SpySheriff can disable
Task Manager
In operating systems, a task manager is a system monitor program used to provide information about the processes and applications running on a computer, as well as the general status of the computer. Some implementations can also be used t ...
and
Registry Editor, preventing the user from ending its active process or removing its registry entries from Windows. Renaming the 'regedit' and 'taskmgr' executables will solve this problem.
See also
*
Rogue security software
Rogue security software is a form of malicious software and internet fraud that misleads users into believing there is a virus on their computer and aims to convince them to pay for a fake malware removal tool that actually installs malware on th ...
*
Trojan horse (computing)
In computing, a trojan horse (or simply trojan; often capitalized, but see below) is a kind of malware that misleads users as to its true intent by disguising itself as a normal program.
Trojans are generally spread by some form of social engin ...
Notes
References
External links
* (Note, the online installer does not work due to the payload of the installer being taken down alongside the website.)
*
* http://www.bleepingcomputer.com/forums/topic22402.html
*
{{DEFAULTSORT:Spysheriff
Windows trojans
Rogue security software