Top Qs
Timeline
Chat
Perspective
SpySheriff
Pretend anti-spyware malware From Wikipedia, the free encyclopedia
Remove ads
SpySheriff[a] (also known as BraveSentry 2.0, among other names) was malware that disguised itself as anti-spyware software created by Innovative Marketing Inc. or under alternate name Innovagest 2000. It attempted to mislead the user with false security alerts, threatening them into buying the program.[4] Like other rogue antiviruses, after producing a list of false threats, it prompted the user to pay to remove them. The software was particularly difficult to remove,[5] since it nested its components in System Restore folders, and also blocked some system management tools. However, SpySheriff could be removed by an experienced user, antivirus software, or by using a rescue disk.
Remove ads
Websites
SpySheriff was hosted at both www.spysheriff.com and www.spy-sheriff.com,[6][self-published source] which operated from 2005 until their shutdown in 2008.[citation needed] Both domains are now parked. Several other similarly-named websites also hosted the program but have all been shut down.
Features of a SpySheriff infection
- SpySheriff was designed to behave like genuine antispyware software. Its user interface featured a progress bar and counted allegedly found threats, but its scan results were deliberately false, with cryptic names such as "Trojan VX …" to mislead and scare the user.[7][8]
- Removal attempts in some cases were unsuccessful because SpySheriff could reinstall itself.[citation needed]
- The desktop background sometimes was replaced with an image resembling a Blue Screen of Death, or a notice reading, "SPYWARE INFECTION! Your system is infected with spyware. Windows recommends that you use a spyware removal tool to prevent loss of data. Using this PC before having it cleaned of spyware threats is highly discouraged."[9]
- Attempts to remove SpySheriff via Add or Remove Programs in Control Panel either failed or caused the computer to restart unexpectedly.[10]
- Attempts to connect to the Internet in any Web browser was blocked by SpySheriff. Spy-Sheriff.com became the only accessible website, and could be opened through the program's control panel.[citation needed]
- Attempts to remove SpySheriff via System Restore were blocked as it prevents the calendar and restore points from loading. Users could overcome this by undoing the previous restore operation, after which the system will restore itself, allowing for easier removal of SpySheriff.[10]
- SpySheriff could detect certain antispyware and antivirus programs running on the machine, and disable them by ending their processes as soon as it detected them. This prevented its detection and removal by legitimate antivirus programs.[citation needed]
- SpySheriff could disable Task Manager and Registry Editor, preventing the user from ending its active process or removing its registry entries from Windows. By renaming the 'regedit' and 'taskmgr' executables users could solve this problem.[citation needed]
Remove ads
See also
Notes
- Also known by around thirty other names, including BraveSentry, Pest Trap, SpyTrooper, Adware Sheriff, SpywareNo, SpyLocked, SpywareQuake, SpyDawn, AntiVirGear, SpyDemolisher, System Security, SpywareStrike, SpyShredder, Alpha Cleaner, SpyMarshal, Adware Alert, Malware Stopper, Mr. Antispy, Spycrush, SpyAxe, MalwareAlarm, VirusBurst, VirusBursters, DIARemover, AntiVirus Gold, Antivirus Golden, SpyFalcon, and TheSpyBot/SpywareBot. The name SpywareBot is used to confuse them with the legitimate SpyBot anti-spyware software.
Remove ads
References
External links
Wikiwand - on
Seamless Wikipedia browsing. On steroids.
Remove ads