SpySheriff
SpySheriff, also known as Brave Sentry, Pest Trap, SpyTrooper,[1] Spywareno, and MalwareAlarm,[2] is malware that disguises itself as an anti-spyware program. SpySheriff attempts to mislead a user into buying the program by repeatedly informing them of false threats to their system.[3] It is very difficult to remove SpySheriff from machines,[4] since it nests its components in System Restore folders, and also blocks some system management tools. Like all fake antiviruses, SpySheriff asks the user to register when they click <<Remove found threats>>. However, SpySheriff can be removed if the user has anti-malware tools on the machine, or owns a rescue disk.
Websites
SpySheriff used to be hosted at www.spy-sheriff.com[5] from 2005 to late 2008 and is now defunct. [6] Several typosquatted websites have also attempted to automatically install SpySheriff, including a fake version of Google.com (called Goggle.com), and MCreator, a program used to make mods for Minecraft.[citation needed] As of 2015, Goggle.com, which had changed ownership due to a lawsuit by Google, was a survey scam; in addition, MCreator did not install SpySheriff anymore.[citation needed]
Problems caused by SpySheriff
- SpySheriff reports false malware infections and pretends to detect real malware infections.[1][7]
- Attempts to remove SpySheriff have been reported to be unsuccessful as SpySheriff will reinstall itself.
- The desktop background may be replaced with an image resembling a blue screen of death, or a notice reading: "SPYWARE INFECTION! Your system is infected with spyware. Windows recommends that you use a spyware removal tool to prevent loss of data. Using this PC before having it cleaned of spyware threats is highly discouraged."
- Going to add/remove programs to remove SpySheriff either causes the computer to crash or does not remove all components.[8]
- Any attempt to connect to the Internet via a web browser is blocked by SpySheriff, which replaces the user's desktop background with a blue warning screen saying that the system has been stopped to protect the user from spyware. However, you can connect to Spy-Sheriff.com through the program's control panel.
- SpySheriff stops any attempt to do a system restore by causing the calendar and restore points to not load. This causes the user to be unable to revert their computer to an earlier state. A loop hole has been discovered, in that if the user undoes the last restore operation, the system will restore itself, allowing a chance to remove SpySheriff.[8]
- SpySheriff can detect certain running anti-spyware and anti-virus programs and disable them by ending their processes as soon as it detects them, preventing its detection and removal by these programs as long as it is active on the system.
- SpySheriff can disable the taskmgr or regedit tools that a user may attempt to bring up to end its active process or to remove its registry entries from Windows. Renaming the regedit and taskmgr executables will fool it, however.
See also
References
- ↑ 1.0 1.1 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ "www.spysheriff.com". Internet Archive.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 8.0 8.1 Lua error in package.lua at line 80: module 'strict' not found.[dead link]
