SpySheriff is
malware
Malware (a portmanteau for ''malicious software'') is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, depri ...
that
disguises itself as
anti-spyware software. It attempts to mislead the user with false security alerts, threatening them into buying the program.
Like other rogue antiviruses, after producing a list of false
threats, it prompts the user to pay to remove them. The software is particularly difficult to remove,
since it nests its components in System Restore folders, and also blocks some system management tools. However, SpySheriff can be removed by an experienced user,
antivirus software, or by using a rescue disk.
Websites
SpySheriff was hosted at both www.spysheriff.com and www.spy-sheriff.com,
which operated from 2005 until their shutdown in 2008. Both domains are now parked. Several other similarly-named websites also hosted the program, but have all been shut down. Several
typosquatted websites also attempted to automatically install SpySheriff, including a fake version of
Google.com called Goggle.com. From 2015 Goggle.com, which had changed ownership following a lawsuit by Google, hosted a survey scam and displayed links to
Amazon items. In 2017, the domain hosted a blank page, with only the word "goggle" present in its HTML script. At the beginning of 2018, the site redirected to the scam site tango-deg.com and others, but from October 2018 it existed as a simple HTML markup with a top-level heading reading "Goggle.com Inc.". In late 2019, the website became a
WordPress blog about the
2020 United States presidential election
The 2020 United States presidential election was the 59th quadrennial presidential election, held on Tuesday, November 3, 2020. The Democratic ticket of former vice president Joe Biden and the junior U.S. senator from California Kamala Ha ...
. The blog credits itself with accurately predicting the outcome of the election.
Features of a SpySheriff infection
* SpySheriff is designed to behave like genuine antispyware software. Its user interface features a
progress bar and counts allegedly found threats, but its scan results are deliberately false, with cryptic names such as "Trojan VX …" to mislead and scare the user.
* Removal attempts may be unsuccessful and SpySheriff may reinstall itself.
* The desktop background may be replaced with an image resembling a
Blue Screen of Death, or a notice reading, "SPYWARE INFECTION! Your system is infected with spyware. Windows recommends that you use a spyware removal tool to prevent loss of data. Using this PC before having it cleaned of spyware threats is highly discouraged."
* Attempts to remove SpySheriff via
Add or Remove Programs in Control Panel either fails or causes the computer to restart unexpectedly.
* Attempts to connect to the
Internet in any
Web browser is blocked by SpySheriff. Spy-Sheriff.com becomes the only accessible website, and can be opened through the program's control panel.
* Attempts to remove SpySheriff via
System Restore are blocked as it prevents the
calendar
A calendar is a system of organizing days. This is done by giving names to periods of time, typically days, weeks, months and years. A date is the designation of a single and specific day within such a system. A calendar is also a physi ...
and restore points from loading. Users can overcome this by undoing the previous restore operation, after which the system will restore itself, allowing for easier removal of SpySheriff.
* SpySheriff can detect certain antispyware and antivirus programs running on the machine, and disable them by ending their processes as soon as it detects them. This may prevent its detection and removal by legitimate antivirus programs.
* SpySheriff can disable
Task Manager and
Registry Editor, preventing the user from ending its active process or removing its registry entries from Windows. Renaming the 'regedit' and 'taskmgr' executables will solve this problem.
See also
*
Rogue security software
Rogue security software is a form of malicious software and internet fraud that misleads users into believing there is a virus on their computer and aims to convince them to pay for a fake malware removal tool that actually installs malware on ...
*
Trojan horse (computing)
Notes
References
External links
*
* http://www.bleepingcomputer.com/forums/topic22402.html
* https://web.archive.org/web/20120401221555/http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Program%3AWin32%2FSpySheriff
{{DEFAULTSORT:Spysheriff
Windows trojans
Scareware