SpySheriff

SpySheriff
Technical name
  • SpySheriff Variant
    • Adware.SpySheriff (Symantec)
    • Rogue:W32/SpySheriff(F-Secure)
    • Adware/SpySheriff.[Letter](Fortiguard)
    • Adware-SpySheriff(McAfee)
    • ADW_SPYSHERIFF.[Letter] (Trend Micro)
    • DOWNLOADER_SPYSHERIFF (Trend Micro)
    • FREELOADER_SPYSHERIFF (Trend Micro)
  • BraveSentry Variant
    • Rogue:W32/BraveSentry (F-Secure)
    • VBS_SENTRY.[Letter] (Trend Micro)
    • ADW_BRAVESEN.[Letter] (Trend Micro)
  • Pest Trap Variant
SpySheriff interface
Alias
  • SpyDawn Variant
    • FraudTool.Win32.SpyHeal.a (Sophos)
  • Alpha Cleaner Variant
  • SpyBouncer Variant
    • Trojan:Win32/Spybouncer (Microsoft)
TypeMalware
SubtypeRogue Software
AuthorsInnovagest 2000
Technical details
PlatformWindows
Discontinued2008

SpySheriff (also known as BraveSentry 2.0, among other names) is malware that disguises itself as anti-spyware software. It attempts to mislead the user with false security alerts, threatening them into buying the program. Like other rogue antiviruses, after producing a list of false threats, it prompts the user to pay to remove them. The software is particularly difficult to remove, since it nests its components in System Restore folders, and also blocks some system management tools. However, SpySheriff can be removed by an experienced user, antivirus software, or by using a rescue disk.