SpySheriff (also known as BraveSentry 2.0 among other names) is a malware that disguises itself as anti-spyware software. It attempts to mislead the user with false security alerts, threatening them into buying the program. Like other rogue antiviruses, after producing a list of false threats, it prompts the user to pay to remove them. The software is particularly difficult to remove, since it nests its components in System Restore folders, and also blocks some system management tools. However, SpySheriff can be removed by an experienced user, antivirus software, or by using a rescue disk.

Websites

SpySheriff was hosted at both www.spysheriff.com and www.spy-sheriff.com, which operated from 2005 until their shutdown in 2008. Both domains are now parked. Several other similarly-named websites also hosted the program but have all been shut down.

Features of a SpySheriff infection