Friday, November 14, 2008

SpySheriff Trojan

How To Remove SpySheriff?
You must download trial version of "Exterminate-It" antivirus software,to check your computer instantly.
SpySheriff is dangerous virus:
This loose category includes a variety of Trojans that damage victim machines or
threaten data integrity, or impair the functioning of the victim machine.

Multi-purpose Trojans are also included in this group, as some virus writers
create multi-functional Trojans rather than Trojan packs.
Adware are programs that facilitate delivery for advertising content
to the user and in some cases gather information from the user's computer,
including information related to Internet browser usage or other computer habits
A cryptovirus, cryptotrojan or cryptoworm is a type of
malware that encrypts the data belonging to an individual on a computer,
demanding a ransom for its restoration.

The term ransomware is commonly used to describe such software,
although the field known as cryptovirology predates the term "ransomware".

This type of ransom attack can be accomplished by (for example) attaching
a specially crafted file/program to an e-mail message and sending this to the victim.

If the victim opens/executes the attachment, the program encrypts
a number of files on the victim's computer. A ransom note is then left behind for the victim.

The victim will be unable to open the encrypted files without the correct decryption key.
Once the ransom demanded in the ransom note is paid, the cracker may (or may not)
send the decryption key, enabling decryption of the "kidnapped" files.


SpySheriff Symptoms:

Files:
[%APPDATA%]\Install.dat
[%DESKTOP%]\SpySheriff.lnk
[%PROGRAM_FILES%]\PestTrap\base.avd
[%PROGRAM_FILES%]\PestTrap\base001.avd
[%PROGRAM_FILES%]\PestTrap\heur002.dll
[%PROGRAM_FILES%]\SpySheriff\base001.avd
[%SYSTEM%]\service.exe
[%WINDOWS%]\Downloaded Program Files\UWAS6_0001_N69M0903NetInstaller.exe
[%PROFILE%]\cmd.exe
[%PROFILE%]\start
[%PROGRAMS%]\SpySheriff\SpySheriff.lnk
[%PROGRAM_FILES%]\SpySheriff\base.avd
[%PROGRAM_FILES%]\SpySheriff\base002.avd
[%PROGRAM_FILES%]\SpySheriff\found.wav
[%PROGRAM_FILES%]\SpySheriff\heur000.dll
[%PROGRAM_FILES%]\SpySheriff\heur001.dll
[%PROGRAM_FILES%]\SpySheriff\heur002.dll
[%PROGRAM_FILES%]\SpySheriff\heur003.dll
[%PROGRAM_FILES%]\SpySheriff\notfound.wav
[%PROGRAM_FILES%]\SpySheriff\removed.wav
[%PROGRAM_FILES%]\SpySheriff\SpySheriff.dvm
[%PROGRAM_FILES%]\SpySheriff\SpySheriff.exe
[%PROGRAM_FILES%]\SpySheriff\Uninstall.exe
[%WINDOWS%]\desktop.html
[%DESKTOP%]\spysheriff.lnk
[%APPDATA%]\Install.dat
[%DESKTOP%]\SpySheriff.lnk
[%PROGRAM_FILES%]\PestTrap\base.avd
[%PROGRAM_FILES%]\PestTrap\base001.avd
[%PROGRAM_FILES%]\PestTrap\heur002.dll
[%PROGRAM_FILES%]\SpySheriff\base001.avd
[%SYSTEM%]\service.exe
[%WINDOWS%]\Downloaded Program Files\UWAS6_0001_N69M0903NetInstaller.exe
[%PROFILE%]\cmd.exe
[%PROFILE%]\start
[%PROGRAMS%]\SpySheriff\SpySheriff.lnk
[%PROGRAM_FILES%]\SpySheriff\base.avd
[%PROGRAM_FILES%]\SpySheriff\base002.avd
[%PROGRAM_FILES%]\SpySheriff\found.wav
[%PROGRAM_FILES%]\SpySheriff\heur000.dll
[%PROGRAM_FILES%]\SpySheriff\heur001.dll
[%PROGRAM_FILES%]\SpySheriff\heur002.dll
[%PROGRAM_FILES%]\SpySheriff\heur003.dll
[%PROGRAM_FILES%]\SpySheriff\notfound.wav
[%PROGRAM_FILES%]\SpySheriff\removed.wav
[%PROGRAM_FILES%]\SpySheriff\SpySheriff.dvm
[%PROGRAM_FILES%]\SpySheriff\SpySheriff.exe
[%PROGRAM_FILES%]\SpySheriff\Uninstall.exe
[%WINDOWS%]\desktop.html
[%DESKTOP%]\spysheriff.lnk

Folders:
[%PROGRAMS%]\SpySheriff
[%PROGRAM_FILES%]\spysheriff
[%PROGRAM_FILES%]\Daily Weather Forecast
[%PROGRAMS%]\spysheriff

Registry Keys:
HKEY_CLASSES_ROOT\clsid\{202b0efd-2cb9-039b-2b11-a3579d6d56a3}
HKEY_CLASSES_ROOT\clsid\{7c43e35c-a398-7c5f-b1ba-7e87073be150}
HKEY_CLASSES_ROOT\clsid\{9cb4ce93-8cc7-9e03-1037-2dd837e3a52e}
HKEY_CURRENT_USER\Software\SNO2
HKEY_CURRENT_USER\SOFTWARE\SpySheriff
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spy sheriff
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\menuorder\start menu2\programs\spysheiff
HKEY_CURRENT_USER\software\sno2
HKEY_CURRENT_USER\software\spysheriff
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spysheriff

Registry Values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run


You must clean you computer ASAP !!!
Download Free Trial Version of antivirus software here, to check your computer instantly.

Also Be Aware of the Following Threats:
TrojanSpy.Win32.VB.am Trojan Cleaner
Remove Vxidl.AIA Trojan
Win32.Afrootix Trojan Removal instruction
Fox RAT Information
ICQ99.War.Suite Trojan Information

No comments: