AntivirusWorld

Name: SpywareNo

Aliases: Trojan.Win32.FakeAlert.a, spysheriff.com, Renos

Type: Spyware (Adware)

Size: 24,576 bytes

First appeared on: 26.05.2005

Damage: Low

Brief Description:
SpywareNo is an adware type malware. It is a fake anti-malware program that warns users of non-existing threats, which can only be deleted after purchasing the full version of the program.

When users buy the full version and register the product, the so-called threats are no longer detected and the computer is supposedly clean.

SpywareNo is installed in the affected computer without user consent. It is automatically downloaded while accessing several adult sites or pirated software websites that contain links to web pages that distribute adware belonging to the CWS family by exploiting vulnerabilities. It can also be downloaded from the web page www. spywareno. com.

Visible Symptoms:

SpywareNo is easy to recognize once it has affected the computer, as it shows the following symptoms:

• An icon belonging to the fake anti-malware program appears on the System Tray:

  SpywareNo! Spyware protection status
  SpywareNo! No protection (extremely dangerous)

• Later on, the following message appears on screen:

  SECURITY WARNING!
  serious security threat detected

  Your computer is infected with Spyware
  Your Security and Privacy are in DANGER

  Spyware programs can steal yuor credit card nymbers and
  bank information details. The computer can be used for sending
  spam and you may get popups with adult or any other
  unwanted content.

  If
  - You have visited adult or warez websites during past 3 days.
  - You homepage has changed and does not change back.
  - Your computer performance has dropped dramatically.
  - You are suspecting someone is watching you
  Then your computer is most likely
  INFECTED WITH SPYWARE

  We are sorry, but the trial version of SpywareNo is
  unable to remove these threats.
  We strongly recommend you to purchase full version.
  You will get 24x7 friendly support and unlimited protection.

• It creates a shortcut link on the Desktop:

Technical description:

SpywareNo creates the following files:

• SPYWARENO.LNK in the Desktop. This file is a shortcut link to the anti-malware program:
• Several files in the subfolder SPYWARENO of the Program Files directory.

SpywareNo creates the following entries in the Windows Registry:

• HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Run
  SpywareNo = %path%\ %file%
  where %path% is the path to the directory where %file%, which is a copy of the adware, has been created.
  By creating this entry, SpywareNo ensures that it is run whenever Windows is started.
• HKEY_CURRENT_USER\ Software\ SpywareNo
  It uses this path in order to store its configuration data.
• HKEY_CURRENT_USER\ Software\ SNO
  Code

  HKEY_CURRENT_USER\ Software\ SNO
  Microsoft Activation

SpywareNo stores certain values in this entries, in order to check if the affected user has already registered it, so that it can stop detecting the non-existing threats.

Propagation:

SpywareNo is installed in the affected computer without user consent.

It is automatically downloaded while accessing several adult sites or pirated software websites that contain links to web pages that distribute adware belonging to the CWS family by exploiting vulnerabilities.

It can also be downloaded from the web page www. spywareno. com.

Removal instruction:
Delete all the files and the entries that SpywareNo has created, mentioned in section "Technical description".