We use cookies to ensure that we give you the best experience on our website. By continuing to browse, we are assuming that you have no objection in accepting cookies. You can change your cookie settings at any time.

Close

BullGuard Support

We’re here 24/7 to help you.


Email our support team and we'll get back to you within 24 hours.


 

 

How to remove Adware.SpywareLock.A



THREAT NAME
Adware.SpywareLock.A


CLEAN INSTRUCTIONS

1. Open Task Manager select the rundll32.exe process, right click on it and click on End Process
(this will stop the flashing icon from the system tray and the fake messages).

2. Open Windows Explorer, browse to C:\Windows\System32 folder and delete the rcohty.dll file.

3. Go to Start, Run, type regedit and press OK.


NB: Before you edit the registry, please export the keys that you plan to edit, or create a backup of the system.

4. Navigate to the following registry keys:


HKEY_CLASSES_ROOT\CLSID\

5. Delete the key:


{b23dc537-3e13-44c7-bf67-d8405eb377f7}

6. Navigate to:


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler

7. Delete the key:


{b23dc537-3e13-44c7-bf67-d8405eb377f7}

8. Navigate to:


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall

9. Delete the key:

Windows Safety Alert

10. Restart the computer and run a full scan with BullGuard.

 

SYMPTOMS

1. A fake notification appear telling the user that the system is infected.

 

2. A flashing icon appear on the Taskbar.

 

3. A click on the icon open internet explorer and a connection is established to


http://www.spy{blocked}locked.com


DESCRIPTION
1. When it is executed the malware will create the following registry keys:

HKCLR\CLSID\{b23dc537-3e13-44c7-bf67-d8405eb377f7}


HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{b23dc537-3e13-44c7-bf67-d8405eb377f7}


HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Safety Alert

2. It drops a file named rcohty.dll to Windows system folder and it will execute it (trough rundll32.exe).

 

3. When the dll is loaded it will verify the existance of the key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked 3.5

If it is present then it will get the value of DisplayIcon and it will execute it. If it's not present, the dll will show a flashing icon in the system tray and a fake warning message:

"System has detected a number of active spyware applications that may impact the performance of your computer. Click the icon to get rid of unwanted spyware by downloading an up to date antispyware solution."

4. If a user click on the icon then a new internet explorer window appeares and a connection is made to http://www.spy{blocked}locked.com.

5. Also it tries to open a connection to http://kerato{blocked}mir2.biz/

If the connection is successfull, it will download a file and execute it.

 

 

 

Learn more about spyware



Author:
The BullGuard Team



00: 00: 00: 00
Days Hours Minutes Seconds
Close