Tech guides

Whether you need removal instructions for a specific virus or just a quick tech tip - here is where you'll find advice from our team of technicians. These guides will reflect the latest security threats and hottest topics on our Antivirus Forum.

 

 

How to remove Adware.SpywareLock.A



THREAT NAME
Adware.SpywareLock.A


CLEAN INSTRUCTIONS

1. Open Task Manager select the rundll32.exe process, right click on it and click on End Process
(this will stop the flashing icon from the system tray and the fake messages).

2. Open Windows Explorer, browse to C:\Windows\System32 folder and delete the rcohty.dll file.

3. Go to Start, Run, type regedit and press OK.


NB: Before you edit the registry, please export the keys that you plan to edit, or create a backup of the system.

4. Navigate to the following registry keys:


HKEY_CLASSES_ROOT\CLSID\

5. Delete the key:


{b23dc537-3e13-44c7-bf67-d8405eb377f7}

6. Navigate to:


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler

7. Delete the key:


{b23dc537-3e13-44c7-bf67-d8405eb377f7}

8. Navigate to:


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall

9. Delete the key:

Windows Safety Alert

10. Restart the computer and run a full scan with BullGuard.

 

SYMPTOMS

1. A fake notification appear telling the user that the system is infected.

 

2. A flashing icon appear on the Taskbar.

 

3. A click on the icon open internet explorer and a connection is established to


https://www.spy{blocked}locked.com


DESCRIPTION
1. When it is executed the malware will create the following registry keys:

HKCLR\CLSID\{b23dc537-3e13-44c7-bf67-d8405eb377f7}


HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{b23dc537-3e13-44c7-bf67-d8405eb377f7}


HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Safety Alert

2. It drops a file named rcohty.dll to Windows system folder and it will execute it (trough rundll32.exe).

 

3. When the dll is loaded it will verify the existance of the key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpywareLocked 3.5

If it is present then it will get the value of DisplayIcon and it will execute it. If it's not present, the dll will show a flashing icon in the system tray and a fake warning message:

"System has detected a number of active spyware applications that may impact the performance of your computer. Click the icon to get rid of unwanted spyware by downloading an up to date antispyware solution."

4. If a user click on the icon then a new internet explorer window appeares and a connection is made to https://www.spy{blocked}locked.com.

5. Also it tries to open a connection to https://kerato{blocked}mir2.biz/

If the connection is successfull, it will download a file and execute it.

 

 

 

Learn more about spyware



Author:
The BullGuard Team

We use cookies to ensure that we give you the best experience on our website. By continuing to browse, we are assuming that you have no objection in accepting cookies. You can change your cookie settings at any time.