Spyware, viruses, & security : New rogue called SpyLocked
- 3/19/07 9:21 PM
New rogue called SpyLocked
by Donna Buenaventura - 3/19/07 9:21 PM
"SpyLocked is the latest in a series of fake anti-spyware, or rogue anti-spyware, programs. These programs are being distributed through sites hosting Zlob Trojans, which are malware that disguises itself as a video or audio codec that you need to download and install in order to use a particular video or audio file. In reality, though, when you install these Trojans, they will instead show fake security alerts and install the SpyLocked program on to your computer.
When SpyLocked is downloaded to your computer by a Zlob trojan, it will automatically start and act as if it is scanning your computer. It will then provide a list of grossly exagerated and fake results including the actual Zlob Trojan that installed it in the first place. It will then prompt you to purchase the full commercial version of the software before you can remove these items. This is a complete scam, and the results are a tactic used to scare you into purchasing their software. Needless to say, do not purchase it. "
More details and How to remove SpyLocked (Removal Instructions) at:
http://www.bleepingcomputer.com/forums/topic85376.html
Here is some more information on SpyLockeed
by IHateMalware - 3/22/07 1:04 AM In reply to: New rogue called SpyLocked by Donna Buenaventura
Heres what others say about SpyLocked
Sunbelt Software
SpyLocked may be marketed by malware that displays false or exaggerated warnings of spyware infection on the desktop to entice users to download the program. SpyLocked typically displays exaggerated or false scan reports of infection to frighten the user into paying for the program since the free version of the program will not perform threat removal.
http://research.sunbelt-software.com/threatdisplay.aspx?name=SpyLocked&threatid=129037
spylocked flashing icon on task bar
by kidmystery - 4/1/07 11:06 AM In reply to: Here is some more information on SpyLockeed by IHateMalwareI deleted every file and registry entry I could find and still had the flashing icon on the task bar. I later located a file named oyopu.dll in the system32 folder. After deleteing this file, the icon went away.
Hope this helps someone else.
I've been spylocked
by dudeonacloud - 4/21/07 11:09 AM In reply to: spylocked flashing icon on task bar by kidmysteryI looked for the oyopu.dll and don't see it...could it be somewhere else?
Could it be "hidden"?
by Carol~ - 4/21/07 4:12 PM
In reply to: I've been spylocked by dudeonacloud
Dude..
If you haven't "unhidden" your files and folders, it could be one reason you're not seeing it.
Click on the Tools menu and select Folder Options.
Click on the View tab.
Under the Hidden files and folders category select Show hidden files and folders.
Uncheck Hide protected operating system files.
Press Apply and then OK
If that doesn't help, it may help to look for it while in Safe Mode. See the second #11 listed halfway down the page at:
http://www.bleepingcomputer.com/forums/topic85376.html
It may help..
Carol
SpyLocked is now detected by freeware RogueRemover
by Donna Buenaventura - 3/26/07 5:02 AM
In reply to: New rogue called SpyLocked by Donna Buenaventura
Users who got SpyLocked can try the above mentioned self-help guides or use RogueRemover (free utility to remove and detect growing number of rogue products)
Download RogueRemover from http://www.malwarebytes.org/rogueremover.php
Donna
by tomron - 3/26/07 5:33 AM In reply to: SpyLocked is now detected by freeware RogueRemover by Donna Buenaventura
I looked in RogueRemover programs targeted drop down menu and it is not listed.Unless it will be listed in an up dated version. 
It's there
by Donna Buenaventura - 3/26/07 5:45 AM
In reply to: Donna by tomron
I personally requested via private message to the author of RogueRemover to kindly include SpyLocked in the detection. His response the other day is.. it will be added and released in next update together with detection with many other rogue products.
Update was released and it includes SpyLocked.
It is there today:
See the post of Roddy in Updates thread today:
http://forums.cnet.com/5208-6132_102-0.html?forumID=32&threadID=240102&messageID=2441529#2441529
See the history:
http://www.malwarebytes.org/rogueremover_database_history.php
"Version 113 (3/25/07)
[Added]
AdwareCleaner, AdwareGuardian, AdwareStopper, AdwareSweep, AdwareSweeper, MalwaresWipeds, PestWiper, SpyContra, SpyLocked, SpywareHound, VirusBlasters, VirusBurst
[Updated]
AntiVermins, Anti-Virus&Spyware, DriveCleaner 2006, MalwareAlarm, MalwareWipe, PestCapture, Rogue.Infector, SystemDoctor 2006, SpyDeface, SpyHeal, Spyware Stormer, Ultimate Cleaner
[Removed]
No applications were delisted.
[Notes]
We have now reached 300 rogue applications detected!"
The database also has SpyLocked in the list:
http://www.malwarebytes.org/database.php
Eureka !!!
by tomron - 3/26/07 5:55 AM In reply to: It's there by Donna Buenaventura
Just as I thought,it needed to be updated,I checked Roddy's post.
Thanx
Here's the ID
by Donna Buenaventura - 3/26/07 5:46 AM
In reply to: Donna by tomron
http://www.malwarebytes.org/database.php?id=306
"Name: SpyLocked
Threat Level: Low
Description:
SpyLocked is a rogue antispyware utility that uses false positives to lure the user into buying the product."
And a screenshot that it is there..
by Donna Buenaventura - 3/26/07 5:51 AM
In reply to: Donna by tomron
Still have a system tray icon with annoying pop-up
by cmrabbu - 3/26/07 8:53 PM In reply to: And a screenshot that it is there.. by Donna Buenaventura
The RogueRemover was successful in removing the last Registry Key that seemed to remain after I thought I had gotten all traces of SpyLocked.
Unfortunately, though I still have an icon in my system tray that toggles between a questions mark and a strike through icon. Annoying "system alert!" pop-ups stem from this icon periodically.
Suggestions on removal? Thanks!!
System Alert pop-up
by Donna Buenaventura - 3/27/07 12:04 AM
In reply to: Still have a system tray icon with annoying pop-up by cmrabbu
Try the self-help guide by BleepingComputer.com at:
http://www.bleepingcomputer.com/forums/topic69886.html
There's automated and manual removal.
If you are not comfortable in using the above, please post a HijackThis log in Bleeping Computer forum and they'll assist you in finding the issue and provide removal.
cmrabbu
by tomron - 3/27/07 6:50 AM In reply to: Still have a system tray icon with annoying pop-up by cmrabbu"RogueRemover was successful in removing the last Registry Key"
I don't understand,are you saying that RogueRemover removes registry keys?
Tom
spylocked icon popup
by wood0454 - 4/27/07 10:57 AM In reply to: Still have a system tray icon with annoying pop-up by cmrabbui just renamed ilmpjy.dll to ilmpjy.bad ( in c:\windows\system32). That did it!
just make sure you can see system and hidden files in tools, folder options,its in system32
| Forum legend: | |
 |
Locked thread |
 |
Moderator |
 |
CNET staff |
 |
Samsung staff |
 |
Norton Authorized Support team |
 |
AVG staff |
 |
Windows Outreach team |
 |
Dell staff |
 |
Intel staff |
