SpyLocked removal info

June 12th, 2007

Important Notice: Manual SpyLocked spyware removal, although possible, is potentially dangerous to your system if mistakes are made while performing it. Newest and most dangerous parasites are able to repair themselves even after multiple removal attempts. That said, we recommend removing spyware manually only for experienced computer users. For other users, we recommend using automatic spyware removal tools found on www.kiguolis.com

Remove these SpyLocked processes:

spylocked.exe
spylocked 3.6.exe
spylocked 3.7.exe
spylocked 3.9.exe

Remove these SpyLocked DLL files:

antzozc.dll
dxovx.dll
egzcqg.dll
fyxkaah.dll
ilmpjy.dll
kgkdbsk.dll
onwtj.dll
rcohty.dll
xuoce.dll

Remove these SpyLocked Registry files:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\spylocked.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\spylocked 3.6.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\spylocked 3.7.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\spylocked 3.9.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpyLocked
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpyLocked 3.6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpyLocked 3.7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpyLocked 3.9
HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked
HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.6
HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.7
HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{4233AC08-A2C4-4742-A0B4-83719613D62C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{716002DB-288C-4BF0-80CD-A467E78D8B55}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{735E980D-45D2-4777-AF82-9923D3C8D3AE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{B23DC537-3E13-44C7-BF67-D8405EB377F7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{B292EC9F-A074-4115-8342-1F459702D8D2}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{CECA6F2B-247B-4ECE-9B7A-D0135C8036FC}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{DA3B49F6-8C54-4429-A275-21A86DCCA413}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{EDE8BED5-92CF-4482-8F51-A01CD9B3EA37}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{FA4FBF53-C766-4622-8011-A87A805EEBF0}
HKEY_CLASSES_ROOT\TypeLib\{50450F27-B90B-422B-A4C9-5EC5A5B78001}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{735E980D-45D2-4777-AF82-9923D3C8D3AE}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B292EC9F-A074-4115-8342-1F459702D8D2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CECA6F2B-247B-4ECE-9B7A-D0135C8036FC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA3B49F6-8C54-4429-A275-21A86DCCA413}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EDE8BED5-92CF-4482-8F51-A01CD9B3EA37}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA4FBF53-C766-4622-8011-A87A805EEBF0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{05436423-E2DA-4307-AEE4-275C2522D4DD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{062BC936-7CE4-421C-944E-BD388EC91C86}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{17A868CD-C8B9-4A46-8224-85E4D81CD764}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{22F1A770-B823-48D4-8693-B953902A06EF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3037B797-A390-4DCD-BCA6-272815FC4265}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3A7A14FD-7FEC-48CF-A06F-210344DE6E75}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{41E4ADCD-CCC2-4DA0-97C3-83051A4C35F1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4470C18E-1EF2-453C-BEC1-1745D781BCAB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{52BF24CF-8378-42B4-8962-135CFB6C4F77}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{54D2D4FC-914C-432C-B638-599F48D77A08}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{680FA31F-43BC-47DA-9405-A0D1B1C1151B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6EBB57F2-B416-4F76-9384-A8F669FF60E4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6F342C0C-EF49-49E2-B3F1-FE28F193B974}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6F61B413-1DFE-4C4C-8CD4-B97BE0B17504}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{764CE36A-C778-42A8-B3B2-4B09A4B10469}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8262777C-7176-4A9C-A8A6-D0C4AEB467B6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{87EA76C9-411E-44D0-8270-EA2DF3941133}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8AFC508B-6B96-479C-A1AC-848EB3F4EFDE}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8B7E3C69-4A2E-4F48-B690-47BEEEF16FF5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9309BDC4-952B-4146-8303-2FDA3F5B218F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94792C8E-6FE0-462C-9D20-AD560608DDA1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{99EAEF8C-652D-407C-8319-781A2BB30FF7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A392D107-AFBF-4E1B-8092-DB508BC890A5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AD2AA1CD-22FF-4562-A616-1C64A42985BB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3250C2D-C398-4EC9-8A79-85BCF65F6608}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C2D197C9-8570-4AC8-A121-92F9A8CCD857}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CBCCB1D8-AB10-4B4C-9982-A8DEA99F3111}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D237BD03-5808-4B64-942D-6746FE50EE66}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D8CD0D4F-47B6-4499-AF5A-48446972E058}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DEB82BF1-47BB-4863-B85C-77363D3C37D5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAE9695A-B942-4C07-B94F-7CFBE3F35A37}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F198A883-6BCF-4B94-A890-D8ED007FBCF7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{27B1DED9-7493-4204-AFCE-9AFD4B7FC662}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DA226F0-FE43-4F80-A94A-1848039DE0DD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{50450F27-B90B-422B-A4C9-5EC5A5B78001}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 3.6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 3.7

Remove these SpyLocked files:

antzozc.dll
kgkdbsk.dll
onwtj.dll
xuoce.dll
sd.ini
spylocked.exe
egzcqg.dll
fyxkaah.dll
ilmpjy.dll

Automatic remover for
SpyLocked

Read manual removal instructions for SpyLocked When removing spyware such as SpyLocked the course of action to detect and delete processes, registry keys, DLL files and other malicious files from your computer.

Posted in Security, Rogue Anti-Spyware

2 Responses to “SpyLocked”

June 30th, 2007 at 5:21 am SpyLocker Says: […] Spylocker is one more corrupt antispyware tool which name was derived from infamous spylocked antispyware. Some security sites call spylocker as the worst spyware ever. Basically its a fake antispyware tool, it scans your systems and finds lots of infections. This called scare tactics to make user to purchase the program. Spylocker is installed by a trojan zlob. It acts the same as other rogue antispyware products from this family act: users start to get a message which looks like windows notification message and it tells that you are infected with spyware. Slight differences are that this product waits few days after the infection, and then starts to act. Because of that users dont know the exact time they were infected with spylocker. Its possible to remove this parasite manually, but it tries to recreate itself after reboot, so you need to remove all traces of spywarelocker from the system. Automatic remover for SpyLocker Read manual removal instructions for SpyLocker When removing spyware such as SpyLocker the course of action to detect and delete processes, registry keys, DLL files and other malicious files from your computer. […]
January 4th, 2008 at 8:03 am spylocked.exe Says: […] spylocked.exe on kiguolis.com […]

SpyLocked removal info

2 Responses to “SpyLocked”

Leave a Reply

Categories

Latest security news