This article may need to be rewritten entirely to comply with Wikipedia's quality standards. You can help. The discussion page may contain suggestions. (July 2007)

This article is in need of attention from an expert on the subject. WikiProject Computer Security or the Computer Security Portal may be able to help recruit one. (February 2009)

SpyLocked, also known as SpywareLocked, is rogue software that seeks to trick the user into purchasing its full rogue version. SpyLocked issues false security messages alleging that the user's computer is infected with malicious spyware. Once installed, SpyLocked may be very difficult to remove and may re-install itself after partial removal.

Contents 1 Information 2 Infection 3 Alleged Description 4 General malicious characteristics and behavior 5 Problems caused by SpyLocked 6 Variants 7 Removal 8 Notes and references

[edit] Information

SpyLocked is a rogue security program that provides limited protection against spyware. It alerts users of false positives during spyware scans, as to goad them into purchase of the upgrade. SpyLocked's scans have also been shown to have a low accuracy, and to exaggerate low level threats as critical threats. The trial version will not remove these threats, and in order to do so the full version must be purchased.

[edit] Infection

SpyLocked's method of infection is similar to the delivery methods of all other rogue anti-spyware programs. SpyLocked can infect a computer through web browser security holes, downloading and installing itself through Zlob Trojan horses Infection.

[edit] Alleged Description

SpyLocked's creator describes SpyLocked as follows:

“

Every PC owner has valuable and confidential personal information stored on his/her computer. This can include credit card and banking details, private e-mails and documents, shopping and browsing habits, etc. All this information should be protected from software intruders snooping. Are you sure your PC is protected? Do you want to know whether it is infected or clean? Use SpyLocked scanner and check your PC now. In order to avoid detection, names of adware and spyware are often changed but their content remains the same. SpyLocked's high quality spyware detection and removal engine finds even the most artful infections and removes them quickly and effectively.

”

[edit] General malicious characteristics and behavior

Some problems encountered with SpyLocked are:

• Poor scan reporting.
• False detection and misleading results.
• Deceptive advertising within application
• Fake critical infection alerts
• Self-updating

[edit] Problems caused by SpyLocked

Once inside the computer, SpyLocked may cause a variety of problems to the owner of the computer. Symptoms are obvious: popups, false system alerts in the system tray, and a noticeably slower computer. What are less obvious are the activities the software executes within the system. These trojans can steal personal information. These type of trojan have been known to steal bank account numbers, credit card information, home addresses , dial 1-900 numbers on your money, and much more.

• SpyLocked may generate excessive advertisements and bombard the computer screen with unwanted pop-ups.
• The infected computer may show an icon on the system tray adjacent to the system clock. Clicking the icon will take the user to a rogue anti-spyware site. Even if the message is not clicked, it will intermittently show a message similar to:

"The system has detected a number of active spyware applications that may impact on the performance of your computer. Click the icon to get rid of unwanted spyware by downloading an up-to-date anti-spyware solution."

• SpyLocked may not allow the user to uninstall it by using Add/Remove function and may recreate itself every time the user tries to remove it manually. Additionally, trying to remove it manually may even lead to a system crash. SpyLocked will deliver fake security messages that user's computer is infected with spyware in order to promote its alleged rogue anti-spyware product.
• SpyLocked may run as a number of different processes including 'isamain.exe', ismain.exe' and 'isamntr.exe' These processes usually can not be terminated individually (however, they can be removed using the 'End Process Tree' option on the Windows Task Manager) as they often restart themselves.
• SpyLocked may block the access to some websites for its purpose to prevent the user from downloading legitimate anti-spyware programs.

[edit] Variants

SpyLocked is known to be associated with such rogue anti-spyware programs as Spydawn, SpySheriff, SpywareQuake, VirusBurst, and VirusLocker. These programs share similar interface with the mentioned anti-spyware applications and have the same deceptive intentions.

[edit] Removal

Free tool to Remove Spylocked at CNET

[edit] Notes and references

• “SpyLocked” by Sunbelt Software