SpyLocked Spyware is the Latest SmitFraud Variant

  • Comments: 22
  • Written on: April 10th, 2007

After a quiet spell from the makers of the SmitFraud spyware family, a new variant called SpyLocked has started infecting computers across the Internet.

The infection method for SpyLocked is similar, but there are rumors that the Trojan used to spread the spyware may be exploiting the Animated Cursor Vulnerability to infect and reinfect its victims.

The SpyLocked infection displays a large pop-up when you start your computer as well as repeated alerts as you use your computer that appear to come from the Windows Security Center.

The alerts tell the user that their computer is infected with spyware and that the only way to remove the spyware is to buy the commercial version of SpyLocked. In reality, SpyLocked is the infection and it is what needs to be removed.

Schrock Innovations has posted a Complete SpyLocked Removal Tutorial that does not require you to buy any additional products or services.

  1. Peter Nurney said on April 10th, 2007 at 4:11 pm

    Thanks so much for your help and for posting those excellent step by step instructions.

  2. Jamie said on April 10th, 2007 at 4:30 pm

    Thanks for getting this up so quickly. I really appreciate the fact that you are willing to help people who don’t even live earby. Thanks!

  3. Bill Roeder said on April 10th, 2007 at 6:58 pm

    My daughter has “Spylocked” on her computer at school and is wondering if it is important to get this spyware off as soon as possible or can she go through the steps next week?


  4. Thor Schrock said on April 10th, 2007 at 7:01 pm

    Bill, anytime a computer is infected with malware it is a good idea to get rid of it. In this particular case the computer should suffer no serious damage by putting off the removal until the weekend.

    Bookmark the tutorial site so you can easily find it and you should be good to go when you have the time to work on it. Thanks for visiting and good luck!

  5. Kim said on April 10th, 2007 at 7:31 pm

    We all appreciate your help on so many things. Thank you for quickly returning my call about that online banking email that turned up in my inbox yesterday. It sounded fishy, but it is always nice to have someone that I can ask quickly when I need to.

  6. Josh the Aspie said on April 12th, 2007 at 10:54 am

    In general, any time it seems like Micro$oft is advertising another company’s product, be very very suspicious.

  7. Mike said on April 12th, 2007 at 9:01 pm

    What is Microsoft advertising in this post? This is a spyware infection that afflicts a Microsoft product

  8. djman69 said on April 13th, 2007 at 8:27 am

    I think I have been infected with every single one of these things. I got hit with the spyware sheriff, with spyware falcon, and now I have a new one to worry about. Great!

  9. Tanja said on April 24th, 2007 at 12:09 pm

    I really do need help and I am really frustrated after two days and just everything failed to get rid of spylocked.com.

    My husband caught the virus/trojan on his computer and usually I can call myself as being able to get rid of any virus. But not this one.

    I have followed many instructions. The last one under schrockinnovations.com/removespylocked.php. Did it all. Ran Smitrem. Got stopped. This time the message said “Cannot access Smitfraud.reg. Used SmitFraudFix, no success. Got stopped as it cannot import cleanupreg.

    AVG Anti spyware was already existing on the computer. Plus AVG Free Edition. Avast, AdAware… all the newest versions. Nothing could stop or help to remove the virus.

    None of the logfiles that I should be able to delete do exist. And spylocked.com actually even starts up in safe mode. It’s the first thing that comes up.

    And a friend of mine, a computer specialst even got the same virus, by just looking up links in relation to this virus. We all were well protected and we can’t get rid of the virus/trojan what so ever.

    So what can I do now???? I believe that I caught a new version of spylocked.com. At least I got rid of the pop ups, all that is left is now the question mark and a sign like a stop sign that is leading to spylocked.com. and it always comes up with the message that the computer is invected. Old story, but nothing to remove has helped. And that’s unusual.

  10. rodney long said on May 8th, 2007 at 5:39 am

    Thanks your website helped a lot with the removal of spy lock. I posted on yahoo answers that people should use your website for the removal. The only thing is after all the steps spy lock was not gone but I only had to remove my internet explorer and it worked so thanks.

  11. Floyd Permenter said on May 23rd, 2007 at 2:34 pm

    I am using your DIY to remove Spylocked, and step 1 indicates two tools are required. This section shows on 1 –smitRem. When I followed the remaining steps, I could not find spylocked in the add remove program files window.

    Please help me get rid of this nasty spylocked.

  12. Michael Austin said on June 2nd, 2007 at 8:26 am

    First, I would like to thank you for your website’s information regarding the removal of the SpyLocked infection. Of all the websites found in Google and Yahoo searches, your’s was the most informative and helpful in removing most of the infection on my PC. I’m not sure if the information that I am about to give you will help others, but it appears as though it might, so I’m going to pass it along.

    After following your site’s instructions, there was still an icon in the lower, right-hand taskbar of my desktop (the area for the clock, sound, and network connection). The icon was that of a triangle with an exclaimation mark in the middle and switched to another icon. Upon clicking the icon, it would take me to the SpyLocked website. Of course, I’m sure I shouldn’t have clicked, but I figured I had most of the infection removed.

    This brings me to my next bit of observation. I allow Windows Defender to run in the back ground and scan every Friday morning around 2am. Thankfully, it picked up the remaining bits of the infection and directed me to a file. The file’s location is not part of your information regarding the SpyLocked infection. The particular file I was directed to is:
    I hope by passing this information along, it will allow others to clear their PC of the infection and not have to worry about their information or other data being transmitted across the internet.
    Thank you for taking the time to read this email. Additionally, coming from a web designer, I appreciate the work that your team performs for the general public by making this information available at no charge.

  13. Jmdeur said on June 2nd, 2007 at 8:27 am

    Hello – well, we’d hoped that you procedure would work, but it didn’t. we became suspicious when none of the processes you said to kill were running on our pc – and of course the little flashing icon remained and flashing. we also didn’t find any of the exe or dll files that you said might still be on our machine. other than that, it also took a lot longer that 5 minutes (more like an hour). the only apparent effect was to remove the link to our wallpaper and screwup our aol installation. of course, we can’t complain too much as you didn’t charge us anything (except an hour of our time). if you have any helpful suggestions as to what went wrong, please advise.

  14. Ray said on June 3rd, 2007 at 5:14 am

    I have the same problem with the files listed not being found and I have also spent an hour trying to remove spylock. However I have noticed on the instruction page that only one of the two programs listed in the first step is avalible to download. What should I do from here?

  15. Robert goler said on June 5th, 2007 at 10:07 am

    First, I want to thank you for the complete and easy-to-use instructions on removing SpyLocked spyware. I had the misfortune of finding this on my computer and used your instructions, but have still not gotten rid of the toolbar icon. There are no other signs of the spyware on the computer (programs, files, etc), but that pesky icon does not disappear.

    The only thing I can figure is that I was using Firefox when the computer was infected, so perhaps when I reinstalled that browser the toolbar commands (and other SpyLocked items, too?) were carried forward into the ‘new’ browser. Does that make sense?

    Do you have any other suggestions of what I might do? Is there another browser I should use, or is there a way to eliminate it from Mozilla?

  16. The Andy Man said on June 28th, 2007 at 3:13 pm

    hi I’m in California and today I just went threw your on line tutorial that rids my system of the spyblocker bug. I fallowed it to a tee. except before I found the site (http://www.schrockinnovations.com/removespylocked.php) I had run the uninstall and then deleted the spylocked folder in the program files folder. so I cant uninstall again as the tutorial would like( I even tried reinstalling the spyblocker software just in case. but I get an error haft way threw.). and I’m already running fire fox.. when running in safe mode or normal I don’t find any of the processes that I’m told to end task. also I did get some hits when I searched my system for the word spyblocker and deleted the corresponding files. iv run threw the entire prosecses about five times and the deleted files stayed deleted (no more hits). but at no time did the annoying pop-ups and that phony system shield in the task bar go away. what should I do please help!

    ms windows XP Pro
    Version 2002
    service pack 2

    the invader just calls itself “SPYLOCKED” it matches the screen caps and the description given on the web site given above.

  17. Alan S. Whelpton said on July 3rd, 2007 at 12:08 am

    Nice to meet you, and actually be able to make contact with a useful website.

    This is my problem…
    I have followed your instructions to remove SpyLocked.
    The annoying flashing warning in my taskbar is still there! (I hide it, but it’s still there, darn it!)
    Step 7 didn’t find a single match.
    Step 8 found Spylocked, and I right clicked and deleted it.
    (But the little flasher keeps on a flashin’!)

    I then ran Spybot. It found Spylocked and the Zlob.VideoActiveXObject objects, and this time actually removed ’em (it couldn’t remove Zlob yesterday even after a restart, but apparently it has now.)

    The little flasher keeps going on and on… and on…

    Most appreciated if you could offer further assistance.. please assist your friendly Brit pal haha.

  18. Alan S. Whelpton said on July 3rd, 2007 at 12:09 am

    This might assist you…?
    It must be a process, because although I have hidden it in the toolbar and can’t see the pop-up, it keeps interrupting things, say when I’m typing this for instance. This is obviously whilst it’s attempting to pop up the info.
    Ah well…

  19. Mark Harris said on July 5th, 2007 at 2:24 pm

    I don’t know where to begin but I got caught with the spyware Spylocked. I tried many other free removal tools with instructions included over a period of about 4 weeks.

    I was beginning to think I was going to go the format of the hard drive. Out of desperation I posted my problem on the Windows BBS site and within a couple of hours I had about 15 replies.

    After reading through the responses I noticed one name starting to stick out and that was your removal plan.
    Well guys I have to thank you sincerely.
    I don’t know what prompted you to produce the easy baby steps instructions removal tool
    that anyone could follow.

    I will admit I had my doubts until the very end.
    The flashing Icon has now gone with all its associated problems.

    I am now also using Firefox, what a great product.

  20. Smitfraud said on July 17th, 2008 at 1:34 pm

    Smitfraud is definelty bad stuff. The first time I came across this I had a ton of problems removing it. Now whenever I run into this I do a system restore first then run the free smitfraudfix tool and then run a full scan with Spyware Doctor. If you have Smitfraud I can gurantee you are infected with other threats as well and that is way you need to use other software besides just the smitfraud fix tool.

  21. […] been seeing an increase in customers getting infected with the spylocked spyware infection.  I blogged about it at the […]

  22. […] method imaginable to monetize your own traffic. A great example of this is where I post about a new tutorial that is available on the Schrock Innovations […]

What do you think? Join the discussion...

How do I change my avatar?

Go to gravatar.com and upload your preferred avatar.

Subscribe to My RSS Feed

Subscribe Form Click to Subscribe or

      TwitterCounter for @thorschrock

Ed Wunder Loves Schrock's Service

Popular Posts

Top Commentators

Schrock Innovations' New Ride

Revolution Wraps Rocks!

Geek Squad Hires Anyone!

Other Recent Videos

We're on the Morning Blend answering your Lincoln Nebraska computer repair questions regarding warranties

Need your computer repaired in Omaha? If you're never visited Schrock Innovations before (1st time client), stop by for a FREE hour of repair

Our Open Adoption

    Kim and I are seeking to adopt another child through Open Adoption. If you know of a birth mother seeking a stable, loving family in Nebraska, please direct her to our website at nebraskaopenadoption.com.

Thor's Sponsors

© Thor Schrock 2009