McAfee > Theat Center > PUP Detail Page

Characteristics

Overview -

This is a Potentially Unwanted Program (PUP) detection. It is not a virus or trojan. PUPs are any piece of software which a reasonably security-or privacy-minded computer user may want to be informed of.

Characteristics -

McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. 
If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs

Distribution -

This is not a virus or a trojan. It is detected as a "potentially unwanted program."  This is an anti-spyware application claiming to remove unwanted malicious spyware programs. Upon installation an entry in the registry Run key is created to ensure it is launched at each system startup. In order to clean or delete any elements identified as threats you must enter a valid serial number to activate the software, which requires purchase of the full version.

Privacy

No privacy policy is displayed during installation. However, a policy can be accessed online: http://spylocked.com/privacy.php .

System Changes

General defaults for typical path variables (although they may be different, they usually are not):
%WinDir% = \WINDOWS (Windows 9x/ME/XP), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM32 (Windows 9x/ME/XP), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files
"*" - Denotes files that, though installed along with the software, are by themselves innocent and not included in detection.

Files Added

Installer: sl_setup.exe (3805 KB)
MD5:73A13B4009BE6D9212015590A927C492

• c:\Program Files\SpyLocked 3.9\SpyLocked 3.9.exe
  MD5: 549cb01d2bf4fbfb1f818d0361fa40ac (2520 KB)
• C:\Program Files\SpyLocked 3.9\uninst.exe (41 KB)
• c:\Program Files\SpyLocked 3.9\msvcp71.dll* (488 KB)
• c:\Program Files\SpyLocked 3.9\msvcr71.dll* (340 KB)
• c:\Program Files\SpyLocked 3.9\sl.dat (1365 KB)
• c:\Program Files\SpyLocked 3.9\blacklist.txt (50 KB)
• c:\Program Files\SpyLocked 3.9\Lang\english.ini (32 KB)
• c:\Program Files\SpyLocked 3.9\SpyLocked 3.9.url (1 KB)
• c:\Documents and Settings\all users\Start Menu\SpyLocked 3.9.lnk (1 KB)
• c:\Documents and Settings\all users\Start Menu\Programs\SpyLocked 3.9\SpyLocked 3.9 Website.lnk (1 KB)
• c:\Documents and Settings\all users\Start Menu\Programs\SpyLocked 3.9\SpyLocked 3.9.lnk (1 KB)
• c:\Documents and Settings\all users\Start Menu\Programs\SpyLocked 3.9\Uninstall SpyLocked 3.9.lnk (1 KB)
• c:\Documents and Settings\ (username)\Desktop\SpyLocked 3.9.lnk (1 KB)
• c:\Documents and Settings\(username)\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyLocked 3.9.lnk (1 KB)

Registry

The following registry keys are created:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "SpyLocked 3.9"
• HKEY_LOCAL_MACHINE\SOFTWARE\SpyLocked 3.9
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyLocked 3.9
• HKEY_CLASSES_ROOT\CLSID\{D06E2EAE-1922-4A0B-6A7C-8D9E3DE0E708}
• HKEY_CLASSES_ROOT\Interface\{05436423-E2DA-4307-AEE4-275C2522D4DD}
• HKEY_CLASSES_ROOT\Interface\{17A868CD-C8B9-4A46-8224-85E4D81CD764}
• HKEY_CLASSES_ROOT\Interface\{3037B797-A390-4DCD-BCA6-272815FC4265}
• HKEY_CLASSES_ROOT\Interface\{4470C18E-1EF2-453C-BEC1-1745D781BCAB}
• HKEY_CLASSES_ROOT\Interface\{52BF24CF-8378-42B4-8962-135CFB6C4F77}
• HKEY_CLASSES_ROOT\Interface\{680FA31F-43BC-47DA-9405-A0D1B1C1151B}
• HKEY_CLASSES_ROOT\Interface\{6EBB57F2-B416-4F76-9384-A8F669FF60E4}
• HKEY_CLASSES_ROOT\Interface\{8262777C-7176-4A9C-A8A6-D0C4AEB467B6}
• HKEY_CLASSES_ROOT\Interface\{8AFC508B-6B96-479C-A1AC-848EB3F4EFDE}
• HKEY_CLASSES_ROOT\Interface\{8B7E3C69-4A2E-4F48-B690-47BEEEF16FF5}
• HKEY_CLASSES_ROOT\Interface\{9309BDC4-952B-4146-8303-2FDA3F5B218F}
• HKEY_CLASSES_ROOT\Interface\{B3250C2D-C398-4EC9-8A79-85BCF65F6608}
• HKEY_CLASSES_ROOT\Interface\{D237BD03-5808-4B64-942D-6746FE50EE66}
• HKEY_CLASSES_ROOT\Interface\{D8CD0D4F-47B6-4499-AF5A-48446972E058}
• HKEY_CLASSES_ROOT\Interface\{DEB82BF1-47BB-4863-B85C-77363D3C37D5}
• HKEY_CLASSES_ROOT\Interface\{EAE9695A-B942-4C07-B94F-7CFBE3F35A37}
• HKEY_CLASSES_ROOT\TypeLib\{27B1DED9-7493-4204-AFCE-9AFD4B7FC662}

Network Impact

Possible additional overhead in bandwidth due to download of updates or other components/software.

Removal

Aliases

Aliases

• FraudTool.Win32.SpyLocked.b (Kaspersky)
• SpyLocked (Symantec)