Do you know what Sharecash Screenlocker is?
According to our researchers, Sharecash Screenlocker is a malicious application set to lock your computer’s screen. Judging from how it works, we have classified it as a Trojan and recommend that you remove it from your computer before it causes damage. From the look of things, this application is not functioning as it should, because it is supposed to provide the victim with a survey to fill out in order to unlock the PC, but it does not do that. This infection does not demand money because it seems that it was designed to force you to fill out a survey provided by a third party to make money for this Trojan’s developer. Please read this whole article to find out more.
Our research has revealed that this application is currently being distributed using two methods. The first method used to infect your computer is email spam. Researchers say that this infection’s dropper file is sent in emails from a dedicated server. The emails pose as legitimate and encourage you to open the attached file to see whatever it is they want you to see. The infection occurs when you open the malicious attachment as the dropper file can be a JavaScript file that runs a malicious script and injects this Trojan secretly. The second method used involves bundling Sharecash Screenlocker with software downloaders featured on questionable software distributing websites. These downloaders have to be downloaded and installed, and then they are supposed to download the software you wanted to get. Hence, in addition to downloading and installing the main application, they will also download and install Sharecash Screenlocker. Now that we know how it is most likely distributed let us take a look at how it works.
Sharecash Screenlocker screenshot
Scroll down for full removal instructions
Once Sharecash Screenlocker is on your computer, it will kill of explorer.exe (Windows Explorer) and render a fake error window that claims that your version of Windows is not genuine and that you can either enter the key into the dialog box and activate them or click “Click here to get your key” message. If you click “Click here to get your key,” then this Trojan will open a pop-up window that says that your file is ready to download, but it does not work. Instead, it will redirect you to Fileam.com/pages/dtos[.]php. This website is supposed to show you a survey or allow you to select a survey to fill out, but it instead shows the Terms of Service page that says that “ShareCash LLC takes no liability for the content of the surveys or advertising offers you may encounter while attempting to download the file.” As you can see, this application can also show ads, but currently, it shows no ads since it is not functioning properly. Regardless, Sharecash Screenlocker is bad news, and it will prevent you from using your computer if you do not do something about it. Our malware researchers will say that you delete this Trojan manually, but you must first start explorer.exe which you can do from Task Manager.
In summary, Sharecash Screenlocker is a Trojan-type infection whose primary objective is to secretly infect your computer, kill Windows Explorer, and force you to fill out a survey supplied by a third party. However, this application does not work properly, so you will not get to see any surveys, but your computer will remain locked nonetheless. If you want to remove this malicious application, please follow the instructions provided below this article.
How to remove Sharecash Screenlocker
- Hold down Ctrl+Alt+Delete and select Start Task Manager.
- Click File and click New Task(Run…)
- Enter explorer.exe and click OK.
- Then press Win+E keys.
- Go to C:\Users\{User name}\AppData\Roaming
- Find svtres.exe
- Right-click it and click Delete.
- Close the window.
Delete the registry string
- Press Win+R keys.
- Type regedit and click OK.
- Go to KEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Locate the registry string named Adobe with value data C:\Users\{User name}\AppData\Roaming\svtres.exe and delete it.
In non-techie terms:
Malware researchers say that Sharecash Screenlocker is a Trojan0type infection whose main objective is to kill Windows Explorer and show you a fake error message claiming that your version of Windows is not genuine. By doing so it locks your computer’s screen and it should redirect you to a window that features surveys and ads, but does not at the moment because it is semi-functional due to unknown reasons. Nevertheless, we recommend that you remove it as soon as you can.