BlockKeeper Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCartCart

BlockKeeper, also known as Block Keeper, is another rogue program from the malicious WiniGuard family of rogue anti-spyware applications. The WiniGuard family includes fake security programs like SoftBarrier, SoftCop, Trust Soldier, Safe Fighter and others. BlockKeeper penetrates computer systems with the help of a Trojan or other malware. BlockKeeper will run a scan and display fake virus alerts once it has entered a machine. BlockKeeper is neither capable of detecting nor removing malware from a machine. A legitimate security tool may be used to completely remove BlockKeeper and its related files.

Type: Rogue AntiSpyware Programs

How Can You Detect BlockKeeper?

BlockKeeper Technical Report

As new BlockKeeper details are reported by our customers and findings from our Threat Research Center, we will update this section.

Author of BlockKeeper:

• Unknown

The following BlockKeeper files with its MD5s were created in the system:

BlockKeeper has typically the following processes in memory:

• %WINDOWS%\10068tro9zd85.exe
• %WINDOWS%\system32\1a605tzal32359.dll
• %Program Files%\BlockKeeper Software\BlockKeeper\BlockKeeper.exe
• %WINDOWS%\system32\19z89s5y663.dll
• %Temp%\yxh5.tmp.exe
• %WINDOWS%\10518virzs5f9.ocx
• BlockKeeper.exe

BlockKeeper created the following directories, files, paths:

• %ProgramFiles%\BlockKeeper Software\BlockKeeper
• %AllUsersProfile%\Start Menu\Programs\BlockKeeper

BlockKeeper creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BlockKeeper
• HKEY_LOCAL_MACHINE\SOFTWARE\BlockKeeper
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “yxh5.tmp.exe”
• HKEY_CURRENT_USER\Software\BlockKeeper
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run“BlockKeeper”

Important Article Disclaimer