BlockScanner Description

 

 

[+] Click Image to Enlarge

 

 

CartCartCartCart

BlockScanner is a rogue security applicaiton and successor to its variants known as BlockWatcher, SoftBarrier and ShieldSafeness. BlockScanner is the latest rogue within this group which poses as a legitimate security program. BlockWatcher acts as spyware removal software or a registry repair utility but in fact floods the desktop of an infected system with false system errors and critical spyware infections warnings. Most of BlockScanner’s spyware tools uses Trojan Zlob or Vundo Trojan horses to persuade computer users to download a free trial program. BlockScanner uses a fake scanner to generate exaggerated spyware results which are false positives. BlockScanner should not be given the leeway to mislead the computer user and must be removed immediately.

Type: Rogue AntiSpyware Programs

Automatic Detection of BlockScanner

BlockScanner Technical Report

As new BlockScanner details are reported by our customers and findings from our Threat Research Center, we will update this section.

Fake message for BlockScanner:

The following fake error message(s) appears for BlockScanner:

‘Spyware Alert!
Your computer is infected with spyware. It could damage your critical files or expose your private data on the Internet. Click
here to register your copy of BlockScanner and remove
spyware threats from your PC’.

The following BlockScanner files with its MD5s were created in the system:

BlockScanner has typically the following processes in memory:

• uninstall.exe
• 111249acztool1ef5.exe
• C:\Program Files\BlockScanner Software\BlockScanner\uninstall.exe
• 1649zt5oj447.exe
• %WINDOWS%\system32\16624s5y1z9.dll
• C:\Program Files\BlockScanner Software\BlockScanner\BlockScanner.exe
• BlockScanner.exe
• vwc4.tmp.exe

BlockScanner created the following directories, files, paths:

• %ProgramFiles%\BlockScanner Software\BlockScanner
• %AllUsersProfile%\Start Menu\Programs\BlockScanner

BlockScanner creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\BlockScanner
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BlockScanner
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BlockScanner
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “vwc4.tmp.exe”
• HKEY_CURRENT_USER\SOFTWARE\BlockScanner

Important Article Disclaimer