Sharecash Screenlocker Removal Guide

We have recently stumbled upon a new malicious application that we dubbed Sharecash Screenlocker. We have classified this malicious program as a Trojan and recommend that you remove it from your computer as soon as possible because it can put your computer at great risk. In short, this program is designed to lock your computer, but it is unclear what it wants in return to unlock it. It seems that this program is semi-functional or its command and control (C&C) server is down. Either way, your PC is set to remain locked indefinitely, but you can follow the guide at the end of this description and get rid of it. To find out more about this Trojan, we invite you to read this whole description.

Let us begin our analysis with Sharecash Screenlocker’s distribution methods. We have found that it is currently being distributed in two ways. The first distribution method involves email spam. This program’s dropper file is attached to the malicious email and the text featured in the email should suggest that you open the attachment to view the document referred to in the email as the fake emails try to pass on as legitimate. We have also received information that this Trojan might also be distributed using software downloads that are often used on questionable freeware hosting websites. These downloads are said to download and install this Trojan secretly, so you cannot deselect its installation.

Once on your computer, Sharecash Screenlocker will start doing its dirty work. It will run automatically and kill Windows Explorer (explorer.exe.) As a result, you will not be able to use your computer because explorer.exe is what makes up the Graphical User Interface (GUI.) Instead of seeing your PC’s desktop, this ransomware will present you with a fictitious Windows error that claims that your version of Windows is not genuine. It features a “Click here to get your key” button that, if you click, will open a download button pop-up that redirects to http://fileam.com/pages/dtos{.}php when clicked. It is a scam program that should be set up to extract money from you. However, fortunately for you, it does not work as it is supposed to, which is good news indeed.

Judging from the information featured on http://fileam.com/pages/dtos{.}php, this Trojan should redirect you to a page that features surveys. The surveys could be used to extract personal information, but they may be presented as a means to unlock your computer. We have recently written about a ransomware-type application called Fileice Ransomware that also involves filling out a survey to unlock the computer. Furthermore, the information provided on the site suggests that you may be subjected to commercial advertisements which is alarming since ads presented by unknown programs tend to promote malicious programs. However, the good news is that, like with Fileice Ransomware, you can bypass Sharecash Screenlocker’s lock screen, initiate explorer.exe and eradicate this infection.

In conclusion, Sharecash Screenlocker is a malicious application but it does not damage your computer and the files stored on it. Its purpose it to make you fill out a survey to unlock your PC but it does not function properly. Either way, you should not fill out the survey if it is presented to you as some of its questions may be used to extract personal information. We recommend that you remove Sharecash Screenlocker using the instructions we have provided below. We also suggest scanning your PC with an anti-malware application such as SpyHunter to ensure that your PC is malware-free.

Removal Guide

1. Press Ctrl+Alt+Delete and select Start Task Manager.
2. Click File and click New Task(Run…)
3. Type explorer.exe and click OK.
4. Then press Windows+E keys.
5. Go to C:\Users\{your user name}\AppData\Roaming
6. Find svtres.exe
7. Right-click it and click Delete.
8. Close the window.
9. Then, press Windows+R keys.
10. Type regedit and click OK.
11. Go to KEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
12. Find and delete the registry string named Adobe of which the value data is C:\Users\user\AppData\Roaming\svtres.exe