What is Magic Pc Cleaner?
The Malwarebytes research team has determined that Magic Pc Cleaner is a "system optimizer". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.
How do I know if I am infected with Magic Pc Cleaner?
This is how the main screen of the sytem optimizer looks:
You will find these icons in your taskbar and on your desktop:
and see these warnings during "operations":
You may see this entry in your list of installed programs:
and this Scheduled Task:
How did Magic Pc Cleaner get on my computer?
These so-called system optimizers use different methods of getting installed. This particular one was downloaded from their site.
How do I remove Magic Pc Cleaner?
Our program Malwarebytes can detect and remove this potentially unwanted application.
- Please download Malwarebytes to your desktop.
- Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
- Then click Finish.
- Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
- If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
- When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
- Restart your computer when prompted to do so.
- No, Malwarebytes removes Magic Pc Cleaner completely.
- This PUP creates a scheduled task. You can read here how to check for and, if necessary, remove Scheduled Tasks.
We hope our application and this guide have helped you eradicate this system optimizer.
As you can see below the full version of Malwarebytes would have protected you against the Magic Pc Cleaner installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.
and we block access to their domains.
Technical details for experts
You may see these entries in FRST logs:
() C:\Program Files (x86)\SystemOptimizer\MagicPcCleaner.exe () C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\MagicPcCleaner.exe InternetURL: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemCleaner.url -> file:///C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\MagicPcCleaner.exe C:\Users\{username}\AppData\Local\MagicPcCleaner C:\Users\Public\Desktop\Magic PC Cleaner.lnk C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Magic Pc Cleaner C:\Program Files (x86)\Magic Pc Cleaner (Magic Pc Cleaner) C:\Users\{username}\Desktop\MPCSetup.exe C:\Windows\System32\Tasks\Microsoft Essentials C:\Users\{username}\AppData\Roaming\Magic Pc Cleaner C:\Program Files (x86)\SystemOptimizer Magic Pc Cleaner (HKLM-x32\...\{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}) (Version: 1.0.0 - Magic Pc Cleaner) Task: {5E313F6C-5A9D-46F4-BDA7-8A7358B73F91} - System32\Tasks\Microsoft Essentials => C:\Program Files (x86)\SystemOptimizer\MagicPcCleaner.exe [2017-05-04] ()Alterations made by the installer:
File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner Adds the file MagicPcCleaner.exe"="4/22/2017 11:28 PM, 2603168 bytes, A Adds the file MagicPcCleaner.exe.config"="2/28/2017 8:06 AM, 4371 bytes, A Adds the file Telerik.WinControls.dll"="5/3/2016 8:24 PM, 2840064 bytes, A Adds the file Telerik.WinControls.Themes.HighContrastBlack.dll"="5/3/2016 8:25 PM, 220160 bytes, A Adds the file Telerik.WinControls.UI.dll"="5/3/2016 8:25 PM, 4663296 bytes, A Adds the file TelerikCommon.dll"="5/3/2016 8:24 PM, 340480 bytes, A Adds the file Trial.dll"="4/22/2017 11:30 PM, 609440 bytes, A Adds the file UtilityInfo.xml"="5/10/2017 8:11 AM, 429 bytes, A Adds the folder C:\Program Files (x86)\SystemOptimizer Adds the file GuidInfo.xml"="5/10/2017 8:00 AM, 140 bytes, A Adds the file MagicPcCleaner.exe"="5/4/2017 12:04 PM, 5899752 bytes, A Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Magic Pc Cleaner Adds the file Magic PC Cleaner.lnk"="5/10/2017 8:01 AM, 2154 bytes, A Adds the folder C:\Users\{username}\AppData\Local\MagicPcCleaner\MagicPcCleaner.exe_Url_c555nk35rwj3gbeq3ywwn5witprathsd\1.0.0.0 Adds the file user.config"="5/10/2017 8:11 AM, 2549 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\Magic Pc Cleaner\Magic Pc Cleaner 1.0.0\install In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup Adds the file SystemCleaner.url"="5/10/2017 8:11 AM, 208 bytes, A In the existing folder C:\Users\{username}\Desktop Adds the file MPCSetup.exe"="5/10/2017 8:00 AM, 8673600 bytes, A In the existing folder C:\Users\Public\Desktop Adds the file Magic PC Cleaner.lnk"="5/10/2017 8:01 AM, 2136 bytes, A In the existing folder C:\Windows\System32\Tasks Adds the file Microsoft Essentials"="5/10/2017 8:00 AM, 3282 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A4E49A4-F3DC-812D-C381-9A605CC1AA3A}\2552459366] "(Default)"="REG_SZ", "HYNFYFZ45E54G" "{7A4E49A4-F3DC-812D-C381-9A605CC1AA3A}"="REG_SZ", "RX5VQYX9TK8S" "2552459366"="REG_SZ", "E6NFYFZ45E54G" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22235BA8-0905-B68E-A5A7-0A4D737428CC}\2825635452] "(Default)"="REG_SZ", "RYO4bmh3PwN" "{22235BA8-0905-B68E-A5A7-0A4D737428CC}"="REG_SZ", "Sc62" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files (x86)\Magic Pc Cleaner\"="REG_SZ", "" "C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\"="REG_SZ", "" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Magic Pc Cleaner\"="REG_SZ", "1" "C:\Windows\Installer\{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}\"="REG_SZ", "" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Caphyon\Advanced Installer\LZMA\{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}\1.0.0] "AI_ExePath"="REG_SZ", "C:\Users\{username}\Desktop\MPCSetup.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Magic Pc Cleaner\Magic Pc Cleaner] "Path"="REG_SZ", "C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\" "RegistrationDate"="REG_SZ", "" "Version"="REG_SZ", "1.0.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}] "AuthorizedCDFPrefix"="REG_SZ", "" "Comments"="REG_SZ", "This installer database contains the logic and data required to install Magic Pc Cleaner." "Contact"="REG_SZ", "www.magic-pc-cleaner.com" "DisplayName"="REG_SZ", "Magic Pc Cleaner" "DisplayVersion"="REG_SZ", "1.0.0" "EstimatedSize"="REG_DWORD", 11023 "HelpLink"="REG_EXPAND_SZ, "www.magic-pc-cleaner.com" "HelpTelephone"="REG_SZ", "" "InstallDate"="REG_SZ", "20170510" "InstallLocation"="REG_SZ", "C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\" "InstallSource"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Magic Pc Cleaner\Magic Pc Cleaner 1.0.0\install\" "Language"="REG_DWORD", 1033 "ModifyPath"="REG_EXPAND_SZ, "MsiExec.exe /I{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}" "Publisher"="REG_SZ", "Magic Pc Cleaner" "Readme"="REG_SZ", "" "Size"="REG_SZ", "" "UninstallString"="REG_EXPAND_SZ, "MsiExec.exe /I{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}" "URLInfoAbout"="REG_SZ", "www.magic-pc-cleaner.com" "URLUpdateInfo"="REG_SZ", "www.magic-pc-cleaner.com" "Version"="REG_DWORD", 16777216 "VersionMajor"="REG_DWORD", 1 "VersionMinor"="REG_DWORD", 0 "WindowsInstaller"="REG_DWORD", 1 [HKEY_USERS\.DEFAULT\Software\Classes\CLSID\{7A4E49A4-F3DC-812D-C381-9A605CC1AA3A}\2552459366] "(Default)"="REG_SZ", "HYNFYFZ45E54G" "{7A4E49A4-F3DC-812D-C381-9A605CC1AA3A}"="REG_SZ", "RX5VQYX9TKWS" "2552459366"="REG_SZ", "HYNFYFZ45E54G" [HKEY_USERS\.DEFAULT\Software\Classes\Interface\{22235BA8-0905-B68E-A5A7-0A4D737428CC}\2825635452] "(Default)"="REG_SZ", "RYO4bmh3PwN" "{22235BA8-0905-B68E-A5A7-0A4D737428CC}"="REG_SZ", "Sc62" [HKEY_CURRENT_USER\Software\Classes\Wow6432Node\CLSID\{7A4E49A4-F3DC-812D-C381-9A605CC1AA3A}\2552459366] "{7A4E49A4-F3DC-812D-C381-9A605CC1AA3A}"="REG_SZ", "RX5VQYX9TK8S" "2552459366"="REG_SZ", "E6NFYFZ45E54G"Malwarebytes log:
Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 5/10/17 Scan Time: 8:25 AM Logfile: mbamMagicPCCleaner.txt Administrator: Yes -Software Information- Version: 3.0.6.1469 Components Version: 1.0.103 Update Package Version: 1.0.1908 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Result: Completed Objects Scanned: 330426 Time Elapsed: 1 min, 52 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled -Scan Details- Process: 2 PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\MagicPcCleaner.exe, Quarantined, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\PROGRAM FILES (X86)\SYSTEMOPTIMIZER\MAGICPCCLEANER.EXE, Quarantined, [891], [396750],1.0.1908 Module: 3 PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\MagicPcCleaner.exe, Quarantined, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\Trial.dll, Quarantined, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\PROGRAM FILES (X86)\SYSTEMOPTIMIZER\MAGICPCCLEANER.EXE, Quarantined, [891], [396750],1.0.1908 Registry Key: 4 PUP.Optional.MagicPCCleaner, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}, Delete-on-Reboot, [891], [396761],1.0.1908 PUP.Optional.MagicPCCleaner, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\MagicPcCleaner_RASAPI32, Delete-on-Reboot, [891], [396760],1.0.1908 PUP.Optional.MagicPCCleaner, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\MagicPcCleaner_RASMANCS, Delete-on-Reboot, [891], [396760],1.0.1908 PUP.Optional.MagicPCCleaner, HKLM\SOFTWARE\WOW6432NODE\Magic Pc Cleaner, Delete-on-Reboot, [891], [396759],1.0.1908 Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 9 PUP.Optional.MagicPCCleaner, C:\Users\{username}\AppData\Roaming\Magic Pc Cleaner\Magic Pc Cleaner 1.0.0\install, Delete-on-Reboot, [891], [396755],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Users\{username}\AppData\Roaming\Magic Pc Cleaner\Magic Pc Cleaner 1.0.0, Delete-on-Reboot, [891], [396755],1.0.1908 PUP.Optional.MagicPCCleaner, C:\USERS\{username}\APPDATA\ROAMING\Magic Pc Cleaner, Delete-on-Reboot, [891], [396755],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner, Delete-on-Reboot, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\PROGRAM FILES (X86)\Magic Pc Cleaner, Delete-on-Reboot, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Users\{username}\AppData\Local\MagicPcCleaner\MagicPcCleaner.exe_Url_c555nk35rwj3gbeq3ywwn5witprathsd\1.0.0.0, Delete-on-Reboot, [891], [396756],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Users\{username}\AppData\Local\MagicPcCleaner\MagicPcCleaner.exe_Url_c555nk35rwj3gbeq3ywwn5witprathsd, Delete-on-Reboot, [891], [396756],1.0.1908 PUP.Optional.MagicPCCleaner, C:\USERS\{username}\APPDATA\LOCAL\MagicPcCleaner, Delete-on-Reboot, [891], [396756],1.0.1908 PUP.Optional.MagicPCCleaner, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MAGIC PC CLEANER, Delete-on-Reboot, [891], [396753],1.0.1908 File: 15 PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\MagicPcCleaner.exe, Delete-on-Reboot, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\MagicPcCleaner.exe.config, Delete-on-Reboot, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\Telerik.WinControls.dll, Delete-on-Reboot, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\Telerik.WinControls.Themes.HighContrastBlack.dll, Delete-on-Reboot, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\Telerik.WinControls.UI.dll, Delete-on-Reboot, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\TelerikCommon.dll, Delete-on-Reboot, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\Trial.dll, Delete-on-Reboot, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\UtilityInfo.xml, Delete-on-Reboot, [891], [396752],1.0.1908 PUP.Optional.MagicPCCleaner, C:\Users\{username}\AppData\Local\MagicPcCleaner\MagicPcCleaner.exe_Url_c555nk35rwj3gbeq3ywwn5witprathsd\1.0.0.0\user.config, Delete-on-Reboot, [891], [396756],1.0.1908 PUP.Optional.MagicPCCleaner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Magic Pc Cleaner\Magic PC Cleaner.lnk, Delete-on-Reboot, [891], [396753],1.0.1908 PUP.Optional.MagicPCCleaner, C:\PROGRAM FILES (X86)\SYSTEMOPTIMIZER\MAGICPCCLEANER.EXE, Delete-on-Reboot, [891], [396750],1.0.1908 PUP.Optional.MagicPCCleaner, C:\USERS\{username}\DESKTOP\MPCSETUP.EXE, Delete-on-Reboot, [891], [396751],1.0.1908 PUP.Optional.MagicPCCleaner, C:\USERS\{username}\DESKTOP\MAGICPCCLEANER.EXE, Delete-on-Reboot, [891], [396750],1.0.1908 PUP.Optional.MagicPCCleaner, C:\USERS\PUBLIC\DESKTOP\MAGIC PC CLEANER.LNK, Delete-on-Reboot, [891], [396754],1.0.1908 PUP.Optional.MagicPCCleaner, C:\USERS\{username}\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\SYSTEMCLEANER.URL, Delete-on-Reboot, [891], [396757],1.0.1908 Physical Sector: 0 (No malicious items detected) (end)As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention