No replies to this topic

[Metallica]

Content is republished with permission from Malwarebytes.

What is CleanMyPC?

The Malwarebytes research team has determined that CleanMyPC is a fake registry cleaner. These so-called "registry cleaners" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.

How do I know if I am infected with CleanMyPC?

This is how the main screen of the registry cleaning application looks:



You will find these icons in your taskbar, your startmenu and on your desktop:



And see these warnings during install:





and these screens during "operations":







You may see this entry in your list of installed programs:



How did CleanMyPC get on my computer?

These so-called registry cleaners use different methods of getting installed. This particular one was downloaded from their website.



How do I remove CleanMyPC?

Our program Malwarebytes can detect and remove this potentially unwanted application.

• Please download Malwarebytes to your desktop.
• Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
• Then click Finish.
• Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
• If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
• When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
• Restart your computer when prompted to do so.

Is there anything else I need to do to get rid of CleanMyPC?

• No, Malwarebytes removes CleanMyPC completely.

How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this registry cleaner.

As you can see below the full version of Malwarebytes would have protected you against the CleanMyPC installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.



and we block their domain.

Technical details for experts

You may see these entries in FRST logs:

 (CleanMyPC Tools Software) C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCleaner.exe
 (CleanMyPC Software) C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCHelper.exe
 HKCU\...\Run: [Registry Cleaner Scheduler] => C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCHelper.exe [1400024 2014-12-14] (CleanMyPC Software)
 C:\Users\{username}\AppData\Roaming\CleanMyPC Software
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CleanMyPC Registry Cleaner
 C:\Program Files (x86)\CleanMyPC

CleanMyPC - Registry Cleaner (HKLM-x32\...\CleanMyPC - Registry Cleaner_is1) (Version:  - CleanMyPC Software)

Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\CleanMyPC\Registry Cleaner
       Adds the file RCHelper.exe"="12/14/2014 8:15 PM, 1400024 bytes, A
       Adds the file RCleaner.exe"="12/14/2014 8:15 PM, 3583192 bytes, A
       Adds the file UnFD.exe"="12/14/2014 8:15 PM, 1466368 bytes, A
       Adds the file unins000.dat"="2/2/2017 9:15 AM, 3869 bytes, A
       Adds the file unins000.exe"="2/2/2017 9:14 AM, 754970 bytes, A
       Adds the file update.exe"="12/14/2014 8:15 PM, 664792 bytes, A
       Adds the file update.urs"="12/14/2014 8:15 PM, 352 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CleanMyPC Registry Cleaner
       Adds the file CleanMyPC - Registry Cleaner.lnk"="2/2/2017 9:15 AM, 1119 bytes, A
       Adds the file Registry Cleaner Online Help.lnk"="2/2/2017 9:15 AM, 2053 bytes, A
       Adds the file Uninstall CleanMyPC - Registry Cleaner.lnk"="2/2/2017 9:15 AM, 1119 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\CleanMyPC Software\CleanMyPC Registry Cleaner
    In the existing folder C:\Users\{username}\Desktop
       Adds the file CleanMyPC - Registry Cleaner.lnk"="2/2/2017 9:15 AM, 1101 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9254C72A-294B-BFDF-ACFA-A7E8A56FF865}]
       "(Default)"="REG_SZ", "CImeProductObject_JK Class"
       "dpOyjPvOmlcq"="REG_SZ", "fC[evgCGLVijRZcX|\d]me^NheWiw`i"
       "humqnl"="REG_SZ", "Xbfx[x@}pCsHwzmCRBQ[uCVAl`kHG_WA"
       "ivapVGzoVmm"="REG_SZ", "QekSTF{A|eSshe]B`"
       "sdapb"="REG_SZ", "APG\]_^GSuYQp{P{@hET@}z}AcNs"
       "wgcEfj"="REG_SZ", "@GDnfTO^olhBzDXGrP"
       "wvdutfclao"="REG_SZ", "[mCZtM|XLrQSYyyL_lDz]wHx"
       "zKnIomfly"="REG_SZ", "@Hqzme[qmei@J`mAx@XkgKAX{LUyQ}j"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9254C72A-294B-BFDF-ACFA-A7E8A56FF865}\InprocServer32]
       "(Default)"="REG_EXPAND_SZ, "%SystemRoot%\SysWow64\ime\shared\imjkapi.dll"
       "ThreadingModel"="REG_SZ", "Apartment"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9254C72A-294B-BFDF-ACFA-A7E8A56FF865}\ProgID]
       "(Default)"="REG_SZ", "IMEAPI.CImeProductObjectJK.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9254C72A-294B-BFDF-ACFA-A7E8A56FF865}\TypeLib]
       "(Default)"="REG_SZ", "{da524058-bdb4-482a-997a-338ae04d7156}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9254C72A-294B-BFDF-ACFA-A7E8A56FF865}\Version]
       "(Default)"="REG_SZ", "1.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9254C72A-294B-BFDF-ACFA-A7E8A56FF865}\VersionIndependentProgID]
       "(Default)"="REG_SZ", "IMEAPI.CImeProductObjectJK"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RCHelper.exe]
       "(Default)"="REG_SZ", "C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCHelper.exe"
       "Path"="REG_SZ", "C:\Program Files (x86)\CleanMyPC\Registry Cleaner\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RCleaner.exe]
       "(Default)"="REG_SZ", "C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCleaner.exe"
       "Path"="REG_SZ", "C:\Program Files (x86)\CleanMyPC\Registry Cleaner\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ComputerAssociates\ITMRT]
       "HookExclude"="REG_MULTI_SZ, "RCleaner.exe "
       "InjectExclude"="REG_MULTI_SZ, "RCleaner.exe "
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CleanMyPC - Registry Cleaner_is1]
       "DisplayName"="REG_SZ", "CleanMyPC - Registry Cleaner"
       "HelpLink"="REG_SZ", "http://www.registry-cleaner.net"
       "Inno Setup: App Path"="REG_SZ", "C:\Program Files (x86)\CleanMyPC\Registry Cleaner"
       "Inno Setup: Deselected Tasks"="REG_SZ", ""
       "Inno Setup: Icon Group"="REG_SZ", "CleanMyPC Registry Cleaner"
       "Inno Setup: Selected Tasks"="REG_SZ", "desktopicon"
       "Inno Setup: Setup Version"="REG_SZ", "5.2.3"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20170202"
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\CleanMyPC\Registry Cleaner\"
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "CleanMyPC Software"
       "QuietUninstallString"="REG_SZ", ""C:\Program Files (x86)\CleanMyPC\Registry Cleaner\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Program Files (x86)\CleanMyPC\Registry Cleaner\unins000.exe""
       "URLInfoAbout"="REG_SZ", "http://www.registry-cleaner.net"
       "URLUpdateInfo"="REG_SZ", "http://www.registry-cleaner.net"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers]
       "C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCHelper.exe"="REG_SZ", "DisableNXShowUI"
       "C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCleaner.exe"="REG_SZ", "DisableNXShowUI"
       "C:\Program Files (x86)\CleanMyPC\Registry Cleaner\update.exe"="REG_SZ", "DisableNXShowUI"
    [HKEY_CURRENT_USER\Software\CleanMyPC\CleanMyPC - Registry Cleaner\Recent File List]
    [HKEY_CURRENT_USER\Software\CleanMyPC\CleanMyPC - Registry Cleaner\Settings]
       "FirstRun"="REG_DWORD", 0
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
       "Registry Cleaner Scheduler"="REG_SZ", ""C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCHelper.exe" /startup"

Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 2/2/17
Scan Time: 9:31 AM
Logfile: mbamCleanMyPC.txt
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.50
Update Package Version: 1.0.1155
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 358315
Time Elapsed: 3 min, 31 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 2
PUP.Optional.CleanMyPC, C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCHelper.exe, Quarantined, [2231], [348420],1.0.1155
PUP.Optional.CleanMyPC, C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCleaner.exe, Quarantined, [2231], [348420],1.0.1155

Module: 2
PUP.Optional.CleanMyPC, C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCHelper.exe, Quarantined, [2231], [348420],1.0.1155
PUP.Optional.CleanMyPC, C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCleaner.exe, Quarantined, [2231], [348420],1.0.1155

Registry Key: 6
PUP.Optional.CleanMyPC, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RCHelper.exe, Delete-on-Reboot, [2231], [366350],1.0.1155
PUP.Optional.CleanMyPC, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RCleaner.exe, Delete-on-Reboot, [2231], [366350],1.0.1155
PUP.Optional.CleanMyPC, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CleanMyPC - Registry Cleaner_is1, Delete-on-Reboot, [2231], [348426],1.0.1155
PUP.Optional.CleanMyPC, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RCHelper.exe, Delete-on-Reboot, [2231], [366350],1.0.1155
PUP.Optional.CleanMyPC, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RCleaner.exe, Delete-on-Reboot, [2231], [366350],1.0.1155
PUP.Optional.CleanMyPC, HKCU\SOFTWARE\CLEANMYPC\CleanMyPC - Registry Cleaner, Delete-on-Reboot, [2231], [348427],1.0.1155

Registry Value: 5
PUP.Optional.CleanMyPC, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RCHelper.exe|PATH, Delete-on-Reboot, [2231], [366350],1.0.1155
PUP.Optional.CleanMyPC, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RCleaner.exe|PATH, Delete-on-Reboot, [2231], [366350],1.0.1155
PUP.Optional.CleanMyPC, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Registry Cleaner Scheduler, Delete-on-Reboot, [2231], [348420],1.0.1155
PUP.Optional.CleanMyPC, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RCHelper.exe|PATH, Delete-on-Reboot, [2231], [366350],1.0.1155
PUP.Optional.CleanMyPC, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RCleaner.exe|PATH, Delete-on-Reboot, [2231], [366350],1.0.1155

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.CleanMyPC, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\CLEANMYPC REGISTRY CLEANER, Delete-on-Reboot, [2231], [348421],1.0.1155
PUP.Optional.CleanMyPC, C:\Program Files (x86)\CleanMyPC\Registry Cleaner, Delete-on-Reboot, [2231], [348420],1.0.1155
PUP.Optional.CleanMyPC, C:\PROGRAM FILES (X86)\CLEANMYPC, Delete-on-Reboot, [2231], [348420],1.0.1155

File: 12
PUP.Optional.CleanMyPC, C:\USERS\{username}\DESKTOP\CLEANMYPC - REGISTRY CLEANER.LNK, Delete-on-Reboot, [2231], [348423],1.0.1155
PUP.Optional.CleanMyPC, C:\USERS\{username}\DESKTOP\REGCLEANER.EXE, Delete-on-Reboot, [2231], [361686],1.0.1155
PUP.Optional.CleanMyPC, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CleanMyPC Registry Cleaner\CleanMyPC - Registry Cleaner.lnk, Delete-on-Reboot, [2231], [348421],1.0.1155
PUP.Optional.CleanMyPC, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CleanMyPC Registry Cleaner\Registry Cleaner Online Help.lnk, Delete-on-Reboot, [2231], [348421],1.0.1155
PUP.Optional.CleanMyPC, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CleanMyPC Registry Cleaner\Uninstall CleanMyPC - Registry Cleaner.lnk, Delete-on-Reboot, [2231], [348421],1.0.1155
PUP.Optional.CleanMyPC, C:\PROGRAM FILES (X86)\CLEANMYPC\REGISTRY CLEANER\UNINS000.DAT, Delete-on-Reboot, [2231], [348420],1.0.1155
PUP.Optional.CleanMyPC, C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCHelper.exe, Delete-on-Reboot, [2231], [348420],1.0.1155
PUP.Optional.CleanMyPC, C:\Program Files (x86)\CleanMyPC\Registry Cleaner\RCleaner.exe, Delete-on-Reboot, [2231], [348420],1.0.1155
PUP.Optional.CleanMyPC, C:\Program Files (x86)\CleanMyPC\Registry Cleaner\UnFD.exe, Delete-on-Reboot, [2231], [348420],1.0.1155
PUP.Optional.CleanMyPC, C:\Program Files (x86)\CleanMyPC\Registry Cleaner\unins000.exe, Delete-on-Reboot, [2231], [348420],1.0.1155
PUP.Optional.CleanMyPC, C:\Program Files (x86)\CleanMyPC\Registry Cleaner\update.exe, Delete-on-Reboot, [2231], [348420],1.0.1155
PUP.Optional.CleanMyPC, C:\Program Files (x86)\CleanMyPC\Registry Cleaner\update.urs, Delete-on-Reboot, [2231], [348420],1.0.1155

Physical Sector: 0
(No malicious items detected)


(end)

As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
• Malware Execution Prevention

Save yourself the hassle and get protected.