Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for SweepTools

- - - - -
Started by Metallica , Mar 05 2018 02:33 AM

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 05 March 2018 - 02:33 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is SweepTools?

The Malwarebytes research team has determined that SweepTools is a "system optimizer". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.

How do I know if I am infected with SweepTools?

This is how the main screen of the system optimizer looks:

main.png

You will find these icons in your taskbar, your startmenu, and on your desktop:

icons.png

and see these warnings during install:

warning1.png

warning2.png

and this type of screens during "operations":

warning5.png

You may see this entry in your list of installed programs:

warning4.png

and this task in your list of Scheduled Tasks:

warning3.png

How did SweepTools get on my computer?

These so-called system optimizers use different methods of getting installed. This particular one was downloaded from their website:

website.png

How do I remove SweepTools?

Our program Malwarebytes can detect and remove this potentially unwanted application.
  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of SweepTools?
  • No, Malwarebytes removes SweepTools completely.
  • This PUP creates some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this system optimizer.

As you can see below the full version of Malwarebytes would have protected you against the SweepTools installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png


and we block access to their domain:

protection2.png


Technical details for experts

You may see these entries in FRST logs:

() C:\Program Files (x86)\SweepTools PC Cleaner\PC Cleaner.exe
 C:\Windows\System32\Tasks\SweepTools PC Cleaner
 C:\Users\Public\Desktop\SweepTools PC Cleaner.lnk
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SweepTools PC Cleaner
 C:\Program Files (x86)\SweepTools PC Cleaner
 C:\Users\{username}\AppData\Local\SweepTools

SweepTools PC Cleaner version 1.14 (HKLM-x32\...\{DF091B9B-6D44-4BB4-B3AD-E19C36CB77AE}_is1) (Version: 1.14 - Secure Download)
Task: {BBE772F1-A41C-49AC-9A6B-548D2536CACC} - System32\Tasks\SweepTools PC Cleaner => C:\Program Files (x86)\SweepTools PC Cleaner\stpcs.exe
() C:\Program Files (x86)\SweepTools PC Cleaner\libcef.dll
() C:\Program Files (x86)\SweepTools PC Cleaner\stpclib.dll
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\SweepTools PC Cleaner
       Adds the file data"="10/24/2014 10:27 AM, 7562816 bytes, A
       Adds the file debug.log"="3/5/2018 8:42 AM, 165 bytes, A
       Adds the file icudt.dll"="3/5/2013 1:41 AM, 9956864 bytes, A
       Adds the file libcef.dll"="3/5/2013 1:41 AM, 24978944 bytes, A
       Adds the file PC Cleaner.exe"="2/24/2015 4:20 PM, 1920520 bytes, A
       Adds the file stpclib.dll"="2/24/2015 4:21 PM, 328200 bytes, A
       Adds the file unins000.dat"="3/5/2018 8:44 AM, 17782 bytes, A
       Adds the file unins000.exe"="3/5/2018 8:44 AM, 749217 bytes, A
    Adds the folder C:\Program Files (x86)\SweepTools PC Cleaner\locales
       Adds the file en-US.pak"="3/5/2013 1:40 AM, 2898 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SweepTools PC Cleaner
       Adds the file SweepTools PC Cleaner.lnk"="3/5/2018 8:44 AM, 1126 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\SweepTools\BU
       Adds the file se"="3/5/2018 8:42 AM, 8 bytes, A
       Adds the file spIss.pb"="3/5/2018 8:42 AM, 9565 bytes, A
    In the existing folder C:\Users\Public\Desktop
       Adds the file SweepTools PC Cleaner.lnk"="3/5/2018 8:44 AM, 1108 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file SweepTools PC Cleaner"="3/5/2018 8:44 AM, 2812 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{DF091B9B-6D44-4BB4-B3AD-E19C36CB77AE}_is1]
       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\SweepTools PC Cleaner\PC Cleaner.exe"
       "DisplayName"="REG_SZ", "SweepTools PC Cleaner version 1.14"
       "DisplayVersion"="REG_SZ", "1.14"
       "EstimatedSize"="REG_DWORD", 44421
       "HelpLink"="REG_SZ", "http://www.sweeptools.com/"
       "Inno Setup: App Path"="REG_SZ", "C:\Program Files (x86)\SweepTools PC Cleaner"
       "Inno Setup: Icon Group"="REG_SZ", "SweepTools PC Cleaner"
       "Inno Setup: Language"="REG_SZ", "english"
       "Inno Setup: Setup Version"="REG_SZ", "5.5.6 (a)"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20180305"
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\SweepTools PC Cleaner\"
       "MajorVersion"="REG_DWORD", 1
       "MinorVersion"="REG_DWORD", 14
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "Secure Download"
       "QuietUninstallString"="REG_SZ", ""C:\Program Files (x86)\SweepTools PC Cleaner\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Program Files (x86)\SweepTools PC Cleaner\unins000.exe""
       "URLInfoAbout"="REG_SZ", "http://www.sweeptools.com/"
       "URLUpdateInfo"="REG_SZ", "http://www.sweeptools.com/"
Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/5/18
Scan Time: 8:52 AM
Log File: 335c2fbb-204a-11e8-90e2-080027235d76.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.4210
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 244037
Threats Detected: 31
Threats Quarantined: 31
Time Elapsed: 3 min, 23 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 1
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\PC Cleaner.exe, Quarantined, [6961], [480555],1.0.4210

Module: 4
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\icudt.dll, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\libcef.dll, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\PC Cleaner.exe, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\stpclib.dll, Quarantined, [6961], [480555],1.0.4210

Registry Key: 4
PUP.Optional.SweepTools, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\SWEEPTOOLS PC CLEANER, Quarantined, [7977], [480558],1.0.4210
PUP.Optional.SweepTools, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{BBE772F1-A41C-49AC-9A6B-548D2536CACC}, Quarantined, [7977], [480558],1.0.4210
PUP.Optional.SweepTools, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{BBE772F1-A41C-49AC-9A6B-548D2536CACC}, Quarantined, [7977], [480558],1.0.4210
PUP.Optional.SweepTools.TskLnk, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{DF091B9B-6D44-4BB4-B3AD-E19C36CB77AE}_is1, Quarantined, [6961], [484946],1.0.4210

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 4
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\locales, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\PROGRAM FILES (X86)\SWEEPTOOLS PC CLEANER, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\SWEEPTOOLS PC CLEANER, Quarantined, [7977], [480556],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\USERS\{username}\APPDATA\LOCAL\SWEEPTOOLS\BU, Quarantined, [6961], [484945],1.0.4210

File: 18
PUP.Optional.SweepTools, C:\USERS\PUBLIC\DESKTOP\SWEEPTOOLS PC CLEANER.LNK, Quarantined, [7977], [480557],1.0.4210
PUP.Optional.SweepTools, C:\WINDOWS\SYSTEM32\TASKS\SWEEPTOOLS PC CLEANER, Quarantined, [7977], [480558],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\locales\en-US.pak, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\data, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\debug.log, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\icudt.dll, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\libcef.dll, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\PC Cleaner.exe, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\stpclib.dll, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\unins000.dat, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Program Files (x86)\SweepTools PC Cleaner\unins000.exe, Quarantined, [6961], [480555],1.0.4210
PUP.Optional.SweepTools, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SweepTools PC Cleaner\SweepTools PC Cleaner.lnk, Quarantined, [7977], [480556],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Users\{username}\AppData\Local\SweepTools\BU\1520236349-regErrK.pb, Quarantined, [6961], [484945],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Users\{username}\AppData\Local\SweepTools\BU\1520236349-regErrV.pb, Quarantined, [6961], [484945],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Users\{username}\AppData\Local\SweepTools\BU\se, Quarantined, [6961], [484945],1.0.4210
PUP.Optional.SweepTools.TskLnk, C:\Users\{username}\AppData\Local\SweepTools\BU\spIss.pb, Quarantined, [6961], [484945],1.0.4210
PUP.Optional.SweepTools, C:\USERS\{username}\DESKTOP\SETUP.1.13.EXE, Quarantined, [7977], [480554],1.0.4210
PUP.Optional.SweepTools, C:\USERS\{username}\DOWNLOADS\SETUP.1.13.EXE, Quarantined, [7977], [480554],1.0.4210

Physical Sector: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.