SysCleaner

9 February 2008 Unwanted Program 0 Comment

SysCleaner is a fake Windows system utility application that may display fake privacy violation results on computer. The rogue program’s next move is to demand payment from computer users to fix or clean reported items. In most cases, SysCleaner sets itself inside your computer in a way that it utilizes a Trojan. There are also instances that people who made to believe that SysCleaner is a legitimate application. That is why the manually install the product, without realizing that it can harm the system in the end.

If you are seeing a bunch of pop-up alerts recommending that you must purchase a paid version of SysCleaner, it signifies that the rogue program is starting to manipulate your computer. It begins with minimal changes to the registry that allows these annoyances to appear. Then, it starts dropping malicious files on various folders that is necessary for its fraud operation.

We strongly recommend removing SysCleaner as early as possible. We have provided a simple guide below.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Malware Behavior
To further mislead unsuspecting computer users, SysCleaner virus will mimic Windows alert method. Fake task bar alerts arises to disguise as legitimate warnings but containing only false and imaginary detection of security risks. This method and other deceiving tactics attempts to persuade victims into obtaining the commercial version of SysCleaner.

Added Registry Entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"SysCleaner" = "C:\Program Files\SysCleaner\SysCleaner.exe"

Associated Files and Folders:

%UserProfile%\Application Data\SysCleaner
%UserProfile%\Application Data\SysCleaner\logs
C:\Documents and Settings\All Users\Start Menu\Programs\SysCleaner
%ProgramFiles%\SysCleaner
%ProgramFiles%\SysCleaner\com

1. Temporarily Disable System Restore (Windows Me/XP). [how to]
2. Open your antivirus application and update the virus definition file. This method ensures that your antivirus program can detect even newer variants of SysCleaner

3. Start Windows in Safe Mode with Networking.
- From a power-off state, turn on the computer and press F8 on your keyboard repeatedly.
- Your computer will display Windows Advanced Boot Options menu. Please select Safe Mode with Networking.
- The system will now boot Windows and loads only necessary drivers and files.

4. Open your antivirus program and run a full system scan. After the scan, delete all infected items. If unable, better place them in quarantine. Once the scan is complete, please proceed with the next step.

Online Virus Scanner:

Another way to remove SysCleaner without the need to install additional antivirus application is to perform a thorough scan with free online virus scanner that can be found here or on websites of legitimate anti-virus and security provider.

5. Go to Online Virus Scanner list and run a virus scan. This may require plug-ins, add-on or Activex object, please install if you want to proceed with scan.
6. After completing the necessary download, your system is now ready for online virus scanning.
7. Select an option in which you can thoroughly scan the computer to make sure that it will find and delete entirely all infections not detected on previous scan.
8. Remove or delete all detected items.
9. When scanning is finished you may now restart the computer in normal mode.