Home Malware Programs Rogue Anti-Spyware Programs TZ SystemCleanser

TZ SystemCleanser

Posted: January 28, 2009

TZ SystemCleanser, also known as TZ SystemCleanser, is a rogue anti-spyware program and is a clone of TrackZapper. TZ SystemCleanser is usually installed by any of the Trojan variations of Zlob, Trojan.Generic, Vundo. Once you're infected with a Trojan similar to Zlob, you'll receive numerous fake security alerts and system scan results stating that your computer is infected with spyware. To remove the supposed spyware infections, TZ SystemCleanser will then urge you to purchase TZ SystemCleanser's full program for $79.95 or $49.95.

All links provided by TZ SystemCleanser will most likely redirect you to malicious websites that sell TZ SystemCleanser as a legitimate spyware remover. TZ SystemCleanser may have the ability to recreate itself after reboot. It is strongly recommended to remove TZ SystemCleanser from your system upon detection.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 C:\Documents and Settings\Administrator\Desktop\TZ Spyware Remover.lnk
    2 C:\Documents and Settings\All Users\Start Menu\Programs\TrackZapper.com\TZ Spyware Remover\
    3 C:\Documents and Settings\All Users\Start Menu\Programs\TrackZapper.com\TZ Spyware Remover\Help.lnk
    4 C:\Documents and Settings\All Users\Start Menu\Programs\TrackZapper.com\TZ Spyware Remover\TZ Spyware-Adware Remover.lnk
    5 C:\Documents and Settings\All Users\Start Menu\Programs\TrackZapper.com\TZ Spyware Remover\Uninstall.lnk
    6 C:\Program Files\TrackZapper.com\TZ Spyware Remover\
    7 C:\Program Files\TrackZapper.com\TZ Spyware Remover\Box.tz
    8 C:\Program Files\TrackZapper.com\TZ Spyware Remover\Core.dll
    9 C:\Program Files\TrackZapper.com\TZ Spyware Remover\DataBase.ini
    10 C:\Program Files\TrackZapper.com\TZ Spyware Remover\DB.tz
    11 C:\Program Files\TrackZapper.com\TZ Spyware Remover\DB1.tz
    12 C:\Program Files\TrackZapper.com\TZ Spyware Remover\DB2.tz
    13 C:\Program Files\TrackZapper.com\TZ Spyware Remover\DB3.tz
    14 C:\Program Files\TrackZapper.com\TZ Spyware Remover\DB4.tz
    15 C:\Program Files\TrackZapper.com\TZ Spyware Remover\DB5.tz
    16 C:\Program Files\TrackZapper.com\TZ Spyware Remover\English.inf
    17 C:\Program Files\TrackZapper.com\TZ Spyware Remover\English.jpg
    18 C:\Program Files\TrackZapper.com\TZ Spyware Remover\folders.tz
    19 C:\Program Files\TrackZapper.com\TZ Spyware Remover\guard.tz
    20 C:\Program Files\TrackZapper.com\TZ Spyware Remover\Help.chm
    21 C:\Program Files\TrackZapper.com\TZ Spyware Remover\home.tz
    22 C:\Program Files\TrackZapper.com\TZ Spyware Remover\Progress.tz
    23 C:\Program Files\TrackZapper.com\TZ Spyware Remover\Purchase.tz
    24 C:\Program Files\TrackZapper.com\TZ Spyware Remover\scanning.tz
    25 C:\Program Files\TrackZapper.com\TZ Spyware Remover\Splash.spl
    26 C:\Program Files\TrackZapper.com\TZ Spyware Remover\SpyRem.exe
    27 C:\Program Files\TrackZapper.com\TZ Spyware Remover\unins000.dat
    28 C:\Program Files\TrackZapper.com\TZ Spyware Remover\unins000.exe
    29 C:\Program Files\TrackZapper.com\TZ Spyware Remover\update.cli
    30 C:\Program Files\TrackZapper.com\TZ Spyware Remover\update.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\TZ Spyware RemoverHKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4222FB6A-87F1-4867-8639-3B07B79B2EA2}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{509F840C-8FBE-4B39-8135-7AE4F77211BE}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E0EA78D-E2BD-4DC4-8139-3C80FEA5388C}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BE09D09-4A7B-4CC9-A729-A0142C7DF45B}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{921064A0-DA49-40B6-B8CE-0E9F3C925E2D}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B46BB0D4-73BC-426F-822D-06CF4D5D5AE9}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCAF88BD-430E-4735-84DA-87B2BCA2420E}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE9BE0B6-6282-45C1-89E0-6DC449033B23}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F01F5B97-4493-47C7-881E-17C065B899EC}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Core.BackupHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Core.ErrorHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Core.LoadingHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Core.RemoveHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Core.ScanHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Core.ShieldHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Core.ThreadControlHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Core.ThreadLaunchHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Core.WorkerHKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1AE04A0C-8523-47DE-AA0C-1A752BAC0C3C}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23E12DDE-E63E-4D03-B92A-5A9FBD2AAC56}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{250191B9-C470-4496-BE0B-328A9828B13F}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{335F2B2A-95EE-4D5E-964C-92DB7CD9AB4F}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3CF06A51-25CB-4AC1-8B2B-68939764841B}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3DC35E00-E545-4874-8F22-8509077849FE}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4A10974A-BE32-4C5D-959C-7CB2A2EC7A47}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6EBFEFE7-4A25-43E9-8DA9-1B2050D6B40F}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79534873-72F1-4EF4-80B1-81DC825FB29A}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7A571EF3-BA6F-4883-8089-ED150079D1E8}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{853958CB-4ABD-4425-90E8-481BF6F50BE3}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E64C74F7-7A0B-4CDB-A948-0BBB54AF4D76}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9BE9673-6933-45D7-8478-7A521DA5CF0F}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EA8AF03F-D635-4007-9430-A82DAE65F7A1}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F8D7C39B-B275-44D3-9758-08DC48A52124}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5466CEC7-55DE-4245-A6B6-CFA8CCCB89DC}HKEY_USERS\S-1-5-21-1343024091-1336601894-839522115-500\Software\TZ Spyware RemoverHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}TZ Spyware Remover_is1
Loading...