Home Malware Programs Rogue Anti-Spyware Programs Windows Cleaning Tool

Windows Cleaning Tool

Posted: June 23, 2011

Windows Cleaning Tool is a rogue security scanner that uses Windows Cleaning Tool's external appearance of being a legitimate software product to steal money and credit card information. Error messages, scanning results and other forms of diagnostic information that are provided by Windows Cleaning Tool, all contain inaccurate data and false positives. Windows Cleaning Tool will even attack your computer itself to make the appearance of threats on your PC seem more realistic; Windows Cleaning Tool can hijack your browser or block a variety of applications. Infections by Windows Cleaning Tool may also indicate the presence of Trojans, and because of this, you should remove Windows Cleaning Tool by using the best possible anti-virus software that can detect all possible threats.

Windows Cleaning Tool: A Program with Ties to Not So Clean Rogue Security Software

Windows Cleaning Tool is one of the numerous clones that are churned out to prolong the life of a large group of rogue security programs. These programs share nearly identical interfaces and similar functions, so you can treat any infection by Windows Cleaning Tool as being the same as an infection by Windows Stable Work, Windows Examination Utility, Windows Necessary Firewall or Windows Averting System.

The Windows Cleaning Tool group of threats can spread by websites with poor security or outright malicious sites that have no qualms about loading praises atop Windows Cleaning Tool's nonexistent security features. However, most Windows Cleaning Tool infections are caused by Trojans like Fake Microsoft Security Essentials Alert. Fake Microsoft Security Essentials Alert Trojans are responsible for creating fake security-related errors, to make it look like the rogue security program that's being installed is a real software product. One of Fake Microsoft Security Essentials Alert's possible messages can resemble the example seen here:

Microsoft Security Essentials Alert
Potential Threat Details
Microsoft Security Essentials detected potential threats that might compromise your private or damage your computer. Your access to these items may be suspended until you take an action. Click 'show details' to learn more.

Regardless of what you attempt to do, Fake Microsoft Security Essentials Alert will try to install Windows Cleaning Tool or another rogue security program, and then reboot your PC. This reboot is performed to let Windows Cleaning Tool launch itself automatically, which Windows Cleaning Tool will do from now on whenever Windows starts.

The Three Ways Windows Cleaning Tool Tries to Grab Your Credit Card

Although Windows Cleaning Tool can't detect or remove real threats to your PC, and there's no reason to buy Windows Cleaning Tool, Windows Cleaning Tool will continue to do everything in Windows Cleaning Tool's power to make you want to purchase Windows Cleaning Tool. Some typical Windows Cleaning Tool attacks along these lines can include:

  • Browser hijacks that redirect you towards the Windows Cleaning Tool website over and over again. Hijacks can also use fake error screens or change your search results to stop you from finding websites that can help you remove Windows Cleaning Tool from your PC.
  • Application-blocking attacks that make it look like critical programs are infected. This gives the appearance that Windows Cleaning Tool's threat detection functions are working while simultaneously denying you any real threat-removal capabilities. Some errors that are associated with this Windows Cleaning Tool attack are:

    Warning!
    Location: [application file path]
    Viruses: Backdoor.Win32.Rbot

    Warning!
    Name: [application file name]
    Name: [application file path]
    Application that seems to be a key-logger is detected. System information security is at risk. It is recommended to enable the security mode and run total System scanning.

  • Miscellaneous errors that try to trick you into thinking that your computer will break down if you don't purchase Windows Cleaning Tool. Other high-level threats like keyloggers are also implicated, as you can see below:

    System Security Warning
    Attempt to modify register key entries is detected. Register entries analysis is recommended.

    Warning! Database update failed!
    Database update failed!
    Outdated viruses databases are not effective and can't [sic] guarantee adequate protection and security for your PC!
    Click here to get the full version of the product and update the database!

    System component corrupted!
    System reboot error has occurred due to lsass.exe system process failure.
    This may be caused by severe malware infections.
    Automatic restore of lsass.exe backup copy completed.
    The correct system performance can not be resumed without eliminating the cause of lsass.exe corruption.

    Warning! Running trial version!
    The security of your computer has been compromised!
    Now running trial version of the software!
    Click here to purchase the full version of the software and get full protection for your PC!

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %UserProfile%\Application Data\Microsoft\[RANDOM CHARACTERS].exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = ’0?HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwserv.exe “Debugger” = ‘svchost.exe’HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastsvc.exe “Debugger” = ‘svchost.exe’HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastui.exe “Debugger” = ‘svchost.exe’HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe “Debugger” = ‘svchost.exe’HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe “Debugger” = ‘svchost.exe’HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe “Debugger” = ‘svchost.exe’HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe “Debugger” = ‘svchost.exe’HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe “Debugger” = ‘svchost.exe’HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore “DisableSR ” = ’1?HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnHTTPSToHTTPRedirect” = ’0?

Related Posts

Loading...