Malware Removal Instructions

  • Subscribe to our RSS feed.
  • Twitter
  • StumbleUpon
  • Reddit
  • Facebook
  • Digg

Saturday, 19 March 2011

How to Remove CleanThis (Uninstall Guide)

Posted on 14:04 by Unknown
CleanThis is a fake anti-virus application that claims to be a Microsoft product and wants to get you to upgrade to the full version in order to remove the threats which do not even exist on your computer. It constantly displays fake security warnings and pop-up windows saying that your computer is infected with malicious software. This rogue AV application is a complete scam. If your computer is being infected by CleanThis malware, please follow the removal instructions below.



CleanThis - video

Thanks to rogueamp for making this video

CleanThis masquerades as Microsoft Security Essentials alert and claims that your computer is infected with unknown Win32/Trojan. The fake security alert box does not go by clicking the "X" mark at the right top corner. Actually, it won't go unless I click "OK" or "Continue", which will install "CleanThis" and reboot your computer. After a reboot, you will see the "Windows CleanThis World's leading security solution" screen instead of your normal Windows desktop.



Fake security threat warning:


CleanThis doesn't appear in the list of "uninstall" programs. This rogue applications disables pretty much everything on your computer, Task Manager, Internet Explorer, it hides your Desktop even in safe mode. It modifies Windows registry so that the rogue programs runs automatically during system bootup. Thankfully, we've got the removal instructions to help you to remove CleanThis. Please be advised, if you pay for this phony security software, you will subjected to monetary theft, or in a worst-case example, ID Theft. There is no guarantee that your credit card details aren't going to be sold to other third parties. Do not hesitate to contact us if you need further assistance or you have questions regarding removal of CleanThis. Please leave a comment below. Good luck and be safe online!

CleanThis is a new variant of ThinkPoint and Palladium Pro scareware.


CleanThis removal instructions:

1. Restart your computer. Once the "CleanThis World's leading security solution" window comes press the "Safe Startup" button to do the safe start. It may take a few seconds to load.



2. The CleanThis scanner will show up. Click "OK" to run a full system scan. It may take a few minutes to complete. Then, select "Settings" from the menu and check a checkbox "Allow unprotected startup." Click "Safe settings" to safe the changes.



Close the CleanThis scanner by clicking the "X" mark at the right top corner.

3. Click Start -> Run or press WinKey+R. Type in cmd and press Enter key or click OK.



Type in: taskkill /f /im gog.exe and click Enter. This will stop the CleanThis malware.



4. Download the following file to your Desktop: windows-shell.reg. Double-click to run it. Click "Yes" when it asks if you want to add the information to the registry. This file will fix the Windows Shell entry. This step is important because if you won't fix this entry, then your Windows Desktop may not be displayed the next time you reboot. Once the new registry value has been added, you can delete the file from your computer.

5. Download free anti-malware software from the list below and run a full system scan.
  • MalwareBytes Anti-malware
  • SUPERAntispyware
  • Spybot S&D
  • Hitman Pro 3.5
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

6. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET NOD32 Antivirus 4.


Alternate CleanThis removal instructions:

1. Reboot your computer is "Safe Mode with Command Prompt". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Command Prompt" and press Enter key. Login as the same user you were previously logged in with in the normal Windows mode. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm



2. When Windows loads, the Windows command prompt will show up as show in the image below. At the command prompt, type explorer, and press Enter. Windows Explorer opens.



3. Then open the Registry editor using the same Windows command prompt. Type regedit and press Enter. The Registry Editor opens.



4. Locate the following registry entry:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

In the righthand pane select the registry key named Shell. Right click on the registry key and choose Delete. Click Yes to confirm and exit the Registry editor.



5. Delete CleanThis files. Delete gog.exe and other files as shown in the image below.
  • C:\Documents and Settings\[User Name]\Application Data\ (Windows XP/2000)
  • C:\Users\[User Name]\AppData\Roaming\ (Windows Vista/7)


NOTE: By default, Application Data folder is hidden. If you can find it, please read Show Hidden Files and Folders in Windows.

6. Go back into "Normal Mode". Download free anti-malware software from the list below and run a full system scan.
  • MalwareBytes Anti-malware
  • SUPERAntispyware
  • Spybot S&D
  • Hitman Pro 3.5
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe, explorer.exe or winlogon.exe. With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.

7. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET NOD32 Antivirus 4.


Associated CleanThis files and registry values:

Files:

For Windows XP users:
  • C:\Documents and Settings\[User Name]\Application Data\gog.exe
  • C:\Documents and Settings\[User Name]\Application Data\[SET OF RANDOM CHARACTERS].bat
  • C:\Documents and Settings\[User Name]\Desktop\CleanThis.lnk
  • C:\Documents and Settings\[User Name]\Start Menu\Programs\CleanThis.lnk
  • C:\Windows\Tasks\At[random].job
For Windows Vista and Windows 7 users:
  • C:\Users\[User Name]\AppData\Roaming\gog.exe
  • C:\Users\[User Name]\AppData\Roaming\[SET OF RANDOM CHARACTERS].bat
  • C:\Users\[User Name]\Desktop\CleanThis.lnk
  • C:\Users\[User Name]\Start Menu\Programs\CleanThis.lnk
  • C:\Windows\Tasks\At[random].job
Registry values:
  • HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell = "%AppData%\gog.exe"
Share this information with other people:
Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest
Posted in Rogue programs | No comments
Newer Post Older Post Home

0 comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Popular Posts

  • Remove ShopperReports (Uninstall Guide)
    ShopperReports is defined as adware or a potentially unwanted program that displays marketing related results in a side pane of the browser...
  • Trojan.MBRlock, Внимание! Ваш компьютер заблокирован
    Trojan.MBRlock is a very disturbing piece of malicious code which infects the master boot record (MBR) and prevents Windows from starting. ...
  • Remove RiskTool.Win32.BitCoinMiner (Uninstall Guide)
    RiskTool.Win32.BitCoinMiner is a risk tool or potentially unwanted application that may use your computer's resources to generate bitco...
  • What is wrtc.exe and how to remove it?
    wrtc.exe - by Perion Network Ltd. What is wrtc.exe? wrtc.exe is a part of IncrediMail software, digitally signed by Perion Network Ltd. This...
  • Remove Rattlingsearchsystem.com (Uninstall Guide)
    Rattlingsearchsystem.com is a ZeroAccess/Sirefef rootkit-related browser hijacker that redirects users to shady websites while searching on...
  • False Positive: Ikarus and Comodo detecting TDSSKiller as a Trojan horse
    This awkward moment when you realize that your favorite rootkit removal utility is detected as malware. I probably wouldn't even have no...
  • Remove TR/ATRAPS.Gen2, removal instructions
    Cyber crooks and third parties that buy stolen data are increasingly using more and more sophisticated techniques, in a variety of different...
  • Remove Ask Search and Ask Toolbar (Uninstall Guide)
    Ask Search and Ask Toolbar are very often incorrectly classified as virus/spyware that may cause search redirects. The majority of us pref...
  • Remove Windows Attention Utility (Uninstall Guide)
    Windows Attention Utility is a rogue security application that generates misleading warnings about nonexistent viruses and attempts to lure...
  • Remove "System Check" (Uninstall Guide)
    System Check is malicious software posing as Windows system utility. Although, it may look like a real thing, it isn't! You are actuall...

Categories

  • Adware
  • Answers
  • Antivirus software
  • Browser Hijackers
  • Cloud Computing
  • Fake Alerts
  • Giveaways
  • Hoax
  • How-To
  • IaaS
  • Internet
  • Malicious websites
  • Malware
  • PaaS
  • Parental Controls
  • Passwords
  • Phishing
  • Process Information
  • Ransomware
  • Rogue programs
  • Rootkits
  • SaaS
  • Security Advisories
  • Spam
  • Spyware
  • Trojans
  • Viruses
  • Web Browsers
  • Worms

Blog Archive

  • ►  2013 (173)
    • ►  December (6)
    • ►  November (13)
    • ►  October (11)
    • ►  September (20)
    • ►  August (4)
    • ►  July (17)
    • ►  June (31)
    • ►  May (25)
    • ►  April (15)
    • ►  March (17)
    • ►  February (7)
    • ►  January (7)
  • ►  2012 (86)
    • ►  November (2)
    • ►  October (4)
    • ►  September (6)
    • ►  August (6)
    • ►  July (11)
    • ►  June (1)
    • ►  May (5)
    • ►  April (7)
    • ►  March (7)
    • ►  February (17)
    • ►  January (20)
  • ▼  2011 (239)
    • ►  December (8)
    • ►  November (18)
    • ►  October (21)
    • ►  September (24)
    • ►  August (28)
    • ►  July (32)
    • ►  June (16)
    • ►  May (23)
    • ►  April (15)
    • ▼  March (16)
      • How to Remove MS Removal Tool (Uninstall Guide)
      • Smartphone Security: Using Your Mobile Phone Safely
      • Remove Android.Zeahache (Uninstall Guide)
      • Facebook Security and Privacy Best Practices
      • How to Remove CleanThis (Uninstall Guide)
      • How to Remove Best Malware Protection (Uninstall G...
      • How to Remove E-Set Antivirus 2011 (Uninstall Guide)
      • How to Remove System Cleaner (Uninstall Guide)
      • Remove "Windows license locked!" Ransomware
      • Antivired.com and other Antivirus Monitor Related ...
      • Fake avast! Antivirus: Avast-antivirus-francais.exe
      • Remove "You have committed network crime!" Ransomware
      • How to Remove System Defender (Uninstall Guide)
      • Remove Trojan.Ransomware (Uninstall Guide)
      • How to Remove Antivirus Monitor (Uninstall Guide)
      • How to Remove Android Rootcager (Uninstall Guide)
    • ►  February (9)
    • ►  January (29)
  • ►  2010 (2)
    • ►  December (2)
Powered by Blogger.

About Me

Unknown
View my complete profile