Related to the notorious malware applications known as Security Antivirus and My Security Wall, Cleanup Antivirus uses scare tactics to trick users into paying for its software license. Cleanup Antivirus gets installed on the user’s system via Trojans that get downloaded from malicious websites along with fake video/audio codec packs or get downloaded on to the user’s system as an infected PDF file. Once installed, Cleanup Antivirus takes measures to prevent its removal by disabling Windows utilities such as Task Manager and Registry Editor. Cleanup Antivirus proceeds to perform a large number of fake security scans on the system, generating false reports which state that the computer is under threat from malware. It also generates an endless stream of fake warning pop-ups from the Windows taskbar. Meanwhile, Cleanup Antivirus repeatedly requests the user to purchase a license to the ‘full’ version of the software, claiming that the currently installed ‘trial’ version is insufficient to remove all the detected ‘threats’. It enforces this request through its GUI, through pop-ups and through the results of fake scans. However, it is important to note that this is a fake security application and therefore none of its versions are capable of properly scanning or cleaning any system.
The following section provides an overview of how to remove Cleanup Antivirus. Cleanup Antivirus removal involves the deletion of files and folders and the removal of registry entries.
File Removal Procedures
When discussing how to remove Cleanup Antivirus, the first step is to delete the following files and folders:
- %Documents and Settings%\All Users\Application Data\[randomsymbols]\
- %Documents and Settings%\[UserName]\Application Data\CleanUp Antivirus
- %Documents and Settings%\[UserName]\Application Data\Microsoft\Internet Explorer\Quick Launch\CleanUp Antivirus.lnk
- %Documents and Settings%\[UserName]\Application Data\CleanUp Antivirus\cookies.sqlite
- %Documents and Settings%\[UserName]\Desktop\CleanUp Antivirus.lnk
- %Documents and Settings%\[UserName]\Start Menu\CleanUp Antivirus.lnk
- %Documents and Settings%\[UserName]\Start Menu\Programs\CleanUp Antivirus.lnk
- %Program Files%\Mozilla Firefox\searchplugins\search.xml
Once this step has been completed, your file system is free of Cleanup Antivirus files and therefore it is safe to progress to the next step.
Registry Removal Procedures
In order to completely remove Cleanup Antivirus, it is necessary to remove the following keys and settings from the Windows Registry:
- HKEY_CURRENT_USER\Software\CleanUp Antivirus
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer “PRS” =”http://127.0.0.1:27777/?inj=%ORIGINAL%”
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “RunInvalidSignatures” = “1?
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “App/7.00195?
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “CleanUp Antivirus”
Once the registry has been cleaned, you have completed the process of Cleanup Antivirus removal. However, in order to make sure of this fact it is recommended to scan the entire PC using genuine antivirus software such as Spyware Doctor with Antivirus.
Conclusion
Even though an inexperienced computer user may have full knowledge on how to remove Cleanup Antivirus, it is not recommended that they attempt it as any mistake made during removal could cause damage to the system. Therefore inexperienced users are advised to make use of a web-based malware scanning/cleaning service such as www.onlinecomputerrepair.org or legitimate antivirus software to remove Cleanup Antivirus properly and securely without any risk of data loss.