XPCleaner

Behavior
The program must be manually installed.

The program reports false or exaggerated system security threats on the computer.





The user is then prompted to pay for a full license of the application in order to remove the errors.








Installation
When the program is executed, it creates the following files:

• %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\XP Cleaner.lnk
• %UserProfile%\Desktop\XP Cleaner.lnk
• %UserProfile%\Start Menu\XP Cleaner\Uninstall XP Cleaner.lnk
• %UserProfile%\Start Menu\XP Cleaner\XP Cleaner.lnk
• %ProgramFiles%\XP Cleaner\cats.lst
• %ProgramFiles%\XP Cleaner\list.lst
• %ProgramFiles%\XP Cleaner\xpc.exe

Next, the program creates the following registry entry so that it executes whenever Windows starts:
HKEY_ALL_USERS\Software\Microsoft\Windows\CurrentVersion\Run\"XP Cleaner" = "C:\Program Files\XP Cleaner\xpc.exe"

It also creates the following registry subkey:
HKEY_ALL_USERS\Software\XP Cleaner

Summary