PCClean

Behavior
The program must be manually installed.

The program reports false or exaggerated system security threats on the computer.





The user is then prompted to pay for a full license of the application in order to remove the errors.





Installation
When the program is executed, it creates the following files:

• %UserProfile%\Application Data\PC-Cleaner\log.dat
• %UserProfile%\Application Data\PC-Cleaner\settings.dat
• %UserProfile%\Desktop\PC-Cleaner.lnk
• %UserProfile%\Local Settings\Temp\[RANDOM FILE NAME].tmp
• C:\Documents and Settings\All Users\Start Menu\Programs\PC-Cleaner\Register PC-Cleaner.lnk
• C:\Documents and Settings\All Users\Start Menu\Programs\PC-Cleaner\Start PC-Cleaner.lnk
• C:\Documents and Settings\All Users\Start Menu\Programs\PC-Cleaner\Uninstall PC-Cleaner.lnk
• %ProgramFiles%\PC-Cleaner\com\pcsd.dll
• %ProgramFiles%\PC-Cleaner\PC-Cleaner.db
• %ProgramFiles%\PC-Cleaner\PC-Cleaner.exe
• %ProgramFiles%\PC-Cleaner\pccleaner.pkg
• %ProgramFiles%\PC-Cleaner\program.info
• %ProgramFiles%\PC-Cleaner\Uninstall.exe

Next, the program creates the following registry entry so that it executes whenever Windows starts:
HKEY_ALL_USERS\Software\Microsoft\Windows\CurrentVersion\Run\"PC-Cleaner" = ""C:\Program Files\PC-Cleaner\PC-Cleaner.exe" hide"

The program then creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{82297D11-31C1-40B1-960A-BDF40B3B365F}" = "pcsd"
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{022E7B1E-65A4-4963-9C72-134D0498C5AE}" = "pcsd"

It also creates the following registry subkeys:

• HKEY_LOCAL_MACHINE\SOFTWARE\PC-Cleaner
• HKEY_CLASSES_ROOT\AllFilesystemObjects\shellex\ContextMenuHandlers\pcsd
• HKEY_CLASSES_ROOT\CLSID\{82297D11-31C1-40B1-960A-BDF40B3B365F}
• HKEY_CLASSES_ROOT\CLSID\{022E7B1E-65A4-4963-9C72-134D0498C5AE}
• HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC-Cleaner
• HKEY_LOCAL_MACHINE\SOFTWARE\PC-Cleaner
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82297D11-31C1-40B1-960A-BDF40B3B365F}
• HKEY_CURRENT_USERS\Software\PC-Cleaner

Summary