Free malware removal tool to remove CleanUp Antivirus

Written by Administrator | Thursday, 18 March 2010 00:00

CleanUp Antivirus is a rogue Antispyware, a scareware, it's a malware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are warned by a fake alarm that there are more malwares on your system. It’s true indeed, there is really a malware in your system but I think the only malware on your system is CleanUp Antivirus. It invites you to purchase a license to remove malware, do not, it's a scam, you need a license for a malware? This so-called Antivirus tries to scam you. Uninstall CleanUp Antivirus immediately from your system.

CleanUp Antivirus

To remove CleanUp Antivirus (Uninstall CleanUp Antivirus)

Download this free removal tool for CleanUp Antivirus
Extract it
Launch
Click on the delete button

CleanUp Antivirus will be removed from your system in 10s. Restart your computer when it’s finished.

Alias :

Mal/FakeAV-BW, Mal/FakeAV-BW [Sophos]
Trojan-Downloader.Win32.FakeVimes [Ikarus]
Win-Trojan/Fakeav.330752 [AhnLab]
packed with: PE_Patch.UPX [Kaspersky Lab]

Processes :

Cleanup.exe
CleanUpAV.exe

Files :

%Temp%\del.bat
%Temp%\[filename of the sample #1]
%CommonAppData%\[Random]
%AppData%\CleanUp Antivirus
%System%\CUASys
%System%\Quarantine Items
%CommonAppData%\[Random]\[Random].cfg
%CommonAppData%\[Random]
%CommonAppData%\[Random]\unins000.dat
%CommonAppData%\[Random]\CleanUpAV.exe
%CommonAppData%\[Random]\CUASys\[Random].bd
[%Desktop%]\CleanUp Antivirus.lnk
[%StartMenu%]\CleanUp Antivirus.lnk
[%Programs%]\CleanUp Antivirus.lnk
[%AppData%]\Microsoft\Internet Explorer\Quick Launch\CleanUp Antivirus.lnk
[%Desktop%]\Cleanup.exe

Registry

Created key :

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Created values :

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- CUA = ""%CommonAppData%\e4a12b7\CleanUpAV.exe" /s"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
- CUA = "%Temp%\[filename of the sample #1] /cs:1 "
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer
- IIL = 0x00000000
- ltHI = 0x00000000
- ltTST = 0x0000B491
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
- TrialVersion = ""%CommonAppData%\03b8\CleanUpAV.exe" /s"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,
- CleanUp Antivirus="[%COMMON_APPDATA%]\e7f76a8\CUe7f7.exe" /s /d