10 january, 2008
RegClean2Sqr
Updated: January 7, 2008 4:35:46 PM
Type: Misleading Application
Name: RegClean
Version: 2.7
Publisher: 2Squared
Risk Impact: Medium
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000
SUMMARY
Behavior
RegClean2Sqr is a misleading application that may give exaggerated reports of errors on the computer.Note: Virus definitions dated January 8th, 2008 or earlier may detect this application as RegClean.
Protection
- Initial Rapid Release version January 7, 2008 revision 017
- Latest Rapid Release version January 8, 2008 revision 006
- Initial Daily Certified version January 7, 2008 revision 022
- Latest Daily Certified version January 8, 2008 revision 022
- Initial Weekly Certified release date January 9, 2008
TECHNICAL DETAILS
BehaviorThe program must be manually installed.
The program reports false or exaggerated reports of errors on the computer.
The user is then prompted to pay for a full license of the application in order to remove the errors.
Installation
When the program is executed, it creates the following files:
- %UserProfile%\Application Data\RegClean\Log\2008 Jan 07 - 12_01_02 PM_031.log
- %UserProfile%\Application Data\RegClean\Log\2008 Jan 07 - 12_01_10 PM_843.log
- %UserProfile%\Desktop\200defs_SR\2007-12-31_Downloader.MisleadApp_setupxv.exe.1.exe
- %UserProfile%\Local Settings\Temp\symlcsv1.exe
- C:\Documents and Settings\All Users\Desktop\RegClean.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\RegClean\RegClean on the Web.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\RegClean\RegClean.lnk
- %ProgramFiles%\RegClean\DataBase.ref
- %ProgramFiles%\RegClean\Launcher.exe
- %ProgramFiles%\RegClean\RegClean.exe
- %ProgramFiles%\RegClean\RegClean.url
- %ProgramFiles%\RegClean\RegCleaner.dll
- %ProgramFiles%\RegClean\TCL.dll
- %ProgramFiles%\RegClean\zlib.dll
- %Windìr%\Installer\[RANDOM NAME].msi
- %Windìr%\Installer\{D6938AFF-30C4-409C-B667-3F6503750BB8}\Icon.exe
- %Windìr%\Tasks\RegClean Scheduled Scan.job
It may also create temporary files.
Next, the program creates the following registry entry so that it executes whenever Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"RegClean" = "%ProgramFiles%\RegClean\RegClean.exe"
The risk also creates the following entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"C:\Program Files\RegClean\" = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"C:\Documents and Settings\All Users\Start Menu\Programs\RegClean\" = ""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\"C:\WINDOWS\Installer\{D6938AFF-30C4-409C-B667-3F6503750BB8}\" = ""
It also creates the following registry subkeys:
- HKEY_CURRENT_USER\Software\RegClean
- HKEY_CLASSES_ROOT\Installer\Features\FFA8396D4C03C9046B76F3563057B08B
- HKEY_CLASSES_ROOT\Installer\Products\FFA8396D4C03C9046B76F3563057B08B
- HKEY_CLASSES_ROOT\Installer\UpgradeCodes\8E650C92721B8364BB774E25145C382A
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D6938AFF-30C4-409C-B667-3F6503750BB8}
- HKEY_LOCAL_MACHINE\SOFTWARE\RegClean
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\350A43477F3E8D94EAB18377D1E7421D\FFA8396D4C03C9046B76F3563057B08B
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3D1033F8162A79449B35709F1E31AF3B\FFA8396D4C03C9046B76F3563057B08B
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6121E96C162F8C64BAF0CE846F8186E5\FFA8396D4C03C9046B76F3563057B08B
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\78A0FBA817F2FC044AE7F3078863CC1B\FFA8396D4C03C9046B76F3563057B08B
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8AE7DA13A8A50784EB8DB6C0C9CB5A00\FFA8396D4C03C9046B76F3563057B08B
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\96561E3A346665E4AA79D997C23D33FB\FFA8396D4C03C9046B76F3563057B08B
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9F4D2600F2086F948BF0217B8EEAF075\FFA8396D4C03C9046B76F3563057B08B
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B6EC329EDEB1E1F49A774B220E15682A\FFA8396D4C03C9046B76F3563057B08B