Cleaner2009 is a rogue security software, it is a false anti-spyware application that is generally installed in the user’s computer by dangerous trojans (such as Zlob and false video codecs), but it can also be installed manually by the victim.
Once your computer is infected with this parasite, it will immediately displays security warnings, alerts and system scans stating that your computer is heavily infected. These warnings are all false and are only displayed to make you think your computer is truly infected and that it is necessary to buy the full version of the software to remove the so-called infections.
This program installs also another rogue security software named Virus Remover 2009, also known as VRM2009, that is of the same family of Cleaner2009.
Make sure to not fall in this scam, if your computer is infected with Cleaner2009, it is recommended to remove it immediately and to scan your system with a real security software.
Symptoms of infection
- The process PP.exe is running in your system
- The process UCLN.exe is running in your system
- The process VRM2009.exe is running in your system
- The process ni_d.exe is running in your system
- Slow computer performance
- Repeated security warnings, alerts and system scans
- Web sites that suddenly are shown on your desktop
Malicious web sites and urls:
1 2 3 4 5 6 7 8
desktoprepairpackage.com (188.8.131.52) ulog.mycleaner2009.com (184.108.40.206) go-uniq.com (220.127.116.11) voidupdate.com () downl.removespywarethreats.com (18.104.22.168) removespywarethreats.com (22.214.171.124) cleanerpcsolution.com (126.96.36.199) mycleaner2009.com (188.8.131.52)
When the program is executed, it creates the following files:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
%ProgramFiles%\Cleaner2009 Freeware %ProgramFiles%\Cleaner2009 Freeware\unins000.exe %ProgramFiles%\Cleaner2009 Freeware\UCLN.exe %ProgramFiles%\Cleaner2009 Freeware\PP.exe %ProgramFiles%\Cleaner2009 Freeware\UserAgent.dll %ProgramFiles%\Cleaner2009 Freeware\remnag.dat %ProgramFiles%\Cleaner2009 Freeware\Appbase\ %AllUsers%\Start Menu\Programs\Cleaner2009 Freeware %AllUsers%\Start Menu\Programs\Cleaner2009 Freeware\Cleaner2009 Freeware.lnk %AllUsers%\Start Menu\Programs\Cleaner2009 Freeware\Cleaner2009 HomePage.url %AllUsers%\Start Menu\Programs\Cleaner2009 Freeware\Cleaner2009 Online Manual.url %AllUsers%\Start Menu\Programs\Cleaner2009 Freeware\Contact Customer Support.url %AllUsers%\Start Menu\Programs\Cleaner2009 Freeware\Uninstall Cleaner2009.lnk %User%\Desktop\Cleaner2009 Freeware.lnk %ProgramFiles%\VirusRemover2009 %ProgramFiles%\VirusRemover2009\VRM2009.exe %ProgramFiles%\VirusRemover2009\ExtSecurityCenter.exe %ProgramFiles%\VirusRemover2009\ExtSecurityCenter.xml %ProgramFiles%\VirusRemover2009\ExtSecurityCenter.ini %ProgramFiles%\VirusRemover2009\PP.exe %ProgramFiles%\VirusRemover2009\ni_d.exe %ProgramFiles%\VirusRemover2009\Uninstall.exe
The program creates the following registry entries:
1 2 3
HKCU\Software\Cleaner2009 Freeware HKLM\SOFTWARE\Cleaner2009 Freeware HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cleaner2009 Freeware
How to remove Cleaner2009 (manual removal) ?
- Kill the running process PP.exe
- Kill the running process UCLN.exe
- Kill the running process VRM2009.exe
- Kill the running process ExtSecurityCenter.exe
- Kill the running process ni_d.exe
- Unregister all the Cleaner2009 DLLs
- Delete all the Cleaner2009 files
- Delete all the Cleaner2009 registry entries
How to remove Cleaner2009 (automatic removal) ?
- Download and Install NoVirusThanks Malware Remover
- Update the database
- Click the button Scan
- Delete infected files