Index Introduction Database Detailed Entries Updates Concise List HJT Forums Rogues Message Board

Rogues - ErrClean family

Currently, there are 29 variants (that I know) of the rogue system error and cleaning utility known as ErrClean. They make exaggerated reports of errors on the computer in order to goad the user into buying a full license for the application to fix these errors. The applications can be manually downloaded and installed, or if your system is vulnerable (without current, adequate protection), they may be installed by a downloader - without the user's consent.

Please note that throughout this page I only refer to the HijackThis (or HJT) startup entries and not all associated files - to keep in with the theme of the rest of the site. Note that if you have more than one rogue installed that uses a file common to other rogues the HJT log entry (and maybe filename) could have a pair of () with number inside appended, i.e., HKLM\..\Run: [Salestart(1)]. See here for an example of such a log.

ErrClean

The following image (© Symantec) shows the main screen for ErrClean (click on the image for a larger version - applies throughout):

ErrClean

HijackThis (or HJT) log startup entries identified:

The one file they all share (although a different version in each case obviously) is SysRep.exe. Many of the others are also shared between the variants - but not necessarily always the same one, as you'll see below. In addition, the entries above are from a number of different logs - presumably from different versions of the rogue.

Other registry entries identified:

External links:

Any removal guide referred to below uses MalwareBytes Anti-Malware, which incorporates the functionality from their popular (but now discontinued) RogueRemover products:

MalwareBytes Anti-Malware

Variants

Before dealing with the individual variants, here are some screenshots from some of them (© BleepingComputer) showing the common user interface:

BugsDestroyer CleanPCTool HardDriveGuard ProtectingTool SafeHardDrive WinPCDoctor

Index

AhorreMemoria FestPlattenCleaner ProtezioneSoft StorageProtector
BeschermingsTool HardDriveGuard ReparateurDeSysteme SysDepannage
BugsDestroyer HataDuzelticisi SafeHardDrive SystemErrorFixer
CleanPCTool LibreSystem SafePCTool SystemOrdnare
CleanupTool PCToolPro SchijfBewaker ToolSicuro
DiskRetter ProtectingTool SicherheitsTool UtilisateurSur
DokterFix ProtejaseuDrive SolutionReg WinPCDoctor
ErreurChasseur      

AhorreMemoria

HJT log entries:

BeschermingsTool

(Dutch → "Conservation Tool")

HJT log entries:

BugsDestroyer

HJT log entries:

External links:

CleanPCTool

HJT log entries:

External links:

CleanupTool

HJT log entries:

DiskRetter

(German → "Disk Saviour")

HJT log entries:

DokterFix

(Dutch → "Doctor Fix")

HJT log entries:

Other registry entries:

ErreurChasseur

(French → "Error Hunter")

HJT log entries:

FestPlattenCleaner

(German → "Disk Cleaner")

HJT log entries:

HardDriveGuard

HJT log entries:

External links:

HataDuzelticisi

(Turkish → "Error ??")

Registry entries:

Other registry entries:

LibreSystem

(French → "Free System")

HJT log entries:

PCToolPro

HJT log entries:

External links:

ProtectingTool

HJT log entries:

External links:

ProtejaseuDrive

HJT log entries:

ProtezioneSoft

(Italian → "Soft Protection")

HJT log entries:

ReparateurDeSysteme

(French → "System Repairs")

HJT log entries:

SafeHardDrive

HJT log entries:

External links:

SafePCTool

HJT log entries:

External links:

SchijfBewaker

(Dutch → "DiscGuard")

HJT log entries:

SicherheitsTool

(Dutch → "Security Tool")

HJT log entries:

SolutionReg

HJT log entries:

StorageProtector

HJT log entries:

External links:

SysDepannage

(French)

HJT log entries:

Other registry entries:

SystemErrorFixer

HJT log entries:

SystemOrdnare

(Swedish → "Ancillary System")

HJT log entries:

Other registry entries:

ToolSicuro

(Italian)

HJT log entries:

UtilisateurSur

(French → "On User")

HJT log entries:

WinPCDoctor

HJT log entries:

External links:

Back to Rogues - Overview

Copyright © Pacman's Portal, 2001 - 2016
Powered by Malwarebytes
All rights reserved

Valid XHTML 1.0 Transitional

Privacy Policy Site Map Home