CleanSafer
CleanSafer
Found:
2011-01-24
Description:
Win32.FraudTool.CleanSafer is a rogue anti-spyware application. It may give exaggerated threat reports on the compromised computer then ask the user to purchase a registered version to remove those reported threats.
Known system changes:
Files
Folders
%ProgramFiles%\cleansafer
RegistryEntries
Key: HKEY_LOCAL_MACHINE\SOFTWARE\cleansafer
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cleansafer
Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Value: FlashPlayerUpdate
Data: C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe