Sign in to follow this  
Metallica

Removal instructions for Magic Pc Cleaner

Recommended Posts

What is Magic Pc Cleaner?

The Malwarebytes research team has determined that Magic Pc Cleaner is a "system optimizer". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.

How do I know if I am infected with Magic Pc Cleaner?

This is how the main screen of the sytem optimizer looks:

main.png

You will find these icons in your taskbar and on your desktop:

icons.png

and see these warnings during "operations":

warning2.png

warning1.png

clean.png

You may see this entry in your list of installed programs:

warning4.png

and this Scheduled Task:

warning3.png

How did Magic Pc Cleaner get on my computer?

These so-called system optimizers use different methods of getting installed. This particular one was downloaded from their site.

How do I remove Magic Pc Cleaner?

Our program Malwarebytes can detect and remove this potentially unwanted application.
  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of Magic Pc Cleaner?
  • No, Malwarebytes removes Magic Pc Cleaner completely.
  • This PUP creates a scheduled task. You can read here how to check for and, if necessary, remove Scheduled Tasks.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this system optimizer.

As you can see below the full version of Malwarebytes would have protected you against the Magic Pc Cleaner installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.
 

protection1.png


and we block access to their domains.

Technical details for experts

You may see these entries in FRST logs:
 
 () C:\Program Files (x86)\SystemOptimizer\MagicPcCleaner.exe
 () C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\MagicPcCleaner.exe
 InternetURL: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemCleaner.url -> file:///C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\MagicPcCleaner.exe
 C:\Users\{username}\AppData\Local\MagicPcCleaner
 C:\Users\Public\Desktop\Magic PC Cleaner.lnk
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Magic Pc Cleaner
 C:\Program Files (x86)\Magic Pc Cleaner
 (Magic Pc Cleaner) C:\Users\{username}\Desktop\MPCSetup.exe
 C:\Windows\System32\Tasks\Microsoft Essentials
 C:\Users\{username}\AppData\Roaming\Magic Pc Cleaner
 C:\Program Files (x86)\SystemOptimizer

Magic Pc Cleaner (HKLM-x32\...\{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}) (Version: 1.0.0 - Magic Pc Cleaner)
Task: {5E313F6C-5A9D-46F4-BDA7-8A7358B73F91} - System32\Tasks\Microsoft Essentials => C:\Program Files (x86)\SystemOptimizer\MagicPcCleaner.exe [2017-05-04] ()
Alterations made by the installer:
 
File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner
       Adds the file MagicPcCleaner.exe"="4/22/2017 11:28 PM, 2603168 bytes, A
       Adds the file MagicPcCleaner.exe.config"="2/28/2017 8:06 AM, 4371 bytes, A
       Adds the file Telerik.WinControls.dll"="5/3/2016 8:24 PM, 2840064 bytes, A
       Adds the file Telerik.WinControls.Themes.HighContrastBlack.dll"="5/3/2016 8:25 PM, 220160 bytes, A
       Adds the file Telerik.WinControls.UI.dll"="5/3/2016 8:25 PM, 4663296 bytes, A
       Adds the file TelerikCommon.dll"="5/3/2016 8:24 PM, 340480 bytes, A
       Adds the file Trial.dll"="4/22/2017 11:30 PM, 609440 bytes, A
       Adds the file UtilityInfo.xml"="5/10/2017 8:11 AM, 429 bytes, A
    Adds the folder C:\Program Files (x86)\SystemOptimizer
       Adds the file GuidInfo.xml"="5/10/2017 8:00 AM, 140 bytes, A
       Adds the file MagicPcCleaner.exe"="5/4/2017 12:04 PM, 5899752 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Magic Pc Cleaner
       Adds the file Magic PC Cleaner.lnk"="5/10/2017 8:01 AM, 2154 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\MagicPcCleaner\MagicPcCleaner.exe_Url_c555nk35rwj3gbeq3ywwn5witprathsd\1.0.0.0
       Adds the file user.config"="5/10/2017 8:11 AM, 2549 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Magic Pc Cleaner\Magic Pc Cleaner 1.0.0\install
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
       Adds the file SystemCleaner.url"="5/10/2017 8:11 AM, 208 bytes, A
    In the existing folder C:\Users\{username}\Desktop
       Adds the file MPCSetup.exe"="5/10/2017 8:00 AM, 8673600 bytes, A
    In the existing folder C:\Users\Public\Desktop
       Adds the file Magic PC Cleaner.lnk"="5/10/2017 8:01 AM, 2136 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file Microsoft Essentials"="5/10/2017 8:00 AM, 3282 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A4E49A4-F3DC-812D-C381-9A605CC1AA3A}\2552459366]
       "(Default)"="REG_SZ", "HYNFYFZ45E54G"
       "{7A4E49A4-F3DC-812D-C381-9A605CC1AA3A}"="REG_SZ", "RX5VQYX9TK8S"
       "2552459366"="REG_SZ", "E6NFYFZ45E54G"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22235BA8-0905-B68E-A5A7-0A4D737428CC}\2825635452]
       "(Default)"="REG_SZ", "RYO4bmh3PwN"
       "{22235BA8-0905-B68E-A5A7-0A4D737428CC}"="REG_SZ", "Sc62"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
       "C:\Program Files (x86)\Magic Pc Cleaner\"="REG_SZ", ""
       "C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\"="REG_SZ", ""
       "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Magic Pc Cleaner\"="REG_SZ", "1"
       "C:\Windows\Installer\{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}\"="REG_SZ", ""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Caphyon\Advanced Installer\LZMA\{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}\1.0.0]
       "AI_ExePath"="REG_SZ", "C:\Users\{username}\Desktop\MPCSetup.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Magic Pc Cleaner\Magic Pc Cleaner]
       "Path"="REG_SZ", "C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\"
       "RegistrationDate"="REG_SZ", ""
       "Version"="REG_SZ", "1.0.0"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}]
       "AuthorizedCDFPrefix"="REG_SZ", ""
       "Comments"="REG_SZ", "This installer database contains the logic and data required to install Magic Pc Cleaner."
       "Contact"="REG_SZ", "www.magic-pc-cleaner.com"
       "DisplayName"="REG_SZ", "Magic Pc Cleaner"
       "DisplayVersion"="REG_SZ", "1.0.0"
       "EstimatedSize"="REG_DWORD", 11023
       "HelpLink"="REG_EXPAND_SZ, "www.magic-pc-cleaner.com"
       "HelpTelephone"="REG_SZ", ""
       "InstallDate"="REG_SZ", "20170510"
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\"
       "InstallSource"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Magic Pc Cleaner\Magic Pc Cleaner 1.0.0\install\"
       "Language"="REG_DWORD", 1033
       "ModifyPath"="REG_EXPAND_SZ, "MsiExec.exe /I{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}"
       "Publisher"="REG_SZ", "Magic Pc Cleaner"
       "Readme"="REG_SZ", ""
       "Size"="REG_SZ", ""
       "UninstallString"="REG_EXPAND_SZ, "MsiExec.exe /I{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}"
       "URLInfoAbout"="REG_SZ", "www.magic-pc-cleaner.com"
       "URLUpdateInfo"="REG_SZ", "www.magic-pc-cleaner.com"
       "Version"="REG_DWORD", 16777216
       "VersionMajor"="REG_DWORD", 1
       "VersionMinor"="REG_DWORD", 0
       "WindowsInstaller"="REG_DWORD", 1
    [HKEY_USERS\.DEFAULT\Software\Classes\CLSID\{7A4E49A4-F3DC-812D-C381-9A605CC1AA3A}\2552459366]
       "(Default)"="REG_SZ", "HYNFYFZ45E54G"
       "{7A4E49A4-F3DC-812D-C381-9A605CC1AA3A}"="REG_SZ", "RX5VQYX9TKWS"
       "2552459366"="REG_SZ", "HYNFYFZ45E54G"
    [HKEY_USERS\.DEFAULT\Software\Classes\Interface\{22235BA8-0905-B68E-A5A7-0A4D737428CC}\2825635452]
       "(Default)"="REG_SZ", "RYO4bmh3PwN"
       "{22235BA8-0905-B68E-A5A7-0A4D737428CC}"="REG_SZ", "Sc62"
    [HKEY_CURRENT_USER\Software\Classes\Wow6432Node\CLSID\{7A4E49A4-F3DC-812D-C381-9A605CC1AA3A}\2552459366]
       "{7A4E49A4-F3DC-812D-C381-9A605CC1AA3A}"="REG_SZ", "RX5VQYX9TK8S"
       "2552459366"="REG_SZ", "E6NFYFZ45E54G"
Malwarebytes log:
 
Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 5/10/17
Scan Time: 8:25 AM
Logfile: mbamMagicPCCleaner.txt
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.103
Update Package Version: 1.0.1908
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 330426
Time Elapsed: 1 min, 52 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 2
PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\MagicPcCleaner.exe, Quarantined, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\PROGRAM FILES (X86)\SYSTEMOPTIMIZER\MAGICPCCLEANER.EXE, Quarantined, [891], [396750],1.0.1908

Module: 3
PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\MagicPcCleaner.exe, Quarantined, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\Trial.dll, Quarantined, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\PROGRAM FILES (X86)\SYSTEMOPTIMIZER\MAGICPCCLEANER.EXE, Quarantined, [891], [396750],1.0.1908

Registry Key: 4
PUP.Optional.MagicPCCleaner, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5788EE0A-93E6-4958-AFBD-EB13D1B6558C}, Delete-on-Reboot, [891], [396761],1.0.1908
PUP.Optional.MagicPCCleaner, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\MagicPcCleaner_RASAPI32, Delete-on-Reboot, [891], [396760],1.0.1908
PUP.Optional.MagicPCCleaner, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\MagicPcCleaner_RASMANCS, Delete-on-Reboot, [891], [396760],1.0.1908
PUP.Optional.MagicPCCleaner, HKLM\SOFTWARE\WOW6432NODE\Magic Pc Cleaner, Delete-on-Reboot, [891], [396759],1.0.1908

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 9
PUP.Optional.MagicPCCleaner, C:\Users\{username}\AppData\Roaming\Magic Pc Cleaner\Magic Pc Cleaner 1.0.0\install, Delete-on-Reboot, [891], [396755],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Users\{username}\AppData\Roaming\Magic Pc Cleaner\Magic Pc Cleaner 1.0.0, Delete-on-Reboot, [891], [396755],1.0.1908
PUP.Optional.MagicPCCleaner, C:\USERS\{username}\APPDATA\ROAMING\Magic Pc Cleaner, Delete-on-Reboot, [891], [396755],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner, Delete-on-Reboot, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\PROGRAM FILES (X86)\Magic Pc Cleaner, Delete-on-Reboot, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Users\{username}\AppData\Local\MagicPcCleaner\MagicPcCleaner.exe_Url_c555nk35rwj3gbeq3ywwn5witprathsd\1.0.0.0, Delete-on-Reboot, [891], [396756],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Users\{username}\AppData\Local\MagicPcCleaner\MagicPcCleaner.exe_Url_c555nk35rwj3gbeq3ywwn5witprathsd, Delete-on-Reboot, [891], [396756],1.0.1908
PUP.Optional.MagicPCCleaner, C:\USERS\{username}\APPDATA\LOCAL\MagicPcCleaner, Delete-on-Reboot, [891], [396756],1.0.1908
PUP.Optional.MagicPCCleaner, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MAGIC PC CLEANER, Delete-on-Reboot, [891], [396753],1.0.1908

File: 15
PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\MagicPcCleaner.exe, Delete-on-Reboot, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\MagicPcCleaner.exe.config, Delete-on-Reboot, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\Telerik.WinControls.dll, Delete-on-Reboot, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\Telerik.WinControls.Themes.HighContrastBlack.dll, Delete-on-Reboot, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\Telerik.WinControls.UI.dll, Delete-on-Reboot, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\TelerikCommon.dll, Delete-on-Reboot, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\Trial.dll, Delete-on-Reboot, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Program Files (x86)\Magic Pc Cleaner\Magic Pc Cleaner\UtilityInfo.xml, Delete-on-Reboot, [891], [396752],1.0.1908
PUP.Optional.MagicPCCleaner, C:\Users\{username}\AppData\Local\MagicPcCleaner\MagicPcCleaner.exe_Url_c555nk35rwj3gbeq3ywwn5witprathsd\1.0.0.0\user.config, Delete-on-Reboot, [891], [396756],1.0.1908
PUP.Optional.MagicPCCleaner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Magic Pc Cleaner\Magic PC Cleaner.lnk, Delete-on-Reboot, [891], [396753],1.0.1908
PUP.Optional.MagicPCCleaner, C:\PROGRAM FILES (X86)\SYSTEMOPTIMIZER\MAGICPCCLEANER.EXE, Delete-on-Reboot, [891], [396750],1.0.1908
PUP.Optional.MagicPCCleaner, C:\USERS\{username}\DESKTOP\MPCSETUP.EXE, Delete-on-Reboot, [891], [396751],1.0.1908
PUP.Optional.MagicPCCleaner, C:\USERS\{username}\DESKTOP\MAGICPCCLEANER.EXE, Delete-on-Reboot, [891], [396750],1.0.1908
PUP.Optional.MagicPCCleaner, C:\USERS\PUBLIC\DESKTOP\MAGIC PC CLEANER.LNK, Delete-on-Reboot, [891], [396754],1.0.1908
PUP.Optional.MagicPCCleaner, C:\USERS\{username}\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\SYSTEMCLEANER.URL, Delete-on-Reboot, [891], [396757],1.0.1908

Physical Sector: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.

Share this post


Link to post
Share on other sites
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.