Registry Cleaners

Looking at the Registry Cleaners ads, they all want to Boost / Improve Speed / Speed Up the computer / Increasing Performance of the system / Removing BSOD / Fix Errors, crashes, and freezes / (...) by cleaning the registry.

Registry Cleaners are useless. On a brand new Windows installation, all these cleaners will detect +100 errors to solve (From Empty keys to File Association errors ... ).

CyberDefender Registry Cleaner


PC Doc Pro


Error Fix


RegTool


Reg Fix


ErrorEasy


Of course, buying a license is necessary to "fix" these so called errors. These optimization tools will never Boosts Windows speeds up to 800% :

System Mechanics Boosts Windows speeds up to 800%


In February Microsoft Malware Protection Center reported RegCure from Paretologic (a MS Certified Partner) as Program:Win32/RegCure.

Program:Win32/RegCure is a program that is promoted as a system optimization tool. This program may display deceptive or fraudulent claims about files, registry entries and/or other items on the system.

Avoid these fraudulent tools.

Registry Elite

Registry Elite is a fake registry cleaner. It detects Fake registry problems, file association errors and other symptoms on a brand new system (383 errors on this capture test (Windowns XP SP3 installed few minutes ago).



registryelite.com (67.227.208.84)
tweaklogic.com (67.227.208.84)

Registry Elite is a clone of PC Doc Pro

PC Doc Pro

PC Doc Pro is a fake registry cleaner. It detects Fake registry problems, file association errors and other symptoms on a brand new system (192 errors on this capture test (Windowns XP SP3 installed few minutes ago).



pcdocpro.com (72.52.146.60)
spydocpro.com (72.52.146.60)
spyresearchcenter.com (72.52.146.60)

PC Doc Pro is a clone of Registry Elite

Digiweb corp. rogues

Digiweb corp. (aka ibisweb corp , G. Kavalakis) makes fake security softwares. They detect nonexistent problems (Spyware, Registry, IE Cache, Cookies,...) to scare users.
Some of their products have the old interface, some others have the new one.

RegistryCleanerPro new and old GUI:



AntiMalwarePro new and old GUI:



AdwarePro new and old GUI:



AntivirusPro new and old GUI:



AntiSpywarePro


AntiTrojanPro


SpywareDestroyer


SearchAndDestroy

Presto TuneUp

PrestoTuneUp is a new fake optimizer/cleaner (rogue). It is a clone of My Supervisor.

PrestoTuneUp is made by the same creators of: FastAntivirus, MalwareCatcher, VirusShield, Extra Antivirus, Virus Sweeper, Ultra Antivir 2009, Virusdoctor, VirusMelt, VirusAlarm.

Presto TuneUp detects nonexistent problems (registry, IE Cache, Cookies,...) to scare users. Unlike FastAntivirus/MalwareCatcher family, PrestoTuneUp doesn't detect malware.



Thanks to Bharath

ErrorEasy

ErrorEasy is a rogue that belongs to the same family as ErrorFix, RegTool, RegfixPro.
These fake tools are not detecting infected files or malwares but fake registry problems.



Another rogue (ErrorRepairTool) shows a relationship between, PC Utility Inc. (the editor of these tools) and 2Squared.com (a known rogue editor). But PC Utility Inc. claims that their products are legit and there is no relationship with 2Squared.com.

IP of ErrorRepairTool websites and the name of the company in the privacy page:
updatesprofessional.com (174.36.234.248) 2Squared Inc.
updates-micro.com (174.36.234.248) 2Squared Inc.
fixupdates.com (174.36.234.248) 2Squared Inc.
fix-xp.com (174.36.234.248) 2Squared Inc.
registry-updates.com (174.36.234.248) 2Squared Inc.

errorrepairtool.com (75.125.61.163) PC Utility Inc.
errorstool.com (75.125.61.163) PC Utility Inc.
errorsrepair.com(75.125.61.163) PC Utility Inc.

All pages where PC Utility Inc. was quoted have been removed (they were online yesterday). Google keeps some traces about it:


It was exactly the same page, but 2Squared Inc. was replaced by PC Utility Inc.


Back to ErrorEasy. To update itself, ErrorEasy contacts
ErrorEasy.com/databases/getinfo.php
database.registrysmart.com/updates/definitions.db
database.privacycontrol.com/updates/privacy.db

Looks like déja-vu, see RegistryFox Rogue (from another known rogue company: AntiSpyware LLC.).

database.registrysmart.com (75.125.200.226)
adwarealert.com (75.125.200.226)
evidenceeraser.com (75.125.200.226)
registrysmart.com (75.125.200.226)
restore-pc.com (75.125.200.226)

privacycontrol.com (75.125.61.162)
errorsweeper.com (75.125.61.162)
antispywarebot.com (75.125.61.162)
regclean.com (75.125.61.162)
2squared.com (75.125.61.162)

In the code of ErrorEasy, there is a hardcoded URL to 2Squared.com:



The Database is the same as AntiSpyware LLC. rogue.
There is a hardcoded string of 2Squared.com in the PC Utility Inc. tool.
And no relationship ?

ErrorFix, RegTool, RegfixPro

ErrorFix, RegTool, RegfixPro are new rogues. They are from the same family and have the same GUI. These fake tools are not detecting infected files or malware but fake registry problems.







Malwarebytes removal instructions for ErrorFix, RegTool, RegFix Pro.

RegistryFox Rogue

RegistryFox is a Fake Security application from AntiSpyware LLC. The same company that use to create SmitfraudFixTool rogue (from the original and legit application SmitfraudFix), MalwareRemovalBot Rogue, and many other fake stuff.



The two rogue websites are hosted on the same server:
malwareremovalbot.com (74.53.169.2)
registryfox.com (74.53.169.2)

The application is contacting database.registrysmart.com (75.125.200.226) to update the "heavy" data base: 7Kb. IP shared with other rogues softwares:
adwarealert.com (75.125.200.226)
evidenceeraser.com (75.125.200.226)
registrysmart.com (75.125.200.226)
restore-pc.com (75.125.200.226)

In the code, there is a reference to file (DataBase.ref) downloaded from 2squared.com (75.125.61.162):
antispywarebot.com (75.125.61.162)
errorsweeper.com (75.125.61.162)
privacycontrol.com (75.125.61.162)
regclean.com (75.125.61.162)

There is also a link to Antispyware 2009 Rogue setup:
antispyware.com (75.125.241.58)
adwarebot.com (75.125.241.58)
antispyware2009.com (75.125.241.58)
errorsmart.com (75.125.241.58)
regsweep.com (75.125.241.58)

Thanks to NoVirusThanks

Registry Cleaner

Registry Cleaner rogue installs itself with fake warning messages displayed by a Trojan Downloader.