UltimateCleaner Description

UltimateCleaner is a rogue anti-spyware application that uses deceptive advertising tactics to trick you into purchasing the full downloadable version. UltimateCleaner is commonly brought onto your machine by a Trojan called Zlob which compromises your computer system and allows fake error messages to pop up on your Taskbar. After UltimateCleaner is installed, it will run a full scan on your computer and issue exaggerated spyware reports. After the scanning process is finished, a security message will pop up urging you to click on the button to purchase UltimateCleaner.

In some cases error messages will continue to pop up after you’ve either press “X” or “Cancel” button. Such malicious actions will not only put your computer at risk, but will also consume your machine’s processing power causing it to slow down severely or even crash. UltimateCleaner is designed for one purpose – to profit from vulnerable computer users by scaring them into buying the “full version” of the program. Immediate removal of UltimateCleaner is strongly recommended. UltimateCleaner is known to be a clone of UltimateDefender.

Type: Malware

How Can You Detect UltimateCleaner?

UltimateCleaner Technical Report

As new UltimateCleaner details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following UltimateCleaner files with its MD5s were created in the system:

UltimateCleaner has typically the following processes in memory:

• UltimateCleaner.exe
• iesafe.exe
• app.exe
• ucsecuredelete.dll

UltimateCleaner creates the following registry entries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Ultimate Cleaner
• HKEY_CLASSES_ROOT\AllFilesystemObjects\shellex\ContextMenuHandlers\UCSecureDelete
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ultimate Cleaner
• HKEY_ALL_USERS\Software\Ultimate Cleaner
• HKEY_CLASSES_ROOT\CLSID\{D0BD3D02-4A54-45D4-9502-7DB00F92392A}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\”{D0BD3D02-4A54-45D4-9502-7DB00F92392A}” = “UCSecureDelete”

Important Article Disclaimer