internetinspiration logo
             
Home Internet Guides Privacy & Security Must have software Internet Shopping Earn Money Fun & Games Freebies

Privacy & Security
Remove alfacleaner

The removal tool/procedure for AlphaCleaner on this page has been replaced by Roguefix.
A new comprehensive scan and delete utility for the family of rogue scanners and their installing/accompanying trojans
Roguefix, click here


AlfaCleaner is yet another spyware cleaner that is installed by a trojan and then displays fake infections in an attempt to trick owners of infected machines into buying the scanner.
The company behind this, and other similar applications (Anti Virus Pro, Winhound, Spyware Remover, SpyContra and SpyDeface are a few) is innovagest2000.com

Visible signs of infection.
Your desktop will be changed to a black background with a warning that your computer is infected with spyware,.
The AlfaCleaner scanner will 'perform a scan' and display fake infections.
Balloons will appear from an orange triangle, or other icon in the system tray. (bottom right hand of your screen, near the clock).

It may shut down the PC if an attempt to remove it using usual add/remove programs in the control panel.

You will need

1) SmitRem.zip A tool created by noadfear to remove the trojan. Download the .zip file to your desktop and extract the files ready for use.

2) Pocket killbox, from Here, to your desktop. Extract the files from the .zip folder ready for use.
Killbox is a small application created by Option^Explicit, www.bleepingcomputer.com to remove stubborn files and folders.

3) Ace Utilities (free trial), a comprehensive disk and registry cleaner to remove the remnants.

4) regfixAC.reg. A small file to clean the registry. Save it to your desktop.

Removal proceedure

1 Open Pocket killbox from the Killbox file on your desktop.
Copy and Paste the following files into the Paste Full path of File to Delete box, according to the version of Windows you use. (Note: If your Windows folders are stored on a drive other than C you must change the letter in the file path accordingly)
You should enter each file path one at a time, select Delete on reboot and click the Kill file button (Red circle with white cross), and click No to reboot now, at the prompt.
If you receive a 'file cannot be found' message, just move onto the next one.

For Windows XP
C:\ntzl.exe
C:\winstall.exe
C:\Windows\uninstDsk.exe
C:\Windows\warnhp.html
C:\Windows\System32\intell321.exe
C:\Windows\System32\voi271.exe
C:\Windows\System32\voi640.exe
C:\Documents and Settings\Administrator\Application Data\AlfaCleaner
C:\Documents and Settings\Administrator\Application Data\Skinux
C:\Documents and Settings\Administrator\Application Data\Skinux\AlfaCleaner
C:\Documents and Settings\LocalService\Application Data\AlfaCleaner
C:\Program Files\AlfaCleaner

For Windows NT/2000
C:\ntzl.exe
C:\winstall.exe
C:\Windows\uninstDsk.exe
C:\Windows\warnhp.html
C:\Winnt\System32\intell321.exe
C:\Winnt\System32\voi271.exe
C:\Winnt\System32\voi640.exe
C:\Documents and Settings\Administrator\Application Data\AlfaCleaner
C:\Documents and Settings\Administrator\Application Data\Skinux
C:\Documents and Settings\Administrator\Application Data\Skinux\AlfaCleaner
C:\Documents and Settings\LocalService\Application Data\AlfaCleaner
C:\Program Files\AlfaCleaner

For Windows 95/98/ME
C:\ntzl.exe
C:\winstall.exe
C:\Windows\uninstDsk.exe
C:\Windows\warnhp.html
C:\Windows\System\intell321.exe
C:\Windows\System\voi271.exe
C:\Windows\System\voi640.exe
C:\Documents and Settings\Administrator\Application Data\AlfaCleaner
C:\Documents and Settings\Administrator\Application Data\Skinux
C:\Documents and Settings\Administrator\Application Data\Skinux\AlfaCleaner
C:\Documents and Settings\LocalService\Application Data\AlfaCleaner
C:\Program Files\AlfaCleaner


When all the files are entered, close Killbox.

2. Double click on the regfixAC.reg on your desktop. Click OK at the prompts to confirm you want to run the file.

3. Restart your PC in Safe ModeHow to, and open the Smitrem file, click the runthis.bat icon. When the removal proceedure is complete, restart your PC normally.

4. Open Ace utilities

Perform the following scans, whilst we are targeting spyfalcon, this cleaner will remove many other redundant or obsolete files and registry keys.

Click clean up , select remove Junk Files.
Scan and delete everything found. Close the remove junk files box.

Select Clean system registry.
Click options and select Thorough. Scan and delete everything found. Close the Clean system registry box.

Select Erase History, click the Windows tab and select the following-
Empty the Windows Prefetch Folder.
Delete empty folders on the Windows Temp folder.
Erase Folder streams in the Windows registry.
Clear past icon history of system tray

Click Execute Now

Click the internet Explorer/MSN tab and select the following-
Delete cookies
Delete locked URL cache file.
Clear typed URL's of Address bar
Clear Browser History
Delete Cache (Files in temporary Internet folder)

Click Execute Now.

Any remaining icons on your desktop or start menu can be removed by right clicking on the icon and selecting delete from the menu that appears.

Your computer should now be free of Alfacleaner.

If your Homepage has been changed-
right click on the Internet explorer icon on your desktop or Start menu to open the internet properties box. Select the Programs tab and click the Reset Web settings button.

If your Desktop has not reverted back to normal-
Click Start > Control panel > Display (or Start> Settings > Control panel > display depending on which version of Windows you use) to open the Display properties box..
For Windows 98, ME, 2000 -
Click the Web tab and uncheck Show Web content on my Active Desktop.
Click Apply then OK
For Windows XP -
Click the Desktop tab and then the Customize Desktop button to open the Desktop Items box.
Click the Web tab, to disable Active Desktop uncheck all checkboxes in this window (including Security).
Click Apply then OK

Alfacleaner may have installed additional malware and I recommend you scanning your computer with Ewidow (XP and 2000 only). A free trial which reverts to a free version and a Free online scan is available.
For other operating systems, use an updated Ad-Aware SE A free version is available.


Microsoft issued a security update for Windows 2000 and XP to cover the vulnerability used by this trojan to infect your PC. To prevent future infections, update your Windows operating system. Start > All programs > Windows update.
Users of Windows 95, 98 and ME. Microsoft do not consider this flaw to be 'critical' and falls outside of their support policy only only issuing updated for 'critical security issues.

This information is provided free of charge/subscription/registration and without warranty.
However, if this page has helped resolve your problems without having the expense of taking your PC to a repair shop or the hassle of reformatting, you may like to support our efforts with a small donation towards the maintenance ,further development of this site and the research to create more pages like this for future malware, even £1, $1, €1 can help make sure we are still here should you ever need us again.
Privacy & Security

Information

E-mail

Viruses

hackers, crackers & firewalls

Trojans

Spyware

Keyloggers

Cookies

BHO's & Hijackers

Drive by downloads

diallers

Scams & Hoaxes

Hijack this-
automatic analysis


Free pest scan

Unwanted processes

How to-Tutorials

Clean up/repair after malware infection

Prevent malware installing

Install Hijackthis

Start in Safe mode

Show hidden files/folders

enable/disable Active X controls

Disable Messenger service pop-ups

Use the Host file

Roguefix -
Removal tool for Rogue spyware removers & Fake Warnings
removal tool


Kill E2Give

Kill MySearch

Kill Sdbot-ADD / lockx.exe

Kill seeve.exe / mediamotors pop ups

Kill Winfixer2005

Kill SysProtect

News/Articles

New Winfixer infection displays fake Blackworm warning

The real cost of Free security software

About us Contact us FAQ Links Privacy Statement Site Map Webmasters
Click here to add this page to your favorites
©Internet Inspiration, 2003.      All registered trademarks are observed and respected.
If you receive advertising pop ups whilst viewing this site, you are infected with an ad-serving parasite, because we don't use pop ups. See our Privacy & security section for help with detection and removal.