Privacy & Security
Remove alfacleaner
 The removal tool/procedure for AlphaCleaner on this page has been replaced by Roguefix.A new comprehensive scan and delete utility for the family of rogue scanners and their installing/accompanying trojans Roguefix, click here |
AlfaCleaner is yet another spyware cleaner that is installed by a trojan and then displays fake infections in an attempt to trick owners of infected machines into buying the scanner.
The company behind this, and other similar applications (Anti Virus Pro, Winhound, Spyware Remover, SpyContra and SpyDeface are a few) is innovagest2000.com
Visible signs of infection.
Your desktop will be changed to a black background with a warning that your computer is infected with spyware,.
The AlfaCleaner scanner will 'perform a scan' and display fake infections.
Balloons will appear from an orange triangle, or other icon in the system tray. (bottom right hand of your screen, near the clock).
You will need
1) SmitRem.zip A tool created by noadfear to remove the trojan. Download the .zip file to your desktop and extract the files ready for use.
2) Pocket killbox, from Here, to your desktop. Extract the files from the .zip folder ready for use.
Killbox is a small application created by Option^Explicit, www.bleepingcomputer.com to remove stubborn files and folders.
3) Ace Utilities (free trial), a comprehensive disk and registry cleaner to remove the remnants.
4) regfixAC.reg. A small file to clean the registry. Save it to your desktop.
Removal proceedure
1 Open Pocket killbox from the Killbox file on your desktop.
Copy and Paste the following files into the Paste Full path of File to Delete box, according to the version of Windows you use. (Note: If your Windows folders are stored on a drive other than C you must change the letter in the file path accordingly)
You should enter each file path one at a time, select Delete on reboot and click the Kill file button (Red circle with white cross), and click No to reboot now, at the prompt.
If you receive a 'file cannot be found' message, just move onto the next one.
For Windows XP
C:\ntzl.exe
C:\winstall.exe
C:\Windows\uninstDsk.exe
C:\Windows\warnhp.html
C:\Windows\System32\intell321.exe
C:\Windows\System32\voi271.exe
C:\Windows\System32\voi640.exe
C:\Documents and Settings\Administrator\Application Data\AlfaCleaner
C:\Documents and Settings\Administrator\Application Data\Skinux
C:\Documents and Settings\Administrator\Application Data\Skinux\AlfaCleaner
C:\Documents and Settings\LocalService\Application Data\AlfaCleaner
C:\Program Files\AlfaCleaner
For Windows NT/2000
C:\ntzl.exe
C:\winstall.exe
C:\Windows\uninstDsk.exe
C:\Windows\warnhp.html
C:\Winnt\System32\intell321.exe
C:\Winnt\System32\voi271.exe
C:\Winnt\System32\voi640.exe
C:\Documents and Settings\Administrator\Application Data\AlfaCleaner
C:\Documents and Settings\Administrator\Application Data\Skinux
C:\Documents and Settings\Administrator\Application Data\Skinux\AlfaCleaner
C:\Documents and Settings\LocalService\Application Data\AlfaCleaner
C:\Program Files\AlfaCleaner
For Windows 95/98/ME
C:\ntzl.exe
C:\winstall.exe
C:\Windows\uninstDsk.exe
C:\Windows\warnhp.html
C:\Windows\System\intell321.exe
C:\Windows\System\voi271.exe
C:\Windows\System\voi640.exe
C:\Documents and Settings\Administrator\Application Data\AlfaCleaner
C:\Documents and Settings\Administrator\Application Data\Skinux
C:\Documents and Settings\Administrator\Application Data\Skinux\AlfaCleaner
C:\Documents and Settings\LocalService\Application Data\AlfaCleaner
C:\Program Files\AlfaCleaner
When all the files are entered, close Killbox.
2. Double click on the regfixAC.reg on your desktop. Click OK at the prompts to confirm you want to run the file.
3. Restart your PC in Safe ModeHow to, and open the Smitrem file, click the runthis.bat icon. When the removal proceedure is complete, restart your PC normally.
Click clean up , select remove Junk Files.
Scan and delete everything found. Close the remove junk files box.
Select Clean system registry.
Click options and select Thorough. Scan and delete everything found. Close the Clean system registry box.
Select Erase History, click the Windows tab and select the following-
Empty the Windows Prefetch Folder.
Delete empty folders on the Windows Temp folder.
Erase Folder streams in the Windows registry.
Clear past icon history of system tray
Click Execute Now
Click the internet Explorer/MSN tab and select the following-
Delete cookies
Delete locked URL cache file.
Clear typed URL's of Address bar
Clear Browser History
Delete Cache (Files in temporary Internet folder)
Click Execute Now.
Any remaining icons on your desktop or start menu can be removed by right clicking on the icon and selecting delete from the menu that appears.
Your computer should now be free of Alfacleaner.
If your Homepage has been changed-
right click on the Internet explorer icon on your desktop or Start menu to open the internet properties box. Select the Programs tab and click the Reset Web settings button.
If your Desktop has not reverted back to normal-
Click Start > Control panel > Display (or Start> Settings > Control panel > display depending on which version of Windows you use) to open the Display properties box..
For Windows 98, ME, 2000 -
Click the Web tab and uncheck Show Web content on my Active Desktop.
Click Apply then OK
For Windows XP -
Click the Desktop tab and then the Customize Desktop button to open the Desktop Items box.
Click the Web tab, to disable Active Desktop uncheck all checkboxes in this window (including Security).
Click Apply then OK
Alfacleaner may have installed additional malware and I recommend you scanning your computer with Ewidow (XP and 2000 only). A free trial which reverts to a free version and a Free online scan is available.
For other operating systems, use an updated Ad-Aware SE A free version is available.
Microsoft issued a security update for Windows 2000 and XP to cover the vulnerability used by this trojan to infect your PC. To prevent future infections, update your Windows operating system. Start > All programs > Windows update.
Users of Windows 95, 98 and ME. Microsoft do not consider this flaw to be 'critical' and falls outside of their support policy only only issuing updated for 'critical security issues.
This information is provided free of charge/subscription/registration and without warranty.
However, if this page has helped resolve your problems without having the expense of taking your PC to a repair shop or the hassle of reformatting, you may like to support our efforts with a small donation towards the maintenance ,further development of this site and the research to create more pages like this for future malware, even £1, $1, €1 can help make sure we are still here should you ever need us again.
Information
Viruses
hackers, crackers & firewalls
Trojans
Spyware
Keyloggers
Cookies
BHO's & Hijackers
Drive by downloads
diallers
Scams & Hoaxes
Hijack this-
automatic analysis
Free pest scan
Unwanted processes
How to-Tutorials
Clean up/repair after malware infection
Prevent malware installing
Install Hijackthis
Start in Safe mode
Show hidden files/folders
enable/disable Active X controls
Disable Messenger service pop-ups
Use the Host file
Roguefix -
Removal tool for Rogue spyware removers & Fake Warnings
removal tool
Kill E2Give
Kill MySearch
Kill Sdbot-ADD / lockx.exe
Kill seeve.exe / mediamotors pop ups
Kill Winfixer2005
Kill SysProtect
News/Articles
New Winfixer infection displays fake Blackworm warning
The real cost of Free security software
About us Contact us FAQ Links Privacy Statement Site Map WebmastersClick here to add this page to your favorites
©Internet Inspiration, 2003. All registered trademarks are observed and respected.