Search this blog

Monday, March 21, 2011

How do I remove CleanThis virus?

How to remove CleanThis virus? This is the question that is now being "googled" very often. Therfore, we would now like to seriously warn you of CleanThis malware and tell you about the ways on how to get rid of CleanThis virus. This is the fictitious anti-virus program that is being distributed by means of Fake Microsoft Security Essentials Alerts. This is why, once this virus penetrates inside of your system it will present a fake Microsoft Security Essentials alert that boldly asserts that it has detected certain Unknown Win32/Trojan on your machine. It will then push you to scan your system, which will at its end tell that your PC is infected with Trojan.Horse.Win32.PAV.64.a and that it will install CleanThis in order to supposedly eliminate the virus. It then pushes you to hit the OK button, which will reboot your system in order to finish the installation procedure.

After system restart you will encounter the CleanThis start screen instead of your common Windows desktop. It then suggest to you to scan your PC, which will state that your PC is infected with all kinds of infections. At the same time, it will not let you work with your computer cause the Windows desktop or the Windows task manager will not be allowed to run until you obtain the CleanThis fake anti-virus program. When you attempt to run Task Manager it will show another fake alert about the alleged infection with your OS. Moreover, when you try to shut down this fake program so you can access your Windows desktop, it will indicate the following message: "Current settings don't allow unprotected startup. Please check your settings". Hence, this tool is a scareware cause it is preventing the normal running of your PC until you purchase it. Needless to say, you must not buy this junkware, no matter how convincing it might sound or seem to be.

The below-given recommendations will show you how to remove CleanThis virus from your system. Once again, do not buy this badware called CleanThis. Make sure to get rid of it as soon as you can by following the removal guide provided below.

Automatic removal of CleanThis virus:

  1. Download the latest version of GridinSoft Trojan Killer to clear (not infected) computer and install it.
  2. Update the virus database.
  3. Copy the entire folder “GridinSoft Trojan Killer” to your jump drive (memory stick). Normally it is located at the following path: (C:\Program Files\GridinSoft Trojan Killer). “C” stands for the system disk of your computer. The name of the system disk, however, can be marked with another letter.
  4. Open your jump drive (memory stick). Find the folder “GridinSoft Trojan Killer” there. Open it , find the file under the name “trojankiller.exe” and rename it to “iexplore.exe”.
  5. Move memory stick to infected PC, open “GridinSoft Trojan Killer” folder and run iexplore.exe. Optional: copy the folder “GridinSoft Trojan Killer” from your jump drive to some other folder created on your PC and run “iexplore.exe”.

Manual removal of CleanThis virus:

Delete CleanThis files:

Delete CleanThis registry entries:


dlmiese said...

How do I open the folder on the memory stick in step 5? I get all the blocking messages included in your paragraphs above. No option to get out to a point where I can access the stick.

Anonymous said...

IĆ¢€™ve recently started a blog, the information you provide on this site has helped me tremendously. Thank you for all of your time & work.

cheap nolvadex

Douglas said...

My desktop, running XPpro, was infected with Clean This; I (finally) was able to boot it in Safemode with command line. Change direcotry to the C: drive; type: explorer.exe
This should get you to where you can click: Start, Run.... type: %appdata% ... this should open the hidden folder. Change the name of gog.exe to 123.exe .... this will keep the file from running. Reboot, delete the 123.exe, completescan, and install. Check the date stamp an everything in the folder. You will most likely have to go into the bios to revive the cd drive.
good luck.

Post a Comment

Search this blog