PCAntiMalware is a rogue antispyware program that usually installed itself onto your computer without your permission, through trojans and browser security holes. The rogue is a fresh version of Cleaner2009. Like other rogue antispyware programs, it uses fake alerts and false positives to trick you into buying the software.
During installation, PCAntiMalware is set to start automatically when your computer starts and immediately after launch, PCAntiMalware starts scanning the computer and found a lot of trojans and spyware. Then, it said that you should purchase the rogue in order to remove them and protect your PC.
While PCAntiMalware is running your computer will display fake security alerts from your windows taskbar. These alerts are a fake and should be ignored! Computer users are urged to avoid purchasing this bogus program! The rogue antispyware can be safely removed from your computer along with any other trojan infections if the proper steps are taken. If you are a non-techie computer user then this method of removing PCAntiMalware and any associated malware from your computer is for you.
Symptoms in a HijackThis Log
O4 – HKLM\..\Run: [PCAntiMalware] “c:\program files\pcantimalware\pcam.exe” /min
Use the following instructions to remove PCAntiMalware
Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.
Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded you will see window similar to the one below.
Malwarebytes Anti-Malware Window
Select “Perform Quick Scan”, then click Scan. The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.
Malwarebytes Anti-malware, list of infected items
Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.
PCAntiMalware creates the following files and folders
C:\Program Files\PCAntiMalware\shellext.dll
C:\Program Files\PCAntiMalware\AsAgents.dll
C:\WINDOWS\system32\bootrem.exe
C:\Program Files\PCAntiMalware
C:\Program Files\PCAntiMalware\database
C:\Program Files\PCAntiMalware\quaratine.dat
C:\Program Files\PCAntiMalware\RTMonitor.dat
C:\Documents and Settings\All Users\Start Menu\Programs\PCAntiMalware
C:\Documents and Settings\All Users\Application Data\PCAntiMalware
C:\Documents and Settings\All Users\Application Data\PCAntiMalware\Data
C:\program files\pcantimalware\PCAM.exe
C:\Program Files\PCAntiMalware\Activate.dat
C:\Program Files\PCAntiMalware\appupdate.dat
C:\Program Files\PCAntiMalware\AsAgents.xml
C:\Program Files\PCAntiMalware\atl71.dll
C:\Program Files\PCAntiMalware\AutoProcess.dat
C:\Program Files\PCAntiMalware\dbupdate.dat
C:\Program Files\PCAntiMalware\InstUp.exe
C:\Program Files\PCAntiMalware\lapv.dat
C:\Program Files\PCAntiMalware\license.rtf
C:\Program Files\PCAntiMalware\mfc71.dll
C:\Program Files\PCAntiMalware\monstate.dat
C:\Program Files\PCAntiMalware\msvcp71.dll
C:\Program Files\PCAntiMalware\msvcr71.dll
C:\Program Files\PCAntiMalware\PCAM.xml
C:\Program Files\PCAntiMalware\PP.exe
C:\Program Files\PCAntiMalware\pv.dat
C:\Program Files\PCAntiMalware\readme.rtf
C:\Program Files\PCAntiMalware\scanlog.xml
C:\Program Files\PCAntiMalware\settings.ini
C:\Program Files\PCAntiMalware\shellext.xml
C:\Program Files\PCAntiMalware\Summary.dat
C:\Program Files\PCAntiMalware\tasks.dat
C:\Program Files\PCAntiMalware\threatnet.dat
C:\Program Files\PCAntiMalware\threatnet.ini
C:\Program Files\PCAntiMalware\unins000.dat
C:\Program Files\PCAntiMalware\unins000.exe
C:\Program Files\PCAntiMalware\uninstall.ico
C:\Program Files\PCAntiMalware\UserAgent.dll
C:\Program Files\PCAntiMalware\database\knownfiles.dat
C:\Program Files\PCAntiMalware\database\MalwareDB.dat
C:\Program Files\PCAntiMalware\database\TEBase.dat
C:\Program Files\PCAntiMalware\database\vbpv.dat
C:\Documents and Settings\All Users\Start Menu\Programs\PCAntiMalware\Contact customer support.url
C:\Documents and Settings\All Users\Start Menu\Programs\PCAntiMalware\PCAntiMalware on the Web.url
C:\Documents and Settings\All Users\Start Menu\Programs\PCAntiMalware\PCAntiMalware.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\PCAntiMalware\Uninstall PCAntiMalware.lnk
C:\Documents and Settings\All Users\Application Data\PCAntiMalware\Data\Abbr
C:\Documents and Settings\All Users\Application Data\PCAntiMalware\Data\ProductCode
%UserProfile%\Desktop\PCAntiMalware.lnk
PCAntiMalware creates the following registry keys and values
HKEY_CLASSES_ROOT\TypeLib\{4567ab12-7dfc-4c46-bd8f-41259d169a0d}
HKEY_CLASSES_ROOT\CLSID\{4567ab12-eded-4675-af10-ba15eddb4d7a}
HKEY_CLASSES_ROOT\CLSID\{4add95da-b25d-4d21-9c5c-05fc6de05860}
HKEY_CLASSES_ROOT\TypeLib\{4567ab12-ae24-4fd6-b479-e2b464f32da6}
HKEY_CLASSES_ROOT\Interface\{4567ab12-a884-4ca6-b739-cedb12fef096}
HKEY_CLASSES_ROOT\amshellext.shellhook
HKEY_CLASSES_ROOT\amshellext.shellhook.1
HKEY_CLASSES_ROOT\washellext.wascontextmenu
HKEY_CLASSES_ROOT\washellext.wascontextmenu.1
HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers\ExplorerWAS
HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers\ExplorerWAS
HKEY_LOCAL_MACHINE\SOFTWARE\PCAntiMalware
HKEY_CURRENT_USER\SOFTWARE\PCAntiMalware
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pcantimalware
