RegistryPowerCleaner is a malicious browser hijacker that may change your home page to PureSafetyHere.com. PureSafetyHere.com is a dirty website that pushes fake anti-spyware software. RegistryPowerCleaner and the PureSafetyHere.com website that RegistryPowerCleaner redirects you too displays annoying popups and alert messages on your computer stating that you are infected with W32.Myzor.FK@yf. The popup ad usually reads like this:
W32.Myzor.FK@yf is a virus that infects files with .exe extensions. It attempts to steal passwords
and private information from the infected computer.
Type: Virus
Infection Length: 138,293 bytes
Systems Affected: Windows 95, 98, ME, NT (all versions), 2003, Windows XP (all service packs)
Systems Not Affected: DOS, EPOC, Linux, Macintosh, Novell Netware, OS/2, UNIX
Technical details: 1. Creates files in %Windir%\ directory. By default, this is C:\Windows.
2. Adds values to registry keys:
HKEY_LOCAL_MNACHINE\Software\Microsoft\Windows\CurrentVersion\Run
3. Scans the hard drive for .exe files and infects any executable files.
Searches for passwords/information, which it may send to a remote attacker.
Recomendations [SIC]: Click "OK" to download officially approved security software.
Always keep your patch levels up-to-date.
Non-techie terms: RegistryPowerCleaner is installed onto your system through the Downloader.Affiliase Trojan. The Downloader.Affiliase Trojan is usually downloaded and installed through a video codec download or P2P website. RegistryPowerCleaner and any associated website such as PureSafetyHere.com were created by hackers to take your hard earned money. Do not under any circumstances purchase RegistryPowerCleaner or any programs advertised on PureSafetyHere.com.