Computersight -

If you have heard of rogue anti-spyware programs then you might already have heard of this one. 1 Click Spy Clean is a rogue anti-spyware program which pretends to be a real anti-spyware program doing its job like any other. But this is far from the truth. This guide will show you what it does and how to manually remove this rogue software.

screenshot by author

Where Does it Come From?

The company owns the following domains and the program can be downloaded from them.

[WARNING: DO NOT VISIT THESE SITES]

• 1clickboost.net
• 1clickspyclean.com
• 1clicksuite.net

Information on these domains have been hidden, what do they have to hide? You may wonder…

The Truth Behind It

In actual fact when I tested the program it return that the PC was infected* and requested me to buy the software to remove it. In the results 1 Click Spy Clean stated the Internet Explorer’s homepage had been changed, however this was not the case at all. 1 Click Spy Clean in this case lies to its consumers informing them that their PC’s are infected when they are possibly not. It uses this lie to try to push the user into buying the software.

According to some sites(e.g 2-spyware.com) 1 Click Spy Clean can find legitimate issues on your PC using it’s definitions which were taken from Spybot Search & Destroy. The update function however is broken and won’t update because the developers didn’t make the definitions to start with.

Installation Log

On installation of the program these files were created:

%temp%37M24V9Fd_spycleansetupdb.pdb
%temp%37M24V9Fd_spycleansetuplngEnu.lng
%temp%37M24V9Fd_spycleansetupmain.pdb
%temp%37M24V9Fd_spycleansetupplugins�lngEnu.lng
%temp%37M24V9Fd_spycleansetupplugins�StdUI.dll
%temp%37M24V9Fd_spycleansetuppresetupLicense.txt
%temp%37M24V9Fd_spycleansetuppresetupspy_installer.bmp
%temp%37M24V9Fd_spycleansetuppresetup.bmp
%temp%37M24V9Fd_spycleansetupUninstall.exe
%temp%37M24V9FResume.exe
%temp%37M24V9Funpack.dll
%temp%ESWC.tmpd_spycleansetup.exe

%startmenu%Secure PC Solutions1 Click Spy Clean1Click Spy Clean.lnk
%startmenu%Secure PC Solutions1 Click Spy CleanSpy Clean Help.lnk
%startmenu%Secure PC Solutions1 Click Spy CleanUninstall.lnk

%programfiles%Secure PC Solutions1 Click Spy Clean1ClickSpyClean.exe
%programfiles%Secure PC Solutions1 Click Spy CleanEULA.doc
%programfiles%Secure PC Solutions1 Click Spy CleanINSTALL.LOG
%programfiles%Secure PC Solutions1 Click Spy Cleaninstall.sss
%programfiles%Secure PC Solutions1 Click Spy CleanSpyClean.chm
%programfiles%Secure PC Solutions1 Click Spy Cleanspyware.db
%programfiles%Secure PC Solutions1 Click Spy CleanUninstall.exe

The following Registry keys were also created:

HKEY_CURRENT_USER SoftwareSecure PC Solutions
HKEY_CURRENT_USER Software Secure PC Solutions1 Click Spy Clean
HKEY_CURRENT_USER Software Secure PC Solutions1 Click Spy CleanSettings
HKEY_CURRENT_USER Software Secure PC Solutions1 Click Spy CleanSettingsDeepScan
HKEY_CURRENT_USER Software Secure PC Solutions1 Click Spy CleanSettingsProtectedHomePage
HKEY_CURRENT_USER Software Secure PC Solutions1 Click Spy CleanSettingsHomePageNotifyBeforeRestore
HKEY_CURRENT_USER SoftwareSecure PC Solutions1 Click Spy CleanSettingsRunAtTime
HKEY_CURRENT_USER SoftwareSecure PC Solutions1 Click Spy CleanSettingsRunOnWindowsStartup
HKEY_CURRENT_USER SoftwareSecure PC Solutions1 Click Spy CleanSettingsRunEvery
HKEY_CURRENT_USER SoftwareSecure PC Solutions1 Click Spy CleanSettingsLastScanTime

Uninstall

On un-installation make sure you shut down the program completely as it will remain on your system if the program is running when you uninstall it. The uninstaller removes most of the files above; however leaves the Quarantine folder and a scan log in the Program Files directory. In addition, it also left all the registry keys listed above which will need to be manually removed.

Bottom Line

While the software is not dangerous to your computer, it misleads the user by detecting spyware which does not exist on your machine. It also refuses to remove the problems (that don’t really exist) unless you purchase the software. Because of this I recommend you leave this software alone and avoid it.

*This software was tested on a test machine which has a fresh copy of Windows XP on it. This software was the only software installed onto the machine so therefore the machine has no traces of any other infection. System changes were monitored using a small portable program.