AlfaCleaner Removal Guide

How to remove AlfaCleaner
Windows 2000 and XP ONLY
This is a self help Removal Procedure.
MalwareTeks is in no way liable for anything which may go wrong.

What this program does:
AlfaCleaner is a anti-spyware program that is known to issue fake warnings on your computer to manipulate you into buying its full commercial version. If you are infected with this program you may receive warnings in your task bar that appear to be from Microsoft Security Center stating that you are infected with spyware and to run its special anti-spyware tool. This tool turns out to be the commercial version of AlfaCleaner. These warnings are fake and are a goad to have you buy the commercial version of this software.

Download the following
Smitrem - Save to your desktop.
HijackThis -This is self extracting and will placed in the proper directory

Removal Instructions

-- You will want to print these instructions out, as ALL Browser windows will need to be closed. --

1. First look in Add/Remove Programs and uninstall if found

AlfaCleaner.com
Desktop Uninstall

2. Now please reboot to Safe Mode
3. Go to Start > Run and type Services.msc

• Look for the following service

AlfaCleanerService or AlfaCleaner.com

• Right click it and choose Stop if not greyed out

• Now choose Properties and change Startup Type to Disabled

4. Now open HijackThis

• Choose Open Misc Tools

• Choose Delete an NT Service

• Copy AlfaCleanerService or AlfaCleaner.com (whichever service name it was under) into the box and delete it.

5. Open HijackThis and scan and place a check next to the following

O4 – HKLM\..\Run: C:\WINDOWS\system32\intell321.exe
O4 – HKLM\..\Run: [AlfaCleaner] C:\Program Files\AlfaCleaner\AlfaCleaner.exe
O4 – HKCU\..\Run: [Windows installer] C:\winstall.exe
O23 - Service: AlfaCleanerService - AlfaCleaner.com – C:\Program Files\AlfaCleaner\ACServer.exe

Now close ALL Browsers and choose Fix Checked
6. Open your Smitrem folder located on your desktop

7. Double click the Smitrem.exe file. Your screen will look like the following:

8. Click Start and allow it to extract the files into the Smitrem folder on your desktop.
9. Now please look for and delete the following files and folders

C:\Program Files\AlfaCleaner
C:\Windows\System32\intell321.exe
C:\Windows\System32\voi640.exe
C:\Windows\warnhp.html
c:\winstall.exe
C:\Windows\uninstDsk.exe
C:\Windows\System32\voi271.exe

10. Now close ALL Windows and open the Smitrem folder on your desktop.
11. Please select Runthis.bat from the folder contents

12. Follow the prompts on the screen.
13. Your desktop will disappear, this is normal. When Smitrem is finished, Disk Cleanup will automatically start.

14. When Disk Cleanup completes, please reboot your PC back to Normal Mode.

15. Now run Panda ActiveScan

• Click Scan your PC

• Fill out the requested info

• Click Scan Now

Start a new thread in the Malware Removal Forum of this site.

Attach the following logs:

1. smitfiles.txt from SmitRem.

2. Panda ActiveScan log.

3. A fresh HijackThis log.

(You must Register before posting anywhere on this board. Registering is 100% FREE)

Credit to Grinler at BleepingComputer.com