RegistryCleaner

What is RegistryCleaner?

RegistryCleaner (might also use the Pcobserver name) is an application that has fallen into the category of rogue registry cleaners. Our malware analysts have discovered it recently, so its infection rate is still quite small, but, of course, this might dramatically change soon because a page (registrycleaner.online/download-now) it can be downloaded from exists, and, on top of that, it might be distributed in software bundles, specialists working at anti-spyware-101.com say. No matter where users get RegistryCleaner from, they usually do not rush to remove this scanner from their computers because it, at first sight, looks quite decent. Evidently, it tries to convince users that it is a powerful registry scanner/cleaner because it imitates the system scan when users click on the blue Scan button they see. Needless to say, its scan results cannot be trusted – they are completely fake. Because of this, RegistryCleaner has been classified as a rogue registry cleaner. Delete it without consideration and replace it with a scanner that can be trusted.

What does RegistryCleaner do?

This rogue registry scanner is promoted as an “ultra fast registry cleaner” on its official website. Users are told that it has been “tested through several procedures”, so they can trust it fully. Unfortunately, it seems that there are users who really trust this scanner. Most probably, they download and install this scanner on their computers not only because they believe that it is safe to use it, but, most likely, because they expect it to clean up unused files, fix PC errors, and make sure that the system does not crash ever again. These promises that can be found on its official website are nothing more than lies, specialists say. In reality, RegistryCleaner is not a useful scanner. To be frank, it is the opposite. There is, probably, no need to say that it does not do anything. Additionally, researchers who have thoroughly tested it have managed to find out that this rogue application can also drop a screenlocker. It is a threat which locks the screen seeking to scare users into believing that critical issues have arisen, and users can only get them fixed by contacting the “certified technicians.”

The screenlocker RegistryCleaner drops on users’ computers uses the TaskKill command to close the Task Manager and turn the ESC key into a Tab key. Also, just like all screenlockers do, it locks Desktop. The window it opens looks like a genuine Windows OS window, but it is not. There is no doubt that its main goal is to convince users that the problem is serious and they need to contact a “Microsoft certified technician” by dialing 1-888-348-1767 as soon as possible. The Microsoft Corporation has nothing to do with this screenlocking malware dropped by RegistryCleaner, so it would be too naïve to expect that technicians willing to help you are waiting at the other end of the line. It is one of those reasons you should not even bother dialing this number. In addition, there is no point in doing that because the screen can be unlocked, i.e. the screen-locking window can be removed by entering the unlock code 8716098676542789 in the box at the bottom. Yes, you could unlock your Desktop, but it does not mean that your computer will become clean.

Where does RegistryCleaner come from?

RegistryCleaner can be downloaded from registrycleaner.online/download-now, but we are sure that it is not the only place users can get it from. Research has shown that it might also be spread in malicious software bundles. As for the screenlocker, as has been mentioned above, it does not sneak onto your computer, but, instead, it is dropped by RegistryCleaner without permission. You should try to avoid rogue applications at all costs because they, without a doubt, are not mild threats. You can do this by installing security software on your computer.

How to delete RegistryCleaner

If a screenlocker has already been dropped by RegistryCleaner on your computer and you have found your screen locked, you should enter the unlock code 8716098676542789. Once you can access Desktop again, go to erase this RegistryCleaner from your system fully. You should use our step-by-step manual removal instructions, or you can, alternatively, go to perform a system scan with a reputable antimalware scanner, such as SpyHunter. Keeping RegistryCleaner installed is the worst idea because, although it does not look harmful at first glance, it does not work beneficially and might only be associated with serious problems.

RegistryCleaner removal instructions

Unlock the screen

1. If your Desktop is locked, enter 8716098676542789 in the box and click Activate Now.
2. When you are prompted “Closing of the registration form is not allowed”, click OK.

Delete RegistryCleaner through Control Panel

Windows XP

1. Click Start.
2. Click Control Panel and select Add or Remove Programs.
3. Select the untrustworthy application and click Remove.

Windows 7/8/8.1/10

1. Press Win+R.
2. Type Control Panel. Click OK.
3. Go to Uninstall a program.
4. Click on the unwanted program.
5. Uninstall it.

Delete leftovers and the screenlocker

1. Open the Windows Explorer (tap Win+E).
2. Open %APPDATA%.
3. Delete the Registry Cleaner or Pcobserver folder.
4. Close the Windows Explorer.
5. Press Win+R, type regedit.exe, and click OK.
6. Delete the following registry keys one after the other (the registry keys you need to delete depend on the version of malware you have encountered!):

• HKLM\SOFTWARE\Microsoft\Tracing\RegistryCleaner_RASMANCS
• HKLM\SOFTWARE\Microsoft\Tracing\RegistryCleaner_RASAPI32
• HKCU\SOFTWARE\Registry Cleaner\Registry Cleaner OR
• HKCU\SOFTWARE\DIS\Pcobserver
• HKLM\SOFTWARE\Microsoft\Tracing\Pcobserver_RASMANCS
• HKLM\SOFTWARE\Microsoft\Tracing\Pcobserver_RASAPI32 Download Removal Tool100% FREE spyware scan and
  tested removal of RegistryCleaner*