{
  "family": "deceptpcclean",
  "sample_count": 19,
  "category": "pua",
  "description": "DeceptPCClean (classified in antimalware telemetry under signatures PUA:Win32/DeceptPCClean, Rogue:Win32/DeceptPCClean, and Program:Win32/DeceptPCClean) is a deceptive rogue system utility and scareware application. Marketed under trade names such as Deceptive PC Cleaner or PC Clean Plus, it is distributed via software bundling platforms, pay-per-install networks, and misleading online landing pages claiming PC performance decay. Once installed on a Windows workstation, DeceptPCClean executes fabricated diagnostic scans that falsely report hundreds of critical registry anomalies, obsolete cache errors, and security vulnerabilities. It displays intrusive warning pop-ups urging users to purchase an annual license subscription to clean the purported issues. DeceptPCClean establishes startup persistence via registry run keys and background scheduled tasks, consuming system memory and CPU cycles while degrading overall workstation performance.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/DeceptPCClean",
    "Rogue:Win32/DeceptPCClean",
    "Program:Win32/DeceptPCClean",
    "Win32/DeceptPCClean",
    "PUP.Optional.DeceptPCClean"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/DeceptPCClean?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "DeceptPCClean is a rogue system cleaning utility that fabricates system performance problems to coerce users into buying licenses."
      }
    },
    {
      "@type": "Question",
      "name": "How does DeceptPCClean mislead computer users?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes fake diagnostic scans that intentionally exaggerate benign temporary files and registry keys as critical system threats."
      }
    },
    {
      "@type": "Question",
      "name": "How is DeceptPCClean distributed to endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with third-party software installers, free games, and deceptive online system scan ads."
      }
    },
    {
      "@type": "Question",
      "name": "What impact does DeceptPCClean have on computer systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It runs persistent background updater tasks and generates frequent pop-ups that degrade CPU performance and user experience."
      }
    },
    {
      "@type": "Question",
      "name": "How can DeceptPCClean be completely removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall via Windows Settings, remove associated scheduled tasks and registry keys, and run an antimalware scanner."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1491.001",
    "T1547.001",
    "T1053.005",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/DeceptPCClean",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/DeceptPCClean"
    },
    {
      "name": "Malwarebytes Labs - PUP.Optional.DeceptPCClean Removal Guide",
      "url": "https://www.malwarebytes.com/blog/detections/pup-optional-deceptpcclean"
    },
    {
      "name": "Sophos Threat Center - DeceptPCClean Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Advise the end user not to purchase license keys or input credit card information.",
    "Terminate active DeceptPCClean processes via Windows Task Manager.",
    "Uninstall DeceptPCClean through Windows Programs and Features / Settings.",
    "Remove scheduled tasks associated with DeceptPCClean background checks.",
    "Audit and clean residual registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
  ],
  "what_to_avoid": [
    "Do not purchase license keys or pay for unverified PC optimization utilities.",
    "Do not agree to bundle offers during third-party freeware installations."
  ],
  "target_industries": [
    "Consumer Endpoints",
    "Small Business Workstations"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Scareware Affiliates & Commercial Software Bundlers"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Fraud & Deceptive Commercial Monetization",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}