{
  "family": "pccleaner",
  "sample_count": 17,
  "category": "pua",
  "description": "PCCleaner (classified in antimalware engines under designations including PUA:Win32/PCCleaner, Program:Win32/PCCleaner, and Rogue:Win32/PCCleaner) is a Potentially Unwanted Application and rogue system optimization utility that misleads Windows users regarding their computer's stability and operational health. Distributed through misleading pay-per-install bundles, deceptive software update portals, and aggressive popup advertisements, PCCleaner automatically initiates simulated system scans upon installation. The software intentionally reports hundreds or thousands of fabricated 'critical errors', harmless registry keys, and ordinary browser cookie caches as urgent security hazards and system crashes. PCCleaner locks down its remediation features, presenting persistent pop-ups and full-screen warning banners demanding that the victim purchase a paid premium license key to 'fix' the non-existent problems. Additionally, PCCleaner establishes persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, installs telemetry background tasks, and continually consumes system CPU and RAM.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/PCCleaner",
    "Program:Win32/PCCleaner",
    "Rogue:Win32/PCCleaner",
    "Win32/PCCleaner",
    "PC Cleaner Pro Rogue"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/PCCleaner?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "PCCleaner is a Potentially Unwanted Application that uses scareware tactics and exaggerated error reports to pressure users into buying paid licenses."
      }
    },
    {
      "@type": "Question",
      "name": "Are the errors detected by PCCleaner legitimate risks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. PCCleaner flags benign temporary files, standard cache entries, and normal registry keys as critical system stability risks."
      }
    },
    {
      "@type": "Question",
      "name": "How does PCCleaner gain installation on computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled into freeware download managers, pirated software cracks, and deceptive online browser alerts."
      }
    },
    {
      "@type": "Question",
      "name": "How does PCCleaner persist on Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It configures Windows Run registry keys and registers daily scheduled tasks to launch automated nagging pop-ups on user logon."
      }
    },
    {
      "@type": "Question",
      "name": "How do you completely remove PCCleaner?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the application through Windows Apps & Features, delete remaining folders in %ProgramFiles% and %AppData%, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1491",
    "T1547.001",
    "T1053.005",
    "T1112",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation)",
      "tactic": "Impact"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Advise the end-user NOT to pay the requested fee; the reported system errors are fabricated to induce panic.",
    "Use the Windows Control Panel to uninstall the rogue application, but do not assume this fully cleans the system.",
    "Deploy a reputable enterprise anti-malware or adware removal tool (e.g., Malwarebytes, AdwCleaner) to locate and delete the hidden registry keys and scheduled tasks left behind by the uninstaller.",
    "Review browser configurations to ensure no rogue extensions or homepage hijackers were installed alongside the scareware."
  ],
  "what_to_avoid": [
    "Do not input any credit card or personal information into the software's payment portal.",
    "Avoid ignoring the incident; if the user installed this, they may have unknowingly installed more severe malware from the same bundled package."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - PUA:Win32/PCCleaner",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/PCCleaner"
    },
    {
      "name": "Malwarebytes Labs - PUP.Optional.PCCleaner Removal Guide",
      "url": "https://www.malwarebytes.com/blog/detections/pup-optional-pccleaner"
    },
    {
      "name": "MITRE ATT&CK - Defacement: Displaying Fake Security Alerts (T1491)",
      "url": "https://attack.mitre.org/techniques/T1491/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}