PC Repair Adware Removal Instructions
The Emsisoft malware research team has discovered a new outbreak of the PC Repair adware. Emsisoft Anti-Malware detects this malware as Adware.Win32.PCRepair.
PC Repair is a rogue application, another variant of HDD Repair and System Repair. A rogue application tries to trick you by displaying false positive or misleading scan results report, which says that your computer has a problem, or infected with viruses or trojan, but you will not be able to fix it before you purchase.
Create new files:
- %AllUsersProfiles%\Application Data\~%random%r
- %AllUsersProfiles%\Application Data\%random%.exe
- %AllUsersProfiles%\Application Data\%random%
- %AllUsersProfiles%\Application Data\~%random%
- %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\PC Repair.lnk
- %UserProfile%\Desktop\PC Repair.lnk
- %UserProfile%\Local Settings\Temp\smtmp\
- %UserProfile%\Local Settings\Temp\smtmp\4\
- %UserProfile%\Local Settings\Temp\smtmp\1\
- %UserProfile%\Local Settings\Temp\smtmp\2\
- %UserProfile%\Start Menu\Programs\PC Repair\
- %UserProfile%\Start Menu\Programs\PC Repair\PC Repair.lnk
- %UserProfile%\Start Menu\Programs\PC Repair\Uninstall PC Repair.lnk
Create/modify registry entries:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\
DisableTaskMgr: 0×00000001
- HKEY_CURRENT_USER\Software\
75fa38b7-8b94-4995-ad32-52e938867954:
BD: 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00…
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\
Use FormSuggest: “Yes”
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
WarnonBadCertRecving: 0×00000000
CertificateRevocation: 0×00000000
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\
NoChangingWallPaper: 0×00000001
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations\
LowRiskFileTypes: “/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:”
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\
SaveZoneInformation: 0×00000001
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
%random%: “%AllUsersProfile%\Application Data\%random%.exe”
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download\
CheckExeSignatures: “no”
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
Hidden: 0×00000000
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
ShowSuperHidden: 0×00000000
Screenshots:
To register and uninstall this rogue application, you can try one of the following serial number, and enter any email:
1203978628012489708290478989147
8475082234984902023718742058948
How to remove the infection of PC Repair (Adware.Win32.PCRepair)?
To delete this malware infection, please download and install Emsisoft Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.



























