Program:Win32/RegCure

Program:Win32/RegCure is the detection name for a rogue defragger application known as RegCure. First released in 9 February 2010, this rogue has gone on to infect many thousands of PCs across the world. It was designed to emulate the workings of a real defragmenter, but the truth is Program:Win32/RegCure has no ability to detect or fix any type of system error, and is nothing more than a malicious infection in itself.

This rogue is distributed through an intricate online marketing system which encompasses the help of browser hijacking websites which employ drive-by download tactics, and fake online malware scanners. As of late it has also been reported that Program:Win32/RegCure makes use of infected online flash ads as a part of its online marketing campaign in an effort to forcefully infect users with its infections.

Once Program:Win32/RegCure manages to securely root itself into the system it will edit registry entries so as to allow itself to run automatically each time the user logs on to Windows:

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\RegCure
HKLM\Software\RegCure

It will also drop the following files into the system:

0_days.htm
1_days.htm
15_days.htm
2_days.htm
30_days.htm

Soon after doing this, Program:Win32/RegCure will start a fake system scan which will invariably inform the user that his system is suffering from various crippling errors. It will also spam the user with incessant and annoying pop up messages informing him of the same things. This is all done to panic the user into paying for Program:Win32/RegCure’s worthless software.

Other symptoms Program:Win32/RegCure will cause include increased erratic system behavior, and extremely poor system performance. It will block the user’s access to his applications, so that as to prevent the user from running an application which may be able to detect and remove Program:Win32/RegCure from the system. It is also done in a further effort to panic him into paying for Program:Win32/RegCure’s useless software.

Users are warned never to believe any correspondence received from Program:Win32/RegCure. It was never designed to be of any value to a PC, and only to act as a vehicle with which unscrupulous cyber criminals will rip you off with.

In order to protect your PC from the certain destruction and devastation associated with this rogue, destroy Program:Win32/RegCure with the help of a powerful security tool which will also protect you against future similar attacks.