Skip to main content
Skip to main content
Microsoft Security Intelligence
Published May 28, 2012 | Updated Sep 15, 2017


Detected by Microsoft Defender Antivirus

Aliases: No associated aliases


Win32/Cleaman is a family of multi-component, obfuscated trojans that are distributed via drive-by exploit kits. Its main purpose is to redirect Bing, Google, and Yahoo search results to bogus webpages that serve advertisements, adware programs, and malware.

To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:

For more information on antivirus software, see

Additional remediation instructions for Win32/Cleaman:

This threat may make lasting changes to a computer's configuration that are NOT restored by detecting and removing this threat. For more information on returning an infected computer to its pre-infected state, please see the following article/s:

Recreating a clean Hosts file:

Follow us