Plataforma:

Windows

 Classificao do risco total:
 infecção relatada:
 Impacto no sistema: :
 Exposição das informações:
Baixo
Medium
Alto
Crítico

  • Tipo de grayware:
    Potentially Unwanted Application

  • Destrutivo:
    Não

  • Criptografado:
     

  • In the Wild:
    Sim

  Visão geral

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Löscht Dateien, so dass Programme und Anwendungen nicht ordnungsgemäß ausgeführt werden.

  Detalhes técnicos

Tipo de compactação: 3,542,504 bytes
Tipo de arquivo: EXE
Residente na memória: Sim
Data de recebimento das amostras iniciais: 12 junho 2020

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

  • "%User Temp%\is-10A8I.tmp\{malware file name}.tmp" /SL5="$30168,3054916,148992,{malware file path and name}"
  • "%System%\regsvr32.exe" /s "%System%\jscript.dll"
  • "%Program Files%\PC Power Booster\PCPowerBooster.exe"
  • "%Program Files%\PC Power Booster\sysmon.exe" /verysilent
  • http://www.{BLOCKED}rboost.com/afterinstall/?&LangID=en
  • "%User Temp%\is-G754O.tmp\sysmon.tmp" /SL5="$101D2,860684,140800,%Program Files%\PC Power Booster\sysmon.exe" /verysilent
  • "%System%\taskkill.exe" /f /im sysmon.exe
  • "%Application Data%\SysMon\sysmon.exe"
  • "%Program Files%\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:2

Erstellt die folgenden Ordner:

  • %User Temp%\is-FK05B.tmp\_isetup
  • %Application Data%\pc power booster
  • %User Temp%\is-RG569.tmp\_isetup
  • %Program Files%\PC Power Booster
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster
  • %Application Data%\SysMon

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.)

Andere Systemänderungen

Ändert die folgenden Dateien:

  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat

Löscht die folgenden Dateien:

  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster\PC Power Booster.pif
  • %AppDataLocal%Low\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
  • %Windows%\Tasks\RunAtStartup.job
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster\PC Power Booster.url
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster\Register PC Power Booster.pif
  • %Windows%\Tasks\PC Power Booster.job
  • %System Root%\Users\Public\Desktop\PC Power Booster.pif
  • %System Root%\Users\Public\Desktop\PC Power Booster.url
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster\Register PC Power Booster.url

(Hinweis: %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.. %System Root% ist der Stammordner, normalerweise C:\. Dort befindet sich auch das Betriebssystem.)

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Owner = "T\x03\x00\x00\xbb\xa3\xea\xd4\xa8\xe1\xd5\x01"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
SessionHash = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Sequence = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
pc power booster
TELNO = "(855) 761-8856"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
pc power booster
TELNOFR = "01.76.54.27.59"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
pc power booster
TELNODE = "(800) 180-6512"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
pc power booster
TELNOJP = "03-5050-1410"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
pc power booster
support_email = "support@jawego.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
pc power booster
ShowExitPage = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Jawego\Params
PCPB = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
pc power booster
PCPBURL = "http://www.{BLOCKED}rboost.com/buynow/?"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
pc power booster
RENEWALURL = "http://www.{BLOCKED}rboost.com/renewal/?"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFiles0000 = "\x00\x00\x00\x00x\xe4\xb0\x80\xe1\x80\x80t\xe1\xbe\xbf"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFilesHash = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
pc power booster
MaxFixLimit = "15"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
Inno Setup: Setup Version = "5.5.6 (u)"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
Inno Setup: App Path = "%Program Files%\PC Power Booster"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
InstallLocation = "%Program Files%\PC Power Booster"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
Inno Setup: Icon Group = "PC Power Booster"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
Inno Setup: User = "{username}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
Inno Setup: Language = "en"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
DisplayName = "PC Power Booster"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
DisplayIcon = "%Program Files%\PC Power Booster\PCPowerBooster.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
UninstallString = "%Program Files%\PC Power Booster\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
QuietUninstallString = "%Program Files%\PC Power Booster\unins000.exe /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
DisplayVersion = "3.9.9.941"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
Publisher = "www.pcpowerboost.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
URLInfoAbout = "www.pcpowerboost.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
HelpLink = "www.pcpowerboost.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
InstallDate = "20200212"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
MajorVersion = "3"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
MinorVersion = "9"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
EstimatedSize = "13607"

HKEY_CURRENT_USER\Software\Jawego\
Params
PCPBGuid = "pc power booster"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Jawego\Params
PCPBGuid = "pc power booster"

HKEY_CURRENT_USER\Software\pc power booster\
LANG
LangCode = "en"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
pc power booster\LANG
LangID = "0"

HKEY_CURRENT_USER\Software\pc power booster\
LANG
LangID = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\PC Power Booster_is1
UninstallString = "%Program Files%\PC Power Booster\unins000.exe /silent"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{{GUID}}
(Default) = "JScript Language"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{{GUID}}\
ProgID
(Default) = "JScript"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{{GUID}}\
InprocServer32
(Default) = "%System%\jscript.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{{GUID}}\
InprocServer32
ThreadingModel = "Both"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JScript.Compact Author
(Default) = "JScript Language Authoring"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JScript.Compact Author\CLSID
(Default) = "{{GUID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript1.2 AuthorJavaScript1.3 Author
(Default) = "JScript Language Authoring"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript1.2 AuthorJavaScript1.3 Author\CLSID
(Default) = "{{GUID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ECMAScript Author
(Default) = "JScript Language Authoring"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ECMAScript Author\CLSID
(Default) = "{{GUID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{{GUID}}
(Default) = "JScript Language Authoring"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{{GUID}}\
ProgID
(Default) = "JScript Author"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{{GUID}}
(Default) = "JScript Language Encoding"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{{GUID}}\
ProgID
(Default) = "JScript.Encode"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JScript.Compact
(Default) = "JScript Compact Profile (ECMA 327)"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JScript.Compact\CLSID
(Default) = "{{GUID}}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{{GUID}}
(Default) = "JScript Compact Profile (ECMA 327)"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{{GUID}}\
ProgID
(Default) = "JScript.Compact"

HKEY_CURRENT_USER\Software\PC\
Power\Booster\key\
6
(Default) = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
PC\Power\Booster\
key\6
(Default) = "{random characters}"

HKEY_CURRENT_USER\Software\pc power booster
1stInstalled_Time = "2/12/2020 1:52:24 PM"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
pc power booster
Expired = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
pc power booster
FirstTimePCPBFired = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\DirectDraw\MostRecentApplication
Name = "PCPowerBooster.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\DirectDraw\MostRecentApplication
ID = "1520233734"

HKEY_CURRENT_USER\Software\pc power booster
SetChkDontShowRedTrayPopup = "0"

HKEY_CURRENT_USER\Software\pc power booster
SetChkREmovableMedia = "1"

HKEY_CURRENT_USER\Software\pc power booster
SetChkSkipEmptyKeys = "1"

HKEY_CURRENT_USER\Software\pc power booster
ImprovementProgram = "1"

HKEY_CURRENT_USER\Software\pc power booster
StartWhenWinBoots = "1"

HKEY_CURRENT_USER\Software\pc power booster
GoToSystemTrayOnClose = "0"

HKEY_CURRENT_USER\Software\pc power booster
SetEnableSound = "1"

HKEY_CURRENT_USER\Software\pc power booster
ConfirmBkUps = "1"

HKEY_CURRENT_USER\Software\pc power booster
StartScan = "0"

HKEY_CURRENT_USER\Software\pc power booster
StartMinimized = "0"

HKEY_CURRENT_USER\Software\pc power booster
AutoRepair = "0"

HKEY_CURRENT_USER\Software\pc power booster
StrLastScan = ""

HKEY_CURRENT_USER\Software\pc power booster
StrLastScanResults = "0"

HKEY_CURRENT_USER\Software\pc power booster
ErrorCount = "0"

HKEY_CURRENT_USER\Software\pc power booster
StrLastOptimizeTime = ""

HKEY_CURRENT_USER\Software\pc power booster
StrLatestRegDefrag = ""

HKEY_CURRENT_USER\Software\pc power booster
StrLatestRestorePoint = ""

HKEY_CURRENT_USER\Software\pc power booster
StrLastStartupOpt = ""

HKEY_CURRENT_USER\Software\pc power booster
RegErrFoundTillDate = "0"

HKEY_CURRENT_USER\Software\pc power booster
RegErrsFixedTillDate = "0"

HKEY_CURRENT_USER\Software\pc power booster
RegErrsFixedLast = "0"

HKEY_CURRENT_USER\Software\pc power booster
ScheduledTime = ""

HKEY_CURRENT_USER\Software\pc power booster
NumTimesPCPRunned = "1"

HKEY_CURRENT_USER\Software\pc power booster
SetChkPeriodicUpDate = "1"

HKEY_CURRENT_USER\Software\pc power booster
FirstRun = "1"

HKEY_CURRENT_USER\Software\pc power booster
CanAutoScan = "0"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0001
Owner = "p\x0b\x00\x00^\xac\xc9\xdb\xa8\xe1\xd5\x01"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0001
SessionHash = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0001
Sequence = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
SysMon
TELNO = "(844) 763-5838"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
SysMon
TELNOFR = "01.76.54.05.61"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
SysMon
TELNODE = "(800) 180-6512"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
SysMon
TELNOJP = "03-5050-1410"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
SysMon
TELNOAU = "1800 154 231"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
SysMon
TELNOUK = "0800 031 4657"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0001
RegFiles0000 = "\x00\x00"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0001
RegFilesHash = "'S8lrj\x9c$\x18'q\x07I\xf4\xe0\x7f\xe5Q\x9d\x92\xa87\xc1OI\xf2n\xa8\xc5W\x0b\xa4"

HKEY_CURRENT_USER\Software\SysMon\
LANG
LangCode = "en"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
SysMon\LANG
LangCode = "en"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
SysMon\LANG
LangID = "0"

HKEY_CURRENT_USER\Software\SysMon\
LANG
LangID = "0"

Ändert die folgenden Registrierungseinträge:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JScript
(Default) = "JScript Language"

(Note: The default value data of the said registry entry is JScript Language.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JScript\CLSID
(Default) = "{{GUID}}"

(Note: The default value data of the said registry entry is {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
LiveScript
(Default) = "JScript Language"

(Note: The default value data of the said registry entry is JScript Language.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
LiveScript\CLSID
(Default) = "{{GUID}}"

(Note: The default value data of the said registry entry is {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript
(Default) = "JScript Language"

(Note: The default value data of the said registry entry is JScript Language.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript\CLSID
(Default) = "{{GUID}}"

(Note: The default value data of the said registry entry is {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript1.1
(Default) = "JScript Language"

(Note: The default value data of the said registry entry is JScript Language.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript1.1\CLSID
(Default) = "{{GUID}}"

(Note: The default value data of the said registry entry is {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript1.2
(Default) = "JScript Language"

(Note: The default value data of the said registry entry is JScript Language.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript1.2\CLSID
(Default) = "{{GUID}}"

(Note: The default value data of the said registry entry is {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript1.3
(Default) = "JScript Language"

(Note: The default value data of the said registry entry is JScript Language.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript1.3\CLSID
(Default) = "{{GUID}}"

(Note: The default value data of the said registry entry is {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ECMAScript
(Default) = "JScript Language"

(Note: The default value data of the said registry entry is JScript Language.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ECMAScript\CLSID
(Default) = "{{GUID}}"

(Note: The default value data of the said registry entry is {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Component Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}
409 = "Active Scripting Engine"

(Note: The default value data of the said registry entry is Active Scripting Engine.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Component Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}
409 = "Active Scripting Engine with Parsing"

(Note: The default value data of the said registry entry is Active Scripting Engine with Parsing.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JScript Author
(Default) = "JScript Language Authoring"

(Note: The default value data of the said registry entry is JScript Language Authoring.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JScript Author\CLSID
(Default) = "{{GUID}}"

(Note: The default value data of the said registry entry is {f414c261-6ac0-11cf-b6d1-00aa00bbbb58}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
LiveScript Author
(Default) = "JScript Language Authoring"

(Note: The default value data of the said registry entry is JScript Language Authoring.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
LiveScript Author\CLSID
(Default) = "{{GUID}}"

(Note: The default value data of the said registry entry is {f414c261-6ac0-11cf-b6d1-00aa00bbbb58}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript Author
(Default) = "JScript Language Authoring"

(Note: The default value data of the said registry entry is JScript Language Authoring.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript Author\CLSID
(Default) = "{{GUID}}"

(Note: The default value data of the said registry entry is {f414c261-6ac0-11cf-b6d1-00aa00bbbb58}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript1.1 Author
(Default) = "JScript Language Authoring"

(Note: The default value data of the said registry entry is JScript Language Authoring.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JavaScript1.1 Author\CLSID
(Default) = "{{GUID}}"

(Note: The default value data of the said registry entry is {f414c261-6ac0-11cf-b6d1-00aa00bbbb58}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Component Categories\{0AEE2A92-BCBB-11D0-8C72-00C04FC2B085}
409 = "Active Scripting Engine with Authoring"

(Note: The default value data of the said registry entry is Active Scripting Engine with Authoring.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JScript.Encode
(Default) = "JScript Language Encoding"

(Note: The default value data of the said registry entry is JScript Language Encoding.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
JScript.Encode\CLSID
(Default) = "{{GUID}}"

(Note: The default value data of the said registry entry is {f414c262-6ac0-11cf-b6d1-00aa00bbbb58}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Component Categories\{F0B7A1A3-9847-11CF-8F20-00805F2CD064}
409 = "Active Scripting Engine with Encoding"

(Note: The default value data of the said registry entry is Active Scripting Engine with Encoding.)

Löscht die folgenden Registrierungsschlüssel:

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\RegFilesHash

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\RegFiles0000

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\Sequence

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\SessionHash

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000\Owner

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0001\RegFilesHash

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0001\RegFiles0000

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0001\Sequence

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0001\SessionHash

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0001\Owner

Einschleusungsroutine

Schleust die folgenden Dateien ein:

  • %Program Files%\PC Power Booster\RegList.pcpb
  • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\joppu72\imagestore.dat
  • %Program Files%\PC Power Booster\xmllite.dll
  • %Program Files%\PC Power Booster\is-J7V1B.tmp
  • %Program Files%\PC Power Booster\is-74ALP.tmp
  • %Program Files%\PC Power Booster\is-VH2F5.tmp
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\{1B8B5BCE-4D9C-11EA-AFA6-005056BC7F0D}.dat
  • %Program Files%\PC Power Booster\PCPowerBooster.exe
  • %Program Files%\PC Power Booster\is-G3VU5.tmp
  • %Program Files%\PC Power Booster\is-I89V4.tmp
  • %Program Files%\PC Power Booster\Norwegian_uninst.ini
  • %Program Files%\PC Power Booster\is-IQ8TK.tmp
  • %Program Files%\PC Power Booster\is-RDM9G.tmp
  • %Program Files%\PC Power Booster\FileList.pcpb
  • %Program Files%\PC Power Booster\ja.ini
  • %Application Data%\SysMon\is-M1QTV.tmp
  • %Program Files%\PC Power Booster\is-PEOQF.tmp
  • %Program Files%\PC Power Booster\is-M4RHK.tmp
  • %User Temp%\is-RG569.tmp\_isetup\_shfoldr.dll
  • %Program Files%\PC Power Booster\is-TC7IM.tmp
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster\Register PC Power Booster.lnk
  • %Application Data%\SysMon\is-KQ17G.tmp
  • %Program Files%\PC Power Booster\it.ini
  • %Program Files%\PC Power Booster\is-912O3.tmp
  • %Application Data%\SysMon\japan_sm.ini
  • %Program Files%\PC Power Booster\zhtw.ini
  • %Program Files%\PC Power Booster\is-OG293.tmp
  • %Program Files%\PC Power Booster\is-MP8J4.tmp
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1B8B5BCC-4D9C-11EA-AFA6-005056BC7F0D}.dat
  • %Program Files%\PC Power Booster\portugese_uninst_pt.ini
  • %Program Files%\PC Power Booster\korean_uninst_ko.ini
  • %Program Files%\PC Power Booster\greek_uninst_el.ini
  • %Program Files%\PC Power Booster\PCPBUns.exe
  • %Windows%\Tasks\PC Power Booster_UPDATES.job
  • %Program Files%\PC Power Booster\is-6QEJN.tmp
  • %Application Data%\SysMon\is-89LE8.tmp
  • %Program Files%\PC Power Booster\is-88B9M.tmp
  • %Program Files%\PC Power Booster\sysmon.exe
  • %Program Files%\PC Power Booster\is-TV06R.tmp
  • %Program Files%\PC Power Booster\is-TBGRN.tmp
  • %Program Files%\PC Power Booster\tr.ini
  • %Program Files%\PC Power Booster\is-EABSK.tmp
  • %Program Files%\PC Power Booster\unins000.msg
  • %Program Files%\PC Power Booster\nl.ini
  • %Program Files%\PC Power Booster\is-4T13N.tmp
  • %Program Files%\PC Power Booster\is-L5B3C.tmp
  • %Program Files%\PC Power Booster\is-MUM7B.tmp
  • %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT
  • %Program Files%\PC Power Booster\sv.ini
  • %Program Files%\PC Power Booster\Italian_uninst.ini
  • %Application Data%\pc power booster\en.dat
  • %Program Files%\PC Power Booster\ko.ini
  • %Program Files%\PC Power Booster\es.ini
  • %Windows%\Tasks\PC Power Booster_DEFAULT.job
  • %Program Files%\PC Power Booster\Danish_uninst.ini
  • %Application Data%\SysMon\is-3LS1R.tmp
  • %Program Files%\PC Power Booster\Japanese_uninst.ini
  • %Program Files%\PC Power Booster\el.ini
  • %Program Files%\PC Power Booster\polish_uninst_pl.ini
  • %Program Files%\PC Power Booster\traditionalcn_uninst_zh-tw.ini
  • %Program Files%\PC Power Booster\russian_uninst_ru.ini
  • %Application Data%\SysMon\isxdl.dll
  • %Program Files%\PC Power Booster\is-17PT2.tmp
  • %Program Files%\PC Power Booster\ptbr.ini
  • %System Root%\Users\Public\Desktop\PC Power Booster.lnk
  • %Program Files%\PC Power Booster\is-SBNT9.tmp
  • %Program Files%\PC Power Booster\is-0S12U.tmp
  • %Program Files%\PC Power Booster\is-T35B8.tmp
  • %Program Files%\PC Power Booster\da.ini
  • %Program Files%\PC Power Booster\fi.ini
  • %Program Files%\PC Power Booster\en.ini
  • %Program Files%\PC Power Booster\is-9O7KU.tmp
  • %Program Files%\PC Power Booster\unins000.dat
  • %Application Data%\SysMon\ininotfound0.ini
  • %Application Data%\SysMon\French_sm.ini
  • %Program Files%\PC Power Booster\ru.ini
  • %Application Data%\pc power booster\log_02-12-2020.log
  • %Program Files%\PC Power Booster\pl.ini
  • %Application Data%\pc power booster\backup6.bin
  • %Program Files%\PC Power Booster\pt.ini
  • %Program Files%\PC Power Booster\is-JQ4AN.tmp
  • %Program Files%\PC Power Booster\leftbmp.bmp
  • %Application Data%\SysMon\eng_sm.ini
  • %Program Files%\PC Power Booster\is-2P4PS.tmp
  • %Program Files%\PC Power Booster\is-LRKRG.tmp
  • %Program Files%\PC Power Booster\German_uninst.ini
  • %Program Files%\PC Power Booster\Turkish_uninst_tr.ini
  • %Program Files%\PC Power Booster\is-KEP10.tmp
  • %Program Files%\PC Power Booster\is-5073V.tmp
  • %User Temp%\is-RG569.tmp\_isetup\_iscrypt.dll
  • %Program Files%\PC Power Booster\is-R06MC.tmp
  • %Program Files%\PC Power Booster\is-7MIBM.tmp
  • %Program Files%\PC Power Booster\is-DEQ33.tmp
  • %Program Files%\PC Power Booster\French_uninst.ini
  • %Program Files%\PC Power Booster\is-UPMTL.tmp
  • %Program Files%\PC Power Booster\Chinese_uninst.ini
  • %Program Files%\PC Power Booster\is-JGAK7.tmp
  • %Program Files%\PC Power Booster\eng_uninst.ini
  • %Program Files%\PC Power Booster\is-FC1CM.tmp
  • %Program Files%\PC Power Booster\is-ML989.tmp
  • %Program Files%\PC Power Booster\is-B5EG3.tmp
  • %Program Files%\PC Power Booster\is-E63O0.tmp
  • %Program Files%\PC Power Booster\swedish_uninst.ini
  • %Program Files%\PC Power Booster\is-CFK9R.tmp
  • %Program Files%\PC Power Booster\is-UPE52.tmp
  • %Application Data%\SysMon\German_sm.ini
  • %Program Files%\PC Power Booster\is-3P19H.tmp
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster\PC Power Booster.lnk
  • %Program Files%\PC Power Booster\is-QTBE9.tmp
  • %Program Files%\PC Power Booster\de.ini
  • %Program Files%\PC Power Booster\is-4MI8I.tmp
  • %Program Files%\PC Power Booster\Dutch_uninst.ini
  • %Application Data%\SysMon\is-RR99T.tmp
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat
  • %Program Files%\PC Power Booster\zhcn.ini
  • %Program Files%\PC Power Booster\is-9MF8K.tmp
  • %Program Files%\PC Power Booster\no.ini
  • %Program Files%\PC Power Booster\is-91NSC.tmp
  • %Program Files%\PC Power Booster\Finnish_uninst_fi.ini
  • %User Temp%\is-FK05B.tmp\_isetup\_shfoldr.dll
  • %Application Data%\SysMon\sysmon.exe
  • %Program Files%\PC Power Booster\spanish_uninst.ini
  • %Program Files%\PC Power Booster\Portuguese_uninst.ini
  • %Application Data%\SysMon\is-1G7RM.tmp
  • %Program Files%\PC Power Booster\unins000.exe
  • %Program Files%\PC Power Booster\is-DBR6J.tmp
  • %Program Files%\PC Power Booster\is-R67PN.tmp
  • %Program Files%\PC Power Booster\fr.ini
  • %Program Files%\PC Power Booster\isxdl.dll

(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.. %System Root% ist der Stammordner, normalerweise C:\. Dort befindet sich auch das Betriebssystem.)

Andere Details

It connects to the following possibly malicious URL:

  • http://www.{BLOCKED}rboost.com/getipaddress.asp
  • http://track.{BLOCKED}rboost.com/tempfile/8_36_123_206
  • http://www.{BLOCKED}rboost.com/afterinstall/?&LangID=en
  • http://www.{BLOCKED}rboost.com/js/html5shiv.js
  • http://www.{BLOCKED}-analytics.com/ga.js
  • http://b34df4ra1.{BLOCKED}o.llnwd.net/images/pcpowerboost.com/product/afterinstall_logo.png
  • http://b34df4ra1.{BLOCKED}o.llnwd.net/images/pcpowerboost.com/mcafee/macfee_box.png
  • http://b34df4ra1.{BLOCKED}o.llnwd.net/images/pcpowerboost.com/mcafee/days.png
  • http://b34df4ra1.{BLOCKED}o.llnwd.net/{random path}
  • http://b34df4ra1.{BLOCKED}o.llnwd.net/images/pcpowerboost.com/mcafee/macfee_icon.png
  • http://www.{BLOCKED}-analytics.com/r/__utm.gif?{random characters}
  • http://y31uv4ra1.{BLOCKED}o.llnwd.net/images/pcpowerboost.com/common/recommended-download.jpg
  • http://b34df4ra1.{BLOCKED}o.llnwd.net/images/pcpowerboost.com/product/favicon.ico
  • http://go.{BLOCKED}oft.com
  • http://api.{BLOCKED}g.com
  • http://www.{BLOCKED}g.com
  • http://sqm.{BLOCKED}try.microsoft.com

  Solução

Mecanismo de varredura mínima: 9.850

Step 1

Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.

Step 2

Dateien erkennen und deaktivieren, die als PUA.Win32.JAWEGO.AE entdeckt wurden

[ Saber mais ]
  1. Für Windows 98 und ME Benutzer: Der Windows Task-Manager zeigt möglicherweise nicht alle aktiven Prozesse an. Verwenden Sie in diesem Fall einen Prozess-Viewer eines Drittanbieters, vorzugsweise Process Explorer, um die Malware-/Grayware-/Spyware-Datei zu beenden. Dieses Tool können Sie hier.
    2. herunterladen.
  2. Wenn die entdeckte Datei im Windows Task-Manager oder Process Explorer angezeigt wird, aber nicht gelöscht werden kann, starten Sie Ihren Computer im abgesicherten Modus neu. Klicken Sie auf diesen Link, um alle erforderlichen Schritte anzuzeigen.
  3. Wenn die entdeckte Datei nicht im Windows Task-Manager oder im Process Explorer angezeigt wird, fahren Sie mit den nächsten Schritten fort.

Step 3

Diesen Registrierungswert löschen

[ Saber mais ]

Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.

  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • Owner = "T\x03\x00\x00\xbb\xa3\xea\xd4\xa8\xe1\xd5\x01"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • SessionHash = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • Sequence = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pc power booster
    • TELNO = "(855) 761-8856"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pc power booster
    • TELNOFR = "01.76.54.27.59"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pc power booster
    • TELNODE = "(800) 180-6512"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pc power booster
    • TELNOJP = "03-5050-1410"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pc power booster
    • support_email = "support@jawego.com"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pc power booster
    • ShowExitPage = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Jawego\Params
    • PCPB = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pc power booster
    • PCPBURL = "http://www.{BLOCKED}rboost.com/buynow/?"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pc power booster
    • RENEWALURL = "http://www.{BLOCKED}rboost.com/renewal/?"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • RegFiles0000 = "\x00\x00\x00\x00x\xe4\xb0\x80\xe1\x80\x80t\xe1\xbe\xbf"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • RegFilesHash = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pc power booster
    • MaxFixLimit = "15"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • Inno Setup: Setup Version = "5.5.6 (u)"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • Inno Setup: App Path = "%Program Files%\PC Power Booster"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • InstallLocation = "%Program Files%\PC Power Booster"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • Inno Setup: Icon Group = "PC Power Booster"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • Inno Setup: User = "{username}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • Inno Setup: Language = "en"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • DisplayName = "PC Power Booster"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • DisplayIcon = "%Program Files%\PC Power Booster\PCPowerBooster.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • UninstallString = "%Program Files%\PC Power Booster\unins000.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • QuietUninstallString = "%Program Files%\PC Power Booster\unins000.exe /SILENT"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • DisplayVersion = "3.9.9.941"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • Publisher = "www.pcpowerboost.com"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • URLInfoAbout = "www.pcpowerboost.com"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • HelpLink = "www.pcpowerboost.com"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • NoModify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • NoRepair = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • InstallDate = "20200212"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • MajorVersion = "3"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • MinorVersion = "9"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • EstimatedSize = "13607"
  • In HKEY_CURRENT_USER\Software\Jawego\Params
    • PCPBGuid = "pc power booster"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Jawego\Params
    • PCPBGuid = "pc power booster"
  • In HKEY_CURRENT_USER\Software\pc power booster\LANG
    • LangCode = "en"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pc power booster\LANG
    • LangID = "0"
  • In HKEY_CURRENT_USER\Software\pc power booster\LANG
    • LangID = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PC Power Booster_is1
    • UninstallString = "%Program Files%\PC Power Booster\unins000.exe /silent"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{{GUID}}
    • (Default) = "JScript Language"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{{GUID}}\ProgID
    • (Default) = "JScript"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{{GUID}}\InprocServer32
    • (Default) = "%System%\jscript.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{{GUID}}\InprocServer32
    • ThreadingModel = "Both"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript.Compact Author
    • (Default) = "JScript Language Authoring"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript.Compact Author\CLSID
    • (Default) = "{{GUID}}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.2 AuthorJavaScript1.3 Author
    • (Default) = "JScript Language Authoring"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.2 AuthorJavaScript1.3 Author\CLSID
    • (Default) = "{{GUID}}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ECMAScript Author
    • (Default) = "JScript Language Authoring"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ECMAScript Author\CLSID
    • (Default) = "{{GUID}}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{{GUID}}
    • (Default) = "JScript Language Authoring"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{{GUID}}\ProgID
    • (Default) = "JScript Author"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{{GUID}}
    • (Default) = "JScript Language Encoding"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{{GUID}}\ProgID
    • (Default) = "JScript.Encode"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript.Compact
    • (Default) = "JScript Compact Profile (ECMA 327)"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript.Compact\CLSID
    • (Default) = "{{GUID}}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{{GUID}}
    • (Default) = "JScript Compact Profile (ECMA 327)"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{{GUID}}\ProgID
    • (Default) = "JScript.Compact"
  • In HKEY_CURRENT_USER\Software\PC\Power\Booster\key\6
    • (Default) = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\PC\Power\Booster\key\6
    • (Default) = "{random characters}"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • 1stInstalled_Time = "2/12/2020 1:52:24 PM"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pc power booster
    • Expired = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\pc power booster
    • FirstTimePCPBFired = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication
    • Name = "PCPowerBooster.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication
    • ID = "1520233734"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • SetChkDontShowRedTrayPopup = "0"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • SetChkREmovableMedia = "1"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • SetChkSkipEmptyKeys = "1"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • ImprovementProgram = "1"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • StartWhenWinBoots = "1"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • GoToSystemTrayOnClose = "0"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • SetEnableSound = "1"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • ConfirmBkUps = "1"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • StartScan = "0"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • StartMinimized = "0"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • AutoRepair = "0"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • StrLastScan = ""
  • In HKEY_CURRENT_USER\Software\pc power booster
    • StrLastScanResults = "0"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • ErrorCount = "0"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • StrLastOptimizeTime = ""
  • In HKEY_CURRENT_USER\Software\pc power booster
    • StrLatestRegDefrag = ""
  • In HKEY_CURRENT_USER\Software\pc power booster
    • StrLatestRestorePoint = ""
  • In HKEY_CURRENT_USER\Software\pc power booster
    • StrLastStartupOpt = ""
  • In HKEY_CURRENT_USER\Software\pc power booster
    • RegErrFoundTillDate = "0"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • RegErrsFixedTillDate = "0"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • RegErrsFixedLast = "0"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • ScheduledTime = ""
  • In HKEY_CURRENT_USER\Software\pc power booster
    • NumTimesPCPRunned = "1"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • SetChkPeriodicUpDate = "1"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • FirstRun = "1"
  • In HKEY_CURRENT_USER\Software\pc power booster
    • CanAutoScan = "0"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
    • Owner = "p\x0b\x00\x00^\xac\xc9\xdb\xa8\xe1\xd5\x01"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
    • SessionHash = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
    • Sequence = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SysMon
    • TELNO = "(844) 763-5838"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SysMon
    • TELNOFR = "01.76.54.05.61"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SysMon
    • TELNODE = "(800) 180-6512"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SysMon
    • TELNOJP = "03-5050-1410"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SysMon
    • TELNOAU = "1800 154 231"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SysMon
    • TELNOUK = "0800 031 4657"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
    • RegFiles0000 = "\x00\x00"
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
    • RegFilesHash = "'S8lrj\x9c$\x18'q\x07I\xf4\xe0\x7f\xe5Q\x9d\x92\xa87\xc1OI\xf2n\xa8\xc5W\x0b\xa4"
  • In HKEY_CURRENT_USER\Software\SysMon\LANG
    • LangCode = "en"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SysMon\LANG
    • LangCode = "en"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SysMon\LANG
    • LangID = "0"
  • In HKEY_CURRENT_USER\Software\SysMon\LANG
    • LangID = "0"

Step 4

Diesen geänderten Registrierungswert wiederherstellen

[ Saber mais ]

Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript
    • From: (Default) = "JScript Language"
      To: (Default) = ""JScript Language""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript\CLSID
    • From: (Default) = "{{GUID}}"
      To: (Default) = ""{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LiveScript
    • From: (Default) = "JScript Language"
      To: (Default) = ""JScript Language""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LiveScript\CLSID
    • From: (Default) = "{{GUID}}"
      To: (Default) = ""{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript
    • From: (Default) = "JScript Language"
      To: (Default) = ""JScript Language""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript\CLSID
    • From: (Default) = "{{GUID}}"
      To: (Default) = ""{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.1
    • From: (Default) = "JScript Language"
      To: (Default) = ""JScript Language""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.1\CLSID
    • From: (Default) = "{{GUID}}"
      To: (Default) = ""{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.2
    • From: (Default) = "JScript Language"
      To: (Default) = ""JScript Language""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.2\CLSID
    • From: (Default) = "{{GUID}}"
      To: (Default) = ""{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.3
    • From: (Default) = "JScript Language"
      To: (Default) = ""JScript Language""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.3\CLSID
    • From: (Default) = "{{GUID}}"
      To: (Default) = ""{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ECMAScript
    • From: (Default) = "JScript Language"
      To: (Default) = ""JScript Language""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ECMAScript\CLSID
    • From: (Default) = "{{GUID}}"
      To: (Default) = ""{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Component Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}
    • From: 409 = "Active Scripting Engine"
      To: 409 = ""Active Scripting Engine""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Component Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}
    • From: 409 = "Active Scripting Engine with Parsing"
      To: 409 = ""Active Scripting Engine with Parsing""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript Author
    • From: (Default) = "JScript Language Authoring"
      To: (Default) = ""JScript Language Authoring""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript Author\CLSID
    • From: (Default) = "{{GUID}}"
      To: (Default) = ""{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LiveScript Author
    • From: (Default) = "JScript Language Authoring"
      To: (Default) = ""JScript Language Authoring""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LiveScript Author\CLSID
    • From: (Default) = "{{GUID}}"
      To: (Default) = ""{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript Author
    • From: (Default) = "JScript Language Authoring"
      To: (Default) = ""JScript Language Authoring""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript Author\CLSID
    • From: (Default) = "{{GUID}}"
      To: (Default) = ""{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.1 Author
    • From: (Default) = "JScript Language Authoring"
      To: (Default) = ""JScript Language Authoring""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\CLSID
    • From: (Default) = "{{GUID}}"
      To: (Default) = ""{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Component Categories\{0AEE2A92-BCBB-11D0-8C72-00C04FC2B085}
    • From: 409 = "Active Scripting Engine with Authoring"
      To: 409 = ""Active Scripting Engine with Authoring""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript.Encode
    • From: (Default) = "JScript Language Encoding"
      To: (Default) = ""JScript Language Encoding""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\JScript.Encode\CLSID
    • From: (Default) = "{{GUID}}"
      To: (Default) = ""{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}""
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Component Categories\{F0B7A1A3-9847-11CF-8F20-00805F2CD064}
    • From: 409 = "Active Scripting Engine with Encoding"
      To: 409 = ""Active Scripting Engine with Encoding""

Step 5

Diese Dateien suchen und löschen

[ Saber mais ]
Möglicherweise sind einige Komponentendateien verborgen. Aktivieren Sie unbedingt das Kontrollkästchen Versteckte Elemente durchsuchen unter "Weitere erweiterte Optionen", um alle verborgenen Dateien und Ordner in den Suchergebnissen zu berücksichtigen.
  • %Program Files%\PC Power Booster\RegList.pcpb
  • %AppDataLocal%\Microsoft\Internet Explorer\imagestore\joppu72\imagestore.dat
  • %Program Files%\PC Power Booster\xmllite.dll
  • %Program Files%\PC Power Booster\is-J7V1B.tmp
  • %Program Files%\PC Power Booster\is-74ALP.tmp
  • %Program Files%\PC Power Booster\is-VH2F5.tmp
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\{1B8B5BCE-4D9C-11EA-AFA6-005056BC7F0D}.dat
  • %Program Files%\PC Power Booster\PCPowerBooster.exe
  • %Program Files%\PC Power Booster\is-G3VU5.tmp
  • %Program Files%\PC Power Booster\is-I89V4.tmp
  • %Program Files%\PC Power Booster\Norwegian_uninst.ini
  • %Program Files%\PC Power Booster\is-IQ8TK.tmp
  • %Program Files%\PC Power Booster\is-RDM9G.tmp
  • %Program Files%\PC Power Booster\FileList.pcpb
  • %Program Files%\PC Power Booster\ja.ini
  • %Application Data%\SysMon\is-M1QTV.tmp
  • %Program Files%\PC Power Booster\is-PEOQF.tmp
  • %Program Files%\PC Power Booster\is-M4RHK.tmp
  • %User Temp%\is-RG569.tmp\_isetup\_shfoldr.dll
  • %Program Files%\PC Power Booster\is-TC7IM.tmp
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster\Register PC Power Booster.lnk
  • %Application Data%\SysMon\is-KQ17G.tmp
  • %Program Files%\PC Power Booster\it.ini
  • %Program Files%\PC Power Booster\is-912O3.tmp
  • %Application Data%\SysMon\japan_sm.ini
  • %Program Files%\PC Power Booster\zhtw.ini
  • %Program Files%\PC Power Booster\is-OG293.tmp
  • %Program Files%\PC Power Booster\is-MP8J4.tmp
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1B8B5BCC-4D9C-11EA-AFA6-005056BC7F0D}.dat
  • %Program Files%\PC Power Booster\portugese_uninst_pt.ini
  • %Program Files%\PC Power Booster\korean_uninst_ko.ini
  • %Program Files%\PC Power Booster\greek_uninst_el.ini
  • %Program Files%\PC Power Booster\PCPBUns.exe
  • %Windows%\Tasks\PC Power Booster_UPDATES.job
  • %Program Files%\PC Power Booster\is-6QEJN.tmp
  • %Application Data%\SysMon\is-89LE8.tmp
  • %Program Files%\PC Power Booster\is-88B9M.tmp
  • %Program Files%\PC Power Booster\sysmon.exe
  • %Program Files%\PC Power Booster\is-TV06R.tmp
  • %Program Files%\PC Power Booster\is-TBGRN.tmp
  • %Program Files%\PC Power Booster\tr.ini
  • %Program Files%\PC Power Booster\is-EABSK.tmp
  • %Program Files%\PC Power Booster\unins000.msg
  • %Program Files%\PC Power Booster\nl.ini
  • %Program Files%\PC Power Booster\is-4T13N.tmp
  • %Program Files%\PC Power Booster\is-L5B3C.tmp
  • %Program Files%\PC Power Booster\is-MUM7B.tmp
  • %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT
  • %Program Files%\PC Power Booster\sv.ini
  • %Program Files%\PC Power Booster\Italian_uninst.ini
  • %Application Data%\pc power booster\en.dat
  • %Program Files%\PC Power Booster\ko.ini
  • %Program Files%\PC Power Booster\es.ini
  • %Windows%\Tasks\PC Power Booster_DEFAULT.job
  • %Program Files%\PC Power Booster\Danish_uninst.ini
  • %Application Data%\SysMon\is-3LS1R.tmp
  • %Program Files%\PC Power Booster\Japanese_uninst.ini
  • %Program Files%\PC Power Booster\el.ini
  • %Program Files%\PC Power Booster\polish_uninst_pl.ini
  • %Program Files%\PC Power Booster\traditionalcn_uninst_zh-tw.ini
  • %Program Files%\PC Power Booster\russian_uninst_ru.ini
  • %Application Data%\SysMon\isxdl.dll
  • %Program Files%\PC Power Booster\is-17PT2.tmp
  • %Program Files%\PC Power Booster\ptbr.ini
  • %System Root%\Users\Public\Desktop\PC Power Booster.lnk
  • %Program Files%\PC Power Booster\is-SBNT9.tmp
  • %Program Files%\PC Power Booster\is-0S12U.tmp
  • %Program Files%\PC Power Booster\is-T35B8.tmp
  • %Program Files%\PC Power Booster\da.ini
  • %Program Files%\PC Power Booster\fi.ini
  • %Program Files%\PC Power Booster\en.ini
  • %Program Files%\PC Power Booster\is-9O7KU.tmp
  • %Program Files%\PC Power Booster\unins000.dat
  • %Application Data%\SysMon\ininotfound0.ini
  • %Application Data%\SysMon\French_sm.ini
  • %Program Files%\PC Power Booster\ru.ini
  • %Application Data%\pc power booster\log_02-12-2020.log
  • %Program Files%\PC Power Booster\pl.ini
  • %Application Data%\pc power booster\backup6.bin
  • %Program Files%\PC Power Booster\pt.ini
  • %Program Files%\PC Power Booster\is-JQ4AN.tmp
  • %Program Files%\PC Power Booster\leftbmp.bmp
  • %Application Data%\SysMon\eng_sm.ini
  • %Program Files%\PC Power Booster\is-2P4PS.tmp
  • %Program Files%\PC Power Booster\is-LRKRG.tmp
  • %Program Files%\PC Power Booster\German_uninst.ini
  • %Program Files%\PC Power Booster\Turkish_uninst_tr.ini
  • %Program Files%\PC Power Booster\is-KEP10.tmp
  • %Program Files%\PC Power Booster\is-5073V.tmp
  • %User Temp%\is-RG569.tmp\_isetup\_iscrypt.dll
  • %Program Files%\PC Power Booster\is-R06MC.tmp
  • %Program Files%\PC Power Booster\is-7MIBM.tmp
  • %Program Files%\PC Power Booster\is-DEQ33.tmp
  • %Program Files%\PC Power Booster\French_uninst.ini
  • %Program Files%\PC Power Booster\is-UPMTL.tmp
  • %Program Files%\PC Power Booster\Chinese_uninst.ini
  • %Program Files%\PC Power Booster\is-JGAK7.tmp
  • %Program Files%\PC Power Booster\eng_uninst.ini
  • %Program Files%\PC Power Booster\is-FC1CM.tmp
  • %Program Files%\PC Power Booster\is-ML989.tmp
  • %Program Files%\PC Power Booster\is-B5EG3.tmp
  • %Program Files%\PC Power Booster\is-E63O0.tmp
  • %Program Files%\PC Power Booster\swedish_uninst.ini
  • %Program Files%\PC Power Booster\is-CFK9R.tmp
  • %Program Files%\PC Power Booster\is-UPE52.tmp
  • %Application Data%\SysMon\German_sm.ini
  • %Program Files%\PC Power Booster\is-3P19H.tmp
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster\PC Power Booster.lnk
  • %Program Files%\PC Power Booster\is-QTBE9.tmp
  • %Program Files%\PC Power Booster\de.ini
  • %Program Files%\PC Power Booster\is-4MI8I.tmp
  • %Program Files%\PC Power Booster\Dutch_uninst.ini
  • %Application Data%\SysMon\is-RR99T.tmp
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat
  • %Program Files%\PC Power Booster\zhcn.ini
  • %Program Files%\PC Power Booster\is-9MF8K.tmp
  • %Program Files%\PC Power Booster\no.ini
  • %Program Files%\PC Power Booster\is-91NSC.tmp
  • %Program Files%\PC Power Booster\Finnish_uninst_fi.ini
  • %User Temp%\is-FK05B.tmp\_isetup\_shfoldr.dll
  • %Application Data%\SysMon\sysmon.exe
  • %Program Files%\PC Power Booster\spanish_uninst.ini
  • %Program Files%\PC Power Booster\Portuguese_uninst.ini
  • %Application Data%\SysMon\is-1G7RM.tmp
  • %Program Files%\PC Power Booster\unins000.exe
  • %Program Files%\PC Power Booster\is-DBR6J.tmp
  • %Program Files%\PC Power Booster\is-R67PN.tmp
  • %Program Files%\PC Power Booster\fr.ini
  • %Program Files%\PC Power Booster\isxdl.dll

Step 6

Diese Ordner suchen und löschen

[ Saber mais ]
Aktivieren Sie unbedingt das Kontrollkästchen Versteckte Elemente durchsuchen unter Weitere erweiterte Optionen, um alle verborgenen Ordner in den Suchergebnissen zu berücksichtigen.
  • %User Temp%\is-FK05B.tmp\_isetup
  • %Application Data%\pc power booster
  • %User Temp%\is-RG569.tmp\_isetup
  • %Program Files%\PC Power Booster
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster
  • %Application Data%\SysMon

Step 7

Durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt, und löschen Sie Dateien, die als PUA.Win32.JAWEGO.AE entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.

Step 8

Diese Datei über eine Sicherungskopie wiederherstellen Nur Microsoft basierte Dateien werden wiederhergestellt. Falls diese Malware/Grayware/Spyware auch Dateien aus Programmen gelöscht hat, die nicht von Microsoft stammen, installieren Sie diese Programme auf Ihrem Computer bitte neu.

  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{4555A5E7-C06D-11E6-8AB1-005056BC3E18}.dat

Step 9

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster\PC Power Booster.pif
  • %AppDataLocal%Low\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
  • %Windows%\Tasks\RunAtStartup.job
  • %AppDataLocal%\Microsoft\Internet Explorer\Recovery\High\Last Active\{AD285A8B-713F-11E9-85F8-005056BC44A9}.dat
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster\PC Power Booster.url
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster\Register PC Power Booster.pif
  • %Windows%\Tasks\PC Power Booster.job
  • %System Root%\Users\Public\Desktop\PC Power Booster.pif
  • %System Root%\Users\Public\Desktop\PC Power Booster.url
  • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\PC Power Booster\Register PC Power Booster.url

Step 10

Restore these deleted registry keys/values from backup

*Note: Only Microsoft-related keys/values will be restored. If the malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.

  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • RegFilesHash
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • RegFiles0000
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • Sequence
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • SessionHash
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
    • Owner
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
    • RegFilesHash
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
    • RegFiles0000
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
    • Sequence
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
    • SessionHash
  • In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
    • Owner


Participe da nossa pesquisa!