PUA.Win32.Auslogics.AH

Publish Date: 12 gennaio 2020

Piattaforma:

Windows

Valutazione del rischio complessivo:

Reported Infection:

Sistema di Impatto: :

Informazioni esposizione: :

Basso

Medio

Alto

Critico

Tipo di minaccia informatica:
Potentially Unwanted Application
Distruttivo?:
No
Crittografato?:
In the wild::
Sì

Panoramica e descrizione

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

Dettagli tecnici

Dimensione file: 244,736 bytes

Tipo di file: EXE

Residente in memoria: Sì

Data di ricezione campioni iniziali: 12 gennaio 2020

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

%User Temp%\is-HMAM3.tmp\DefaultBrowserFinder.exe "TweakBit" "PCRepairKit" "pc-repair-kit" "1.x"
%User Temp%\is-HMAM3.tmp\reader.exe "%User Temp%\2AC02BED-480E-4564-9122-78206DF1326C_internet_optimizer_setup.exe" "(x32)HKEY_LOCAL_MACHINE\Software\TweakBit\PCRepairKit\1.x\Settings"
"%System%\regsvr32.exe" /s "%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x64.dll"
"%System%\regsvr32.exe" /s "%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x32.dll"
%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe /Install /Language:"ENU" /AutoStart /SendInfo /AutoScan
"%System Root%\Program Files\Windows Media Player\wmpnetwk.exe"
%System%\svchost.exe -k netsvcs
%System%\svchost.exe -k LocalServiceAndNoImpersonation

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

. %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

. %System Root% es la carpeta raíz, normalmente C:\. También es la ubicación del sistema operativo).

)

Crea las carpetas siguientes:

%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit
%User Temp%\PCRepairKit.madExcept
%All Users Profile%\TweakBit\PCRepairKit
%All Users Profile%\TweakBit\PCRepairKit\1.x
%User Temp%\is-HMAM3.tmp\_isetup
%Program Files%\TweakBit
%Program Files%\TweakBit\PCRepairKit\Data
%Program Files%\TweakBit\PCRepairKit\Lang
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit
%All Users Profile%\TweakBit
%Program Files%\TweakBit\PCRepairKit
%All Users Profile%\TweakBit\PCRepairKit\1.x\Data

. %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

)

Otras modificaciones del sistema

Elimina los archivos siguientes:

%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.pif
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.pif
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.lnk
%Desktop%\TweakBit PCRepairKit.pif
%Program Files%\TweakBit\PCRepairKit\is-5QCKG.tmp
%User Temp%\PCRepairKit.madExcept
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.url
%Desktop%\TweakBit PCRepairKit.url
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.pif
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.url

(Nota: %Desktop% es la carpeta Escritorio del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}\Escritorio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Escritorio, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Escritorio y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\Desktop).

. %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

. %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

)

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\Software\Auslogics\
Google Analytics Package\1.x\Settings

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000

HKEY_LOCAL_MACHINE\Software\TweakBit\
PCRepairKit\1.x\Settings

HKEY_LOCAL_MACHINE\Software\TweakBit\
ATUpdaters\1.x\Settings

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\
ProxyStubClsid32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\
TypeLib

HKEY_CLASSES_ROOT\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}

HKEY_CLASSES_ROOT\AppID\{93469602-4134-4012-A6BC-FD34B37A0C36}

HKEY_CLASSES_ROOT\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
InprocServer32

HKEY_CLASSES_ROOT\BCAgentCOM32.BCAgent32

HKEY_CLASSES_ROOT\BCAgentCOM32.BCAgent32\Clsid

HKEY_CLASSES_ROOT\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
ProgID

HKEY_CLASSES_ROOT\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
Version

HKEY_CLASSES_ROOT\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
TypeLib

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{741C57FF-F26B-E2D6-6A41-2BABBE804D4D}\Version

Agrega las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Auslogics\Google Analytics Package\1.x\
Settings
ClientID = "{28998FD4-7347-4F9B-B598-028BF51DCBD1}"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Owner = "x\x0b\x00\x00\xd9\xb2\xc4\xc8KR\xd5\x01"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
SessionHash = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Sequence = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings
General.Language = "ENU"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings
General.URLSource = "pc-repair-kit"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings
General.Cookie = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings
General.Cookie = "ui_lite"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings
App.Application.PurchaseUrlParam = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings
General.DoNotAddUtmToUrls = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit
ClientID = "{36195DBC-0030-44EB-8AA4-5AF04C38DCF1}"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFiles0000 = "\x00\x00\x00\x00:\xe8\xa0\x80\x0b\xe1\x80\x80t\xe2\xba\xae"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFilesHash = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\ATUpdaters\1.x\
Settings
Shared.Blocking.PCRepairKit = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Inno Setup: Setup Version = "5.5.9 (u)"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Inno Setup: App Path = "%Program Files%\TweakBit\PCRepairKit"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
InstallLocation = "%Program Files%\TweakBit\PCRepairKit"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Inno Setup: Icon Group = "TweakBit\PCRepairKit"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Inno Setup: User = "{username}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Inno Setup: Language = "en"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
DisplayName = "TweakBit PCRepairKit"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
DisplayIcon = "%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
UninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
QuietUninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
DisplayVersion = "1.8.4.19"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Publisher = "Tweakbit Pty Ltd"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
URLInfoAbout = "http://www.{BLOCKED}it.com/support/contact"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
HelpLink = "http://www.{BLOCKED}it.com/en/support.php"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
URLUpdateInfo = "http://www.{BLOCKED}it.com/pc-repair-kit"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
Contact = "info@tweakbit.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
InstallDate = "20190814"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
MajorVersion = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
MinorVersion = "8"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
VersionMajor = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
VersionMinor = "8"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
EstimatedSize = "57537"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
UninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe /compability"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}
(Default) = "IBCAgent32"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\
ProxyStubClsid32
(Default) = "{00020424-0000-0000-C000-000000000046}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\
TypeLib
(Default) = "{F2C6F7D1-ED32-49E5-9919-C51E9E2FD453}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\
TypeLib
Version = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}
AppID = "{93469602-4134-4012-A6BC-FD34B37A0C36}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{93469602-4134-4012-A6BC-FD34B37A0C36}
DllSurrogate = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}
(Default) = "TweakBit BCAgent32"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
InprocServer32
(Default) = "%Program Files%\TweakBit\PCREPA~1\BROWSE~3.DLL"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
InprocServer32
ThreadingModel = "Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
BCAgentCOM32.BCAgent32
(Default) = "TweakBit BCAgent32"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
BCAgentCOM32.BCAgent32\Clsid
(Default) = "{93469602-4134-4012-A6BC-FD34B37A0C36}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
ProgID
(Default) = "BCAgentCOM32.BCAgent32"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
Version
(Default) = "1.0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\
TypeLib
(Default) = "{F2C6F7D1-ED32-49E5-9919-C51E9E2FD453}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Wow6432Node\CLSID\{741C57FF-F26B-E2D6-6A41-2BABBE804D4D}\
Version
Assembly = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings
General.InstallDateTime = "\xe5\xdc\xc4\xc4lU\xe5@"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings
(Default) = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings
App.Application.FileName = "%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings
Application.SplitTest = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings
Application.AutoScan.Enabled = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings
Application.AutoScan.TimeStamp = "\x00p\x08\xa3v\xd2,@"

Modifica las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BITS
Start = "3"

(Note: The default value data of the said registry entry is 3.)

Elimina las siguientes claves de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
TweakBit\PCRepairKit\1.x\
Settings\General.DefWebBrowser

Rutina de infiltración

Infiltra los archivos siguientes:

%Program Files%\TweakBit\PCRepairKit\Data\is-E9QP4.tmp
%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x32.dll
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite
%Program Files%\TweakBit\PCRepairKit\Lang\enu.lng
%Program Files%\TweakBit\PCRepairKit\is-PE5UR.tmp
%Program Files%\TweakBit\PCRepairKit\ATUpdatersHelper.dll
%Program Files%\TweakBit\PCRepairKit\TweakManager.exe
%Program Files%\TweakBit\PCRepairKit\Lang\esp.lng
%User Temp%\is-HMAM3.tmp\AxComponentsRTL.bpl
%Program Files%\TweakBit\PCRepairKit\SystemInformationHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-DSCPP.tmp
%Program Files%\TweakBit\PCRepairKit\is-EF98D.tmp
%Program Files%\TweakBit\PCRepairKit\Lang\is-PME8V.tmp
%Program Files%\TweakBit\PCRepairKit\is-7PMGM.tmp
%Program Files%\TweakBit\PCRepairKit\is-Q8V9I.tmp
%User Temp%\is-HMAM3.tmp\$$$Databases.db119761213
%Program Files%\TweakBit\PCRepairKit\Data\hmthinfo.mdict
%Program Files%\TweakBit\PCRepairKit\TaskSchedulerHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-I43K4.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-0CIIC.tmp
%Program Files%\TweakBit\PCRepairKit\WizardHelper.dll
%User Temp%\is-HMAM3.tmp\$$$Cookies119761026
%Program Files%\TweakBit\PCRepairKit\Data\cmpdw.dict
%Program Files%\TweakBit\PCRepairKit\is-1HQ19.tmp
%Program Files%\TweakBit\PCRepairKit\Data\hsysfiles.mdict
%Program Files%\TweakBit\PCRepairKit\unins000.msg
%Program Files%\TweakBit\PCRepairKit\is-E0O7V.tmp
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite-wal
%Program Files%\TweakBit\PCRepairKit\vcl160.bpl
%Program Files%\TweakBit\PCRepairKit\GoogleAnalyticsHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-AOG0L.tmp
%Program Files%\TweakBit\PCRepairKit\is-K2R23.tmp
%Desktop%\Resume TweakBit Internet Optimizer Installation.lnk
%Program Files%\TweakBit\PCRepairKit\is-DCI2A.tmp
%All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat
%User Temp%\is-HMAM3.tmp\AxComponentsVCL.bpl
%Program Files%\TweakBit\PCRepairKit\Lang\is-N0RIV.tmp
%Program Files%\TweakBit\PCRepairKit\is-KA7QJ.tmp
%Program Files%\TweakBit\PCRepairKit\is-BCFPD.tmp
%Program Files%\TweakBit\PCRepairKit\is-LU7HK.tmp
%Program Files%\TweakBit\PCRepairKit\is-TOKQO.tmp
%Program Files%\TweakBit\PCRepairKit\CommonForms.Routine.dll
%User Temp%\is-HMAM3.tmp\sqlite3.dll
%Program Files%\TweakBit\PCRepairKit\is-VGJI6.tmp
%AppDataLocal%\GDIPFONTCACHEV1.DAT
%Program Files%\TweakBit\PCRepairKit\is-F8KCN.tmp
%User Temp%\is-HMAM3.tmp\ptb.lng
%Program Files%\TweakBit\PCRepairKit\is-4UI09.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-SG3AJ.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-CKOBQ.tmp
%Program Files%\TweakBit\PCRepairKit\RescueCenterHelper.dll
%Program Files%\TweakBit\PCRepairKit\Localizer.dll
%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.dll
%Program Files%\TweakBit\PCRepairKit\TweakManagerHelper.dll
%User Temp%\2AC02BED-480E-4564-9122-78206DF1326C_internet_optimizer_setup.exe
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite-shm
%Program Files%\TweakBit\PCRepairKit\Data\database.dat
%User Temp%\is-HMAM3.tmp\WizardHelper.dll
%User Temp%\is-HMAM3.tmp\reader.exe
%Program Files%\TweakBit\PCRepairKit\is-PQJAG.tmp
%Program Files%\TweakBit\PCRepairKit\is-545PP.tmp
%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x64.dll
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.lnk
%Program Files%\TweakBit\PCRepairKit\DiskWipeHelper.dll
%Program Files%\TweakBit\PCRepairKit\Lang\is-0Q2UJ.tmp
%Program Files%\TweakBit\PCRepairKit\rdboot64.exe
%Program Files%\TweakBit\PCRepairKit\DebugHelper.dll
%Program Files%\TweakBit\PCRepairKit\sqlite3.dll
%Program Files%\TweakBit\PCRepairKit\is-L9G8N.tmp
%Program Files%\TweakBit\PCRepairKit\Lang\ptb.lng
%Program Files%\TweakBit\PCRepairKit\rtl160.bpl
%All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat
%Program Files%\TweakBit\PCRepairKit\Lang\fra.lng
%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe
%Program Files%\TweakBit\PCRepairKit\PCRepairKit.url
%Program Files%\TweakBit\PCRepairKit\CommonForms.Site.dll
%Program Files%\TweakBit\PCRepairKit\CFAHelper.dll
%Program Files%\TweakBit\PCRepairKit\Data\cmpdw.dict-journal
%Program Files%\TweakBit\PCRepairKit\RescueCenter.exe
%Program Files%\TweakBit\PCRepairKit\unins000.exe
%Program Files%\TweakBit\PCRepairKit\InternetOptimizerHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-OGS8S.tmp
%Program Files%\TweakBit\PCRepairKit\is-83L0D.tmp
%Program Files%\TweakBit\PCRepairKit\Lang\ita.lng
%User Temp%\is-HMAM3.tmp\fra.lng
%User Temp%\is-HMAM3.tmp\downloader.exe
%Program Files%\TweakBit\PCRepairKit\ATPopupsHelper.dll
%Program Files%\TweakBit\PCRepairKit\Data\main.ini
%User Temp%\is-HMAM3.tmp\PCRepairKit.exe
%User Temp%\is-HMAM3.tmp\deu.lng
%Program Files%\TweakBit\PCRepairKit\unins000.dat
%Program Files%\TweakBit\PCRepairKit\is-QDN1M.tmp
%Program Files%\TweakBit\PCRepairKit\Data\compromised_passwords.txt
%Program Files%\TweakBit\PCRepairKit\Data\hbwlists.mdict
%Program Files%\TweakBit\PCRepairKit\is-BBOBE.tmp
%Program Files%\TweakBit\PCRepairKit\is-7B5VM.tmp
%Program Files%\TweakBit\PCRepairKit\is-F0L5F.tmp
%Program Files%\TweakBit\PCRepairKit\is-MC41S.tmp
%Program Files%\TweakBit\PCRepairKit\DiskCleanerHelper.dll
%Program Files%\TweakBit\PCRepairKit\DuplicateFileFinder.exe
%Program Files%\TweakBit\PCRepairKit\ReportHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-H6CQQ.tmp
%User Temp%\is-HMAM3.tmp\rtl160.bpl
%User Temp%\is-HMAM3.tmp\CFAHelper.dll
%Program Files%\TweakBit\PCRepairKit\rdboot32.exe
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite-shm
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite-wal
%Program Files%\TweakBit\PCRepairKit\Lang\is-J7B7S.tmp
%Program Files%\TweakBit\PCRepairKit\is-39G8L.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-VEDAU.tmp
%Program Files%\TweakBit\PCRepairKit\RegistryCleanerHelper.dll
%Program Files%\TweakBit\PCRepairKit\vclimg160.bpl
%User Temp%\is-HMAM3.tmp\Localizer.dll
%Program Files%\TweakBit\PCRepairKit\Data\is-GTQTJ.tmp
%Program Files%\TweakBit\PCRepairKit\MalwareHeuristicHelper.dll
%Program Files%\TweakBit\PCRepairKit\Data\is-157J8.tmp
%Program Files%\TweakBit\PCRepairKit\is-MNSO5.tmp
%Program Files%\TweakBit\PCRepairKit\VolumesHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-JBPU0.tmp
%User Temp%\is-HMAM3.tmp\vclimg160.bpl
%Program Files%\TweakBit\PCRepairKit\is-DFAD9.tmp
%Desktop%\TweakBit PCRepairKit.lnk
%User Temp%\is-HMAM3.tmp\$$$Databases.db119774270
%Program Files%\TweakBit\PCRepairKit\InternetOptimizer.exe
%Program Files%\TweakBit\PCRepairKit\AxComponentsVCL.bpl
%Program Files%\TweakBit\PCRepairKit\CommonForms.dll
%Program Files%\TweakBit\PCRepairKit\Lang\deu.lng
%Program Files%\TweakBit\PCRepairKit\RegistryDefrag.exe
%Program Files%\TweakBit\PCRepairKit\Lang\is-4VBR0.tmp
%Program Files%\TweakBit\PCRepairKit\is-OQ2KM.tmp
%Program Files%\TweakBit\PCRepairKit\Data\hwscheme.mdict
%Program Files%\TweakBit\PCRepairKit\Downloader.exe
%Program Files%\TweakBit\PCRepairKit\Data\security_db.dat
%Program Files%\TweakBit\PCRepairKit\is-3K3TB.tmp
%Program Files%\TweakBit\PCRepairKit\is-6PU1I.tmp
%Program Files%\TweakBit\PCRepairKit\is-QBB9D.tmp
%Program Files%\TweakBit\PCRepairKit\is-TSG89.tmp
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.url
%Program Files%\TweakBit\PCRepairKit\Data\is-9QCDU.tmp
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.lnk
%Program Files%\TweakBit\PCRepairKit\is-0OHG3.tmp
%Program Files%\TweakBit\PCRepairKit\RegistryDefragHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-8KBR3.tmp
%Program Files%\TweakBit\PCRepairKit\is-G5HH0.tmp
%User Temp%\is-HMAM3.tmp\vcl160.bpl
%Program Files%\TweakBit\PCRepairKit\AxBrowsers.dll
%Program Files%\TweakBit\PCRepairKit\is-RUI8K.tmp
%Program Files%\TweakBit\PCRepairKit\is-MC0DD.tmp
%User Temp%\is-HMAM3.tmp\esp.lng
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite
%Program Files%\TweakBit\PCRepairKit\FileShredder.exe
%Program Files%\TweakBit\PCRepairKit\RescueCenterForm.dll
%Program Files%\TweakBit\PCRepairKit\DuplicateFileFinderHelper.dll
%Program Files%\TweakBit\PCRepairKit\MalwareDetectionHelper.dll
%User Temp%\is-HMAM3.tmp\GoogleAnalyticsHelper.dll
%User Temp%\is-HMAM3.tmp\ita.lng
%User Temp%\is-HMAM3.tmp\CommonForms.Site.dll
%Program Files%\TweakBit\PCRepairKit\is-BCTHK.tmp
%User Temp%\is-HMAM3.tmp\main.ini
%Program Files%\TweakBit\PCRepairKit\SpywareCheckerHelper.dll
%User Temp%\is-HMAM3.tmp\$$$Cookies119774208
%Program Files%\TweakBit\PCRepairKit\Lang\is-KT988.tmp
%Program Files%\TweakBit\PCRepairKit\SendDebugLog.exe
%Program Files%\TweakBit\PCRepairKit\is-42EQC.tmp
%Program Files%\TweakBit\PCRepairKit\is-V3NST.tmp
%Program Files%\TweakBit\PCRepairKit\AxComponentsRTL.bpl
%Program Files%\TweakBit\PCRepairKit\is-525OP.tmp

(Nota: %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

. %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming.).

. %Desktop% es la carpeta Escritorio del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}\Escritorio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Escritorio, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Escritorio y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\Desktop).

)

Otros detalles

It connects to the following possibly malicious URL:

http://www.{BLOCKED}-analytics.com/collect
http://downloads.{BLOCKED}it.com/en/internet-optimizer/internet-optimizer-setup.exe
http://dynamicdownloads.{BLOCKED}it.com/prk/def/pc-repair-kit-setup
http://{BLOCKED}it.com

Soluzioni

Motore di scansione minimo: 9.850

Step 1

Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.

Step 2

Identificar y terminar los archivos detectados como PUA.Win32.Auslogics.AH

[ learnMore ]

Para los usuarios de Windows 98 y ME, puede que el Administrador de tareas de Windows no muestre todos los procesos en ejecución. En tal caso, utilice un visor de procesos de una tercera parte (preferiblemente, el Explorador de procesos) para terminar el archivo de malware/grayware/spyware. Puede descargar la herramienta en cuestión aquí.
Si el archivo detectado aparece en el Administrador de tareas o en el Explorador de procesos, pero no puede eliminarlo, reinicie el equipo en modo seguro. Para ello, consulte este enlace para obtener todos los pasos necesarios.
Si el archivo detectado no se muestra en el Administrador de tareas o el Explorador de procesos, prosiga con los pasos que se indican a continuación.

Step 3

Eliminar esta clave del Registro

[ learnMore ]

Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.

In HKEY_LOCAL_MACHINE\Software\Auslogics\Google Analytics Package\1.x
- Settings

In HKEY_CURRENT_USER\Software\Microsoft\RestartManager
- Session0000

In HKEY_LOCAL_MACHINE\Software\TweakBit\PCRepairKit\1.x
- Settings

In HKEY_LOCAL_MACHINE\Software\TweakBit\ATUpdaters\1.x
- Settings

In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface
- {3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}
- ProxyStubClsid32

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}
- TypeLib

In HKEY_CLASSES_ROOT\CLSID
- {93469602-4134-4012-A6BC-FD34B37A0C36}

In HKEY_CLASSES_ROOT\AppID
- {93469602-4134-4012-A6BC-FD34B37A0C36}

In HKEY_CLASSES_ROOT\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}
- InprocServer32

In HKEY_CLASSES_ROOT
- BCAgentCOM32.BCAgent32

In HKEY_CLASSES_ROOT\BCAgentCOM32.BCAgent32
- Clsid

In HKEY_CLASSES_ROOT\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}
- ProgID

In HKEY_CLASSES_ROOT\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}
- Version

In HKEY_CLASSES_ROOT\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}
- TypeLib

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{741C57FF-F26B-E2D6-6A41-2BABBE804D4D}
- Version

Para eliminar la clave del Registro que este malware/grayware/spyware ha creado:

Abra el Editor del Registro. Haga clic en Inicio>Ejecutar, escriba REGEDIT y, a continuación, pulse Intro.
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>Software>Auslogics>Google Analytics Package>1.x
También en el panel izquierdo, busque y elimine la clave:
Settings
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>Microsoft>RestartManager
También en el panel izquierdo, busque y elimine la clave:
Session0000
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>Software>TweakBit>PCRepairKit>1.x
También en el panel izquierdo, busque y elimine la clave:
Settings
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>Software>TweakBit>ATUpdaters>1.x
También en el panel izquierdo, busque y elimine la clave:
Settings
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
También en el panel izquierdo, busque y elimine la clave:
{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface
También en el panel izquierdo, busque y elimine la clave:
{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}
También en el panel izquierdo, busque y elimine la clave:
ProxyStubClsid32
También en el panel izquierdo, busque y elimine la clave:
TypeLib
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CLASSES_ROOT>CLSID
También en el panel izquierdo, busque y elimine la clave:
{93469602-4134-4012-A6BC-FD34B37A0C36}
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CLASSES_ROOT>AppID
También en el panel izquierdo, busque y elimine la clave:
{93469602-4134-4012-A6BC-FD34B37A0C36}
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CLASSES_ROOT>CLSID>{93469602-4134-4012-A6BC-FD34B37A0C36}
También en el panel izquierdo, busque y elimine la clave:
InprocServer32
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CLASSES_ROOT
También en el panel izquierdo, busque y elimine la clave:
BCAgentCOM32.BCAgent32
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CLASSES_ROOT>BCAgentCOM32.BCAgent32
También en el panel izquierdo, busque y elimine la clave:
Clsid
También en el panel izquierdo, busque y elimine la clave:
ProgID
También en el panel izquierdo, busque y elimine la clave:
Version
También en el panel izquierdo, busque y elimine la clave:
TypeLib
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{741C57FF-F26B-E2D6-6A41-2BABBE804D4D}
También en el panel izquierdo, busque y elimine la clave:
Version
Cierre el Editor del Registro.

Step 4

Eliminar este valor del Registro

[ learnMore ]

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Auslogics\Google Analytics Package\1.x\Settings
- ClientID = "{28998FD4-7347-4F9B-B598-028BF51DCBD1}"

In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- Owner = "x\x0b\x00\x00\xd9\xb2\xc4\xc8KR\xd5\x01"

In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- SessionHash = "{random characters}"

In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- Sequence = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- General.Language = "ENU"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- General.URLSource = "pc-repair-kit"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- General.Cookie = ""

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- General.Cookie = "ui_lite"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- App.Application.PurchaseUrlParam = ""

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- General.DoNotAddUtmToUrls = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit
- ClientID = "{36195DBC-0030-44EB-8AA4-5AF04C38DCF1}"

In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- RegFiles0000 = "\x00\x00\x00\x00:\xe8\xa0\x80\x0b\xe1\x80\x80t\xe2\xba\xae"

In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- RegFilesHash = "{random characters}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings
- Shared.Blocking.PCRepairKit = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- Inno Setup: Setup Version = "5.5.9 (u)"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- Inno Setup: App Path = "%Program Files%\TweakBit\PCRepairKit"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- InstallLocation = "%Program Files%\TweakBit\PCRepairKit"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- Inno Setup: Icon Group = "TweakBit\PCRepairKit"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- Inno Setup: User = "{username}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- Inno Setup: Language = "en"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- DisplayName = "TweakBit PCRepairKit"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- DisplayIcon = "%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- UninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- QuietUninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe /SILENT"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- DisplayVersion = "1.8.4.19"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- Publisher = "Tweakbit Pty Ltd"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- URLInfoAbout = "http://www.{BLOCKED}it.com/support/contact"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- HelpLink = "http://www.{BLOCKED}it.com/en/support.php"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- URLUpdateInfo = "http://www.{BLOCKED}it.com/pc-repair-kit"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- Contact = "info@tweakbit.com"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- NoModify = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- NoRepair = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- InstallDate = "20190814"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- MajorVersion = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- MinorVersion = "8"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- VersionMajor = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- VersionMinor = "8"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- EstimatedSize = "57537"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
- UninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe /compability"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}
- (Default) = "IBCAgent32"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\ProxyStubClsid32
- (Default) = "{00020424-0000-0000-C000-000000000046}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\TypeLib
- (Default) = "{F2C6F7D1-ED32-49E5-9919-C51E9E2FD453}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\TypeLib
- Version = "1.0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}
- AppID = "{93469602-4134-4012-A6BC-FD34B37A0C36}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{93469602-4134-4012-A6BC-FD34B37A0C36}
- DllSurrogate = ""

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}
- (Default) = "TweakBit BCAgent32"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\InprocServer32
- (Default) = "%Program Files%\TweakBit\PCREPA~1\BROWSE~3.DLL"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\InprocServer32
- ThreadingModel = "Free"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BCAgentCOM32.BCAgent32
- (Default) = "TweakBit BCAgent32"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BCAgentCOM32.BCAgent32\Clsid
- (Default) = "{93469602-4134-4012-A6BC-FD34B37A0C36}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\ProgID
- (Default) = "BCAgentCOM32.BCAgent32"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\Version
- (Default) = "1.0"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\TypeLib
- (Default) = "{F2C6F7D1-ED32-49E5-9919-C51E9E2FD453}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{741C57FF-F26B-E2D6-6A41-2BABBE804D4D}\Version
- Assembly = "{random characters}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- General.InstallDateTime = "\xe5\xdc\xc4\xc4lU\xe5@"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- (Default) = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- App.Application.FileName = "%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- Application.SplitTest = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- Application.AutoScan.Enabled = "1"

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- Application.AutoScan.TimeStamp = "\x00p\x08\xa3v\xd2,@"

Para eliminar el valor del Registro que este malware/grayware/spyware ha creado:

Abra el Editor del Registro. Haga clic en Inicio>Ejecutar, escriba REGEDIT y, a continuación, pulse Intro.
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Auslogics>Google Analytics Package>1.x>Settings
En el panel derecho, busque y elimine la entrada:
ClientID = "{28998FD4-7347-4F9B-B598-028BF51DCBD1}"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_CURRENT_USER>Software>Microsoft>RestartManager>Session0000
En el panel derecho, busque y elimine la entrada:
Owner = "x\x0b\x00\x00\xd9\xb2\xc4\xc8KR\xd5\x01"
En el panel derecho, busque y elimine la entrada:
SessionHash = "{random characters}"
En el panel derecho, busque y elimine la entrada:
Sequence = "1"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>TweakBit>PCRepairKit>1.x>Settings
En el panel derecho, busque y elimine la entrada:
General.Language = "ENU"
En el panel derecho, busque y elimine la entrada:
General.URLSource = "pc-repair-kit"
En el panel derecho, busque y elimine la entrada:
General.Cookie = ""
En el panel derecho, busque y elimine la entrada:
General.Cookie = "ui_lite"
En el panel derecho, busque y elimine la entrada:
App.Application.PurchaseUrlParam = ""
En el panel derecho, busque y elimine la entrada:
General.DoNotAddUtmToUrls = "1"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>TweakBit
En el panel derecho, busque y elimine la entrada:
ClientID = "{36195DBC-0030-44EB-8AA4-5AF04C38DCF1}"
En el panel derecho, busque y elimine la entrada:
RegFiles0000 = "\x00\x00\x00\x00:\xe8\xa0\x80\x0b\xe1\x80\x80t\xe2\xba\xae"
En el panel derecho, busque y elimine la entrada:
RegFilesHash = "{random characters}"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>TweakBit>ATUpdaters>1.x>Settings
En el panel derecho, busque y elimine la entrada:
Shared.Blocking.PCRepairKit = "1"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Microsoft>Windows>CurrentVersion>Uninstall>{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1
En el panel derecho, busque y elimine la entrada:
Inno Setup: Setup Version = "5.5.9 (u)"
En el panel derecho, busque y elimine la entrada:
Inno Setup: App Path = "%Program Files%\TweakBit\PCRepairKit"
En el panel derecho, busque y elimine la entrada:
InstallLocation = "%Program Files%\TweakBit\PCRepairKit"
En el panel derecho, busque y elimine la entrada:
Inno Setup: Icon Group = "TweakBit\PCRepairKit"
En el panel derecho, busque y elimine la entrada:
Inno Setup: User = "{username}"
En el panel derecho, busque y elimine la entrada:
Inno Setup: Language = "en"
En el panel derecho, busque y elimine la entrada:
DisplayName = "TweakBit PCRepairKit"
En el panel derecho, busque y elimine la entrada:
DisplayIcon = "%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe"
En el panel derecho, busque y elimine la entrada:
UninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe"
En el panel derecho, busque y elimine la entrada:
QuietUninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe /SILENT"
En el panel derecho, busque y elimine la entrada:
DisplayVersion = "1.8.4.19"
En el panel derecho, busque y elimine la entrada:
Publisher = "Tweakbit Pty Ltd"
En el panel derecho, busque y elimine la entrada:
URLInfoAbout = "http://www.{BLOCKED}it.com/support/contact"
En el panel derecho, busque y elimine la entrada:
HelpLink = "http://www.{BLOCKED}it.com/en/support.php"
En el panel derecho, busque y elimine la entrada:
URLUpdateInfo = "http://www.{BLOCKED}it.com/pc-repair-kit"
En el panel derecho, busque y elimine la entrada:
Contact = "info@tweakbit.com"
En el panel derecho, busque y elimine la entrada:
NoModify = "1"
En el panel derecho, busque y elimine la entrada:
NoRepair = "1"
En el panel derecho, busque y elimine la entrada:
InstallDate = "20190814"
En el panel derecho, busque y elimine la entrada:
MajorVersion = "1"
En el panel derecho, busque y elimine la entrada:
MinorVersion = "8"
En el panel derecho, busque y elimine la entrada:
VersionMajor = "1"
En el panel derecho, busque y elimine la entrada:
VersionMinor = "8"
En el panel derecho, busque y elimine la entrada:
EstimatedSize = "57537"
En el panel derecho, busque y elimine la entrada:
UninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe /compability"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}
En el panel derecho, busque y elimine la entrada:
(Default) = "IBCAgent32"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}>ProxyStubClsid32
En el panel derecho, busque y elimine la entrada:
(Default) = "{00020424-0000-0000-C000-000000000046}"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}>TypeLib
En el panel derecho, busque y elimine la entrada:
(Default) = "{F2C6F7D1-ED32-49E5-9919-C51E9E2FD453}"
En el panel derecho, busque y elimine la entrada:
Version = "1.0"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93469602-4134-4012-A6BC-FD34B37A0C36}
En el panel derecho, busque y elimine la entrada:
AppID = "{93469602-4134-4012-A6BC-FD34B37A0C36}"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{93469602-4134-4012-A6BC-FD34B37A0C36}
En el panel derecho, busque y elimine la entrada:
DllSurrogate = ""
En el panel derecho, busque y elimine la entrada:
(Default) = "TweakBit BCAgent32"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93469602-4134-4012-A6BC-FD34B37A0C36}>InprocServer32
En el panel derecho, busque y elimine la entrada:
(Default) = "%Program Files%\TweakBit\PCREPA~1\BROWSE~3.DLL"
En el panel derecho, busque y elimine la entrada:
ThreadingModel = "Free"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BCAgentCOM32.BCAgent32
En el panel derecho, busque y elimine la entrada:
(Default) = "TweakBit BCAgent32"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BCAgentCOM32.BCAgent32>Clsid
En el panel derecho, busque y elimine la entrada:
(Default) = "{93469602-4134-4012-A6BC-FD34B37A0C36}"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93469602-4134-4012-A6BC-FD34B37A0C36}>ProgID
En el panel derecho, busque y elimine la entrada:
(Default) = "BCAgentCOM32.BCAgent32"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93469602-4134-4012-A6BC-FD34B37A0C36}>Version
En el panel derecho, busque y elimine la entrada:
(Default) = "1.0"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93469602-4134-4012-A6BC-FD34B37A0C36}>TypeLib
En el panel derecho, busque y elimine la entrada:
(Default) = "{F2C6F7D1-ED32-49E5-9919-C51E9E2FD453}"
En el panel izquierdo, haga doble clic en el siguiente elemento:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{741C57FF-F26B-E2D6-6A41-2BABBE804D4D}>Version
En el panel derecho, busque y elimine la entrada:
Assembly = "{random characters}"
En el panel derecho, busque y elimine la entrada:
General.InstallDateTime = "\xe5\xdc\xc4\xc4lU\xe5@"
En el panel derecho, busque y elimine la entrada:
(Default) = "1"
En el panel derecho, busque y elimine la entrada:
App.Application.FileName = "%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe"
En el panel derecho, busque y elimine la entrada:
Application.SplitTest = "1"
En el panel derecho, busque y elimine la entrada:
Application.AutoScan.Enabled = "1"
En el panel derecho, busque y elimine la entrada:
Application.AutoScan.TimeStamp = "\x00p\x08\xa3v\xd2,@"
Cierre el Editor del Registro.

Step 5

Restaurar este valor del Registro modificado

[ learnMore ]

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS
- From: Start = "3"
  To: Start = ""3""

Step 6

Buscar y eliminar estos archivos

[ learnMore ]

Puede que algunos de los archivos del componente estén ocultos. Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción "Más opciones avanzadas" para que el resultado de la búsqueda incluya todos los archivos y carpetas ocultos.

%Program Files%\TweakBit\PCRepairKit\Data\is-E9QP4.tmp
%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x32.dll
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite
%Program Files%\TweakBit\PCRepairKit\Lang\enu.lng
%Program Files%\TweakBit\PCRepairKit\is-PE5UR.tmp
%Program Files%\TweakBit\PCRepairKit\ATUpdatersHelper.dll
%Program Files%\TweakBit\PCRepairKit\TweakManager.exe
%Program Files%\TweakBit\PCRepairKit\Lang\esp.lng
%User Temp%\is-HMAM3.tmp\AxComponentsRTL.bpl
%Program Files%\TweakBit\PCRepairKit\SystemInformationHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-DSCPP.tmp
%Program Files%\TweakBit\PCRepairKit\is-EF98D.tmp
%Program Files%\TweakBit\PCRepairKit\Lang\is-PME8V.tmp
%Program Files%\TweakBit\PCRepairKit\is-7PMGM.tmp
%Program Files%\TweakBit\PCRepairKit\is-Q8V9I.tmp
%User Temp%\is-HMAM3.tmp\$Databases.db119761213
%Program Files%\TweakBit\PCRepairKit\Data\hmthinfo.mdict
%Program Files%\TweakBit\PCRepairKit\TaskSchedulerHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-I43K4.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-0CIIC.tmp
%Program Files%\TweakBit\PCRepairKit\WizardHelper.dll
%User Temp%\is-HMAM3.tmp\$Cookies119761026
%Program Files%\TweakBit\PCRepairKit\Data\cmpdw.dict
%Program Files%\TweakBit\PCRepairKit\is-1HQ19.tmp
%Program Files%\TweakBit\PCRepairKit\Data\hsysfiles.mdict
%Program Files%\TweakBit\PCRepairKit\unins000.msg
%Program Files%\TweakBit\PCRepairKit\is-E0O7V.tmp
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite-wal
%Program Files%\TweakBit\PCRepairKit\vcl160.bpl
%Program Files%\TweakBit\PCRepairKit\GoogleAnalyticsHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-AOG0L.tmp
%Program Files%\TweakBit\PCRepairKit\is-K2R23.tmp
%Desktop%\Resume TweakBit Internet Optimizer Installation.lnk
%Program Files%\TweakBit\PCRepairKit\is-DCI2A.tmp
%All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat
%User Temp%\is-HMAM3.tmp\AxComponentsVCL.bpl
%Program Files%\TweakBit\PCRepairKit\Lang\is-N0RIV.tmp
%Program Files%\TweakBit\PCRepairKit\is-KA7QJ.tmp
%Program Files%\TweakBit\PCRepairKit\is-BCFPD.tmp
%Program Files%\TweakBit\PCRepairKit\is-LU7HK.tmp
%Program Files%\TweakBit\PCRepairKit\is-TOKQO.tmp
%Program Files%\TweakBit\PCRepairKit\CommonForms.Routine.dll
%User Temp%\is-HMAM3.tmp\sqlite3.dll
%Program Files%\TweakBit\PCRepairKit\is-VGJI6.tmp
%AppDataLocal%\GDIPFONTCACHEV1.DAT
%Program Files%\TweakBit\PCRepairKit\is-F8KCN.tmp
%User Temp%\is-HMAM3.tmp\ptb.lng
%Program Files%\TweakBit\PCRepairKit\is-4UI09.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-SG3AJ.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-CKOBQ.tmp
%Program Files%\TweakBit\PCRepairKit\RescueCenterHelper.dll
%Program Files%\TweakBit\PCRepairKit\Localizer.dll
%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.dll
%Program Files%\TweakBit\PCRepairKit\TweakManagerHelper.dll
%User Temp%\2AC02BED-480E-4564-9122-78206DF1326C_internet_optimizer_setup.exe
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite-shm
%Program Files%\TweakBit\PCRepairKit\Data\database.dat
%User Temp%\is-HMAM3.tmp\WizardHelper.dll
%User Temp%\is-HMAM3.tmp\reader.exe
%Program Files%\TweakBit\PCRepairKit\is-PQJAG.tmp
%Program Files%\TweakBit\PCRepairKit\is-545PP.tmp
%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x64.dll
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.lnk
%Program Files%\TweakBit\PCRepairKit\DiskWipeHelper.dll
%Program Files%\TweakBit\PCRepairKit\Lang\is-0Q2UJ.tmp
%Program Files%\TweakBit\PCRepairKit\rdboot64.exe
%Program Files%\TweakBit\PCRepairKit\DebugHelper.dll
%Program Files%\TweakBit\PCRepairKit\sqlite3.dll
%Program Files%\TweakBit\PCRepairKit\is-L9G8N.tmp
%Program Files%\TweakBit\PCRepairKit\Lang\ptb.lng
%Program Files%\TweakBit\PCRepairKit\rtl160.bpl
%All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat
%Program Files%\TweakBit\PCRepairKit\Lang\fra.lng
%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe
%Program Files%\TweakBit\PCRepairKit\PCRepairKit.url
%Program Files%\TweakBit\PCRepairKit\CommonForms.Site.dll
%Program Files%\TweakBit\PCRepairKit\CFAHelper.dll
%Program Files%\TweakBit\PCRepairKit\Data\cmpdw.dict-journal
%Program Files%\TweakBit\PCRepairKit\RescueCenter.exe
%Program Files%\TweakBit\PCRepairKit\unins000.exe
%Program Files%\TweakBit\PCRepairKit\InternetOptimizerHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-OGS8S.tmp
%Program Files%\TweakBit\PCRepairKit\is-83L0D.tmp
%Program Files%\TweakBit\PCRepairKit\Lang\ita.lng
%User Temp%\is-HMAM3.tmp\fra.lng
%User Temp%\is-HMAM3.tmp\downloader.exe
%Program Files%\TweakBit\PCRepairKit\ATPopupsHelper.dll
%Program Files%\TweakBit\PCRepairKit\Data\main.ini
%User Temp%\is-HMAM3.tmp\PCRepairKit.exe
%User Temp%\is-HMAM3.tmp\deu.lng
%Program Files%\TweakBit\PCRepairKit\unins000.dat
%Program Files%\TweakBit\PCRepairKit\is-QDN1M.tmp
%Program Files%\TweakBit\PCRepairKit\Data\compromised_passwords.txt
%Program Files%\TweakBit\PCRepairKit\Data\hbwlists.mdict
%Program Files%\TweakBit\PCRepairKit\is-BBOBE.tmp
%Program Files%\TweakBit\PCRepairKit\is-7B5VM.tmp
%Program Files%\TweakBit\PCRepairKit\is-F0L5F.tmp
%Program Files%\TweakBit\PCRepairKit\is-MC41S.tmp
%Program Files%\TweakBit\PCRepairKit\DiskCleanerHelper.dll
%Program Files%\TweakBit\PCRepairKit\DuplicateFileFinder.exe
%Program Files%\TweakBit\PCRepairKit\ReportHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-H6CQQ.tmp
%User Temp%\is-HMAM3.tmp\rtl160.bpl
%User Temp%\is-HMAM3.tmp\CFAHelper.dll
%Program Files%\TweakBit\PCRepairKit\rdboot32.exe
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite-shm
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite-wal
%Program Files%\TweakBit\PCRepairKit\Lang\is-J7B7S.tmp
%Program Files%\TweakBit\PCRepairKit\is-39G8L.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-VEDAU.tmp
%Program Files%\TweakBit\PCRepairKit\RegistryCleanerHelper.dll
%Program Files%\TweakBit\PCRepairKit\vclimg160.bpl
%User Temp%\is-HMAM3.tmp\Localizer.dll
%Program Files%\TweakBit\PCRepairKit\Data\is-GTQTJ.tmp
%Program Files%\TweakBit\PCRepairKit\MalwareHeuristicHelper.dll
%Program Files%\TweakBit\PCRepairKit\Data\is-157J8.tmp
%Program Files%\TweakBit\PCRepairKit\is-MNSO5.tmp
%Program Files%\TweakBit\PCRepairKit\VolumesHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-JBPU0.tmp
%User Temp%\is-HMAM3.tmp\vclimg160.bpl
%Program Files%\TweakBit\PCRepairKit\is-DFAD9.tmp
%Desktop%\TweakBit PCRepairKit.lnk
%User Temp%\is-HMAM3.tmp\$Databases.db119774270
%Program Files%\TweakBit\PCRepairKit\InternetOptimizer.exe
%Program Files%\TweakBit\PCRepairKit\AxComponentsVCL.bpl
%Program Files%\TweakBit\PCRepairKit\CommonForms.dll
%Program Files%\TweakBit\PCRepairKit\Lang\deu.lng
%Program Files%\TweakBit\PCRepairKit\RegistryDefrag.exe
%Program Files%\TweakBit\PCRepairKit\Lang\is-4VBR0.tmp
%Program Files%\TweakBit\PCRepairKit\is-OQ2KM.tmp
%Program Files%\TweakBit\PCRepairKit\Data\hwscheme.mdict
%Program Files%\TweakBit\PCRepairKit\Downloader.exe
%Program Files%\TweakBit\PCRepairKit\Data\security_db.dat
%Program Files%\TweakBit\PCRepairKit\is-3K3TB.tmp
%Program Files%\TweakBit\PCRepairKit\is-6PU1I.tmp
%Program Files%\TweakBit\PCRepairKit\is-QBB9D.tmp
%Program Files%\TweakBit\PCRepairKit\is-TSG89.tmp
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.url
%Program Files%\TweakBit\PCRepairKit\Data\is-9QCDU.tmp
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.lnk
%Program Files%\TweakBit\PCRepairKit\is-0OHG3.tmp
%Program Files%\TweakBit\PCRepairKit\RegistryDefragHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-8KBR3.tmp
%Program Files%\TweakBit\PCRepairKit\is-G5HH0.tmp
%User Temp%\is-HMAM3.tmp\vcl160.bpl
%Program Files%\TweakBit\PCRepairKit\AxBrowsers.dll
%Program Files%\TweakBit\PCRepairKit\is-RUI8K.tmp
%Program Files%\TweakBit\PCRepairKit\is-MC0DD.tmp
%User Temp%\is-HMAM3.tmp\esp.lng
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite
%Program Files%\TweakBit\PCRepairKit\FileShredder.exe
%Program Files%\TweakBit\PCRepairKit\RescueCenterForm.dll
%Program Files%\TweakBit\PCRepairKit\DuplicateFileFinderHelper.dll
%Program Files%\TweakBit\PCRepairKit\MalwareDetectionHelper.dll
%User Temp%\is-HMAM3.tmp\GoogleAnalyticsHelper.dll
%User Temp%\is-HMAM3.tmp\ita.lng
%User Temp%\is-HMAM3.tmp\CommonForms.Site.dll
%Program Files%\TweakBit\PCRepairKit\is-BCTHK.tmp
%User Temp%\is-HMAM3.tmp\main.ini
%Program Files%\TweakBit\PCRepairKit\SpywareCheckerHelper.dll
%User Temp%\is-HMAM3.tmp\$Cookies119774208
%Program Files%\TweakBit\PCRepairKit\Lang\is-KT988.tmp
%Program Files%\TweakBit\PCRepairKit\SendDebugLog.exe
%Program Files%\TweakBit\PCRepairKit\is-42EQC.tmp
%Program Files%\TweakBit\PCRepairKit\is-V3NST.tmp
%Program Files%\TweakBit\PCRepairKit\AxComponentsRTL.bpl
%Program Files%\TweakBit\PCRepairKit\is-525OP.tmp

$Databases.db119761213
%Program Files%\TweakBit\PCRepairKit\Data\hmthinfo.mdict
%Program Files%\TweakBit\PCRepairKit\TaskSchedulerHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-I43K4.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-0CIIC.tmp
%Program Files%\TweakBit\PCRepairKit\WizardHelper.dll
%User Temp%\is-HMAM3.tmp\$Cookies119761026
%Program Files%\TweakBit\PCRepairKit\Data\cmpdw.dict
%Program Files%\TweakBit\PCRepairKit\is-1HQ19.tmp
%Program Files%\TweakBit\PCRepairKit\Data\hsysfiles.mdict
%Program Files%\TweakBit\PCRepairKit\unins000.msg
%Program Files%\TweakBit\PCRepairKit\is-E0O7V.tmp
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite-wal
%Program Files%\TweakBit\PCRepairKit\vcl160.bpl
%Program Files%\TweakBit\PCRepairKit\GoogleAnalyticsHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-AOG0L.tmp
%Program Files%\TweakBit\PCRepairKit\is-K2R23.tmp
%Desktop%\Resume TweakBit Internet Optimizer Installation.lnk
%Program Files%\TweakBit\PCRepairKit\is-DCI2A.tmp
%All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat
%User Temp%\is-HMAM3.tmp\AxComponentsVCL.bpl
%Program Files%\TweakBit\PCRepairKit\Lang\is-N0RIV.tmp
%Program Files%\TweakBit\PCRepairKit\is-KA7QJ.tmp
%Program Files%\TweakBit\PCRepairKit\is-BCFPD.tmp
%Program Files%\TweakBit\PCRepairKit\is-LU7HK.tmp
%Program Files%\TweakBit\PCRepairKit\is-TOKQO.tmp
%Program Files%\TweakBit\PCRepairKit\CommonForms.Routine.dll
%User Temp%\is-HMAM3.tmp\sqlite3.dll
%Program Files%\TweakBit\PCRepairKit\is-VGJI6.tmp
%AppDataLocal%\GDIPFONTCACHEV1.DAT
%Program Files%\TweakBit\PCRepairKit\is-F8KCN.tmp
%User Temp%\is-HMAM3.tmp\ptb.lng
%Program Files%\TweakBit\PCRepairKit\is-4UI09.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-SG3AJ.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-CKOBQ.tmp
%Program Files%\TweakBit\PCRepairKit\RescueCenterHelper.dll
%Program Files%\TweakBit\PCRepairKit\Localizer.dll
%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.dll
%Program Files%\TweakBit\PCRepairKit\TweakManagerHelper.dll
%User Temp%\2AC02BED-480E-4564-9122-78206DF1326C_internet_optimizer_setup.exe
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite-shm
%Program Files%\TweakBit\PCRepairKit\Data\database.dat
%User Temp%\is-HMAM3.tmp\WizardHelper.dll
%User Temp%\is-HMAM3.tmp\reader.exe
%Program Files%\TweakBit\PCRepairKit\is-PQJAG.tmp
%Program Files%\TweakBit\PCRepairKit\is-545PP.tmp
%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x64.dll
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.lnk
%Program Files%\TweakBit\PCRepairKit\DiskWipeHelper.dll
%Program Files%\TweakBit\PCRepairKit\Lang\is-0Q2UJ.tmp
%Program Files%\TweakBit\PCRepairKit\rdboot64.exe
%Program Files%\TweakBit\PCRepairKit\DebugHelper.dll
%Program Files%\TweakBit\PCRepairKit\sqlite3.dll
%Program Files%\TweakBit\PCRepairKit\is-L9G8N.tmp
%Program Files%\TweakBit\PCRepairKit\Lang\ptb.lng
%Program Files%\TweakBit\PCRepairKit\rtl160.bpl
%All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat
%Program Files%\TweakBit\PCRepairKit\Lang\fra.lng
%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe
%Program Files%\TweakBit\PCRepairKit\PCRepairKit.url
%Program Files%\TweakBit\PCRepairKit\CommonForms.Site.dll
%Program Files%\TweakBit\PCRepairKit\CFAHelper.dll
%Program Files%\TweakBit\PCRepairKit\Data\cmpdw.dict-journal
%Program Files%\TweakBit\PCRepairKit\RescueCenter.exe
%Program Files%\TweakBit\PCRepairKit\unins000.exe
%Program Files%\TweakBit\PCRepairKit\InternetOptimizerHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-OGS8S.tmp
%Program Files%\TweakBit\PCRepairKit\is-83L0D.tmp
%Program Files%\TweakBit\PCRepairKit\Lang\ita.lng
%User Temp%\is-HMAM3.tmp\fra.lng
%User Temp%\is-HMAM3.tmp\downloader.exe
%Program Files%\TweakBit\PCRepairKit\ATPopupsHelper.dll
%Program Files%\TweakBit\PCRepairKit\Data\main.ini
%User Temp%\is-HMAM3.tmp\PCRepairKit.exe
%User Temp%\is-HMAM3.tmp\deu.lng
%Program Files%\TweakBit\PCRepairKit\unins000.dat
%Program Files%\TweakBit\PCRepairKit\is-QDN1M.tmp
%Program Files%\TweakBit\PCRepairKit\Data\compromised_passwords.txt
%Program Files%\TweakBit\PCRepairKit\Data\hbwlists.mdict
%Program Files%\TweakBit\PCRepairKit\is-BBOBE.tmp
%Program Files%\TweakBit\PCRepairKit\is-7B5VM.tmp
%Program Files%\TweakBit\PCRepairKit\is-F0L5F.tmp
%Program Files%\TweakBit\PCRepairKit\is-MC41S.tmp
%Program Files%\TweakBit\PCRepairKit\DiskCleanerHelper.dll
%Program Files%\TweakBit\PCRepairKit\DuplicateFileFinder.exe
%Program Files%\TweakBit\PCRepairKit\ReportHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-H6CQQ.tmp
%User Temp%\is-HMAM3.tmp\rtl160.bpl
%User Temp%\is-HMAM3.tmp\CFAHelper.dll
%Program Files%\TweakBit\PCRepairKit\rdboot32.exe
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite-shm
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite-wal
%Program Files%\TweakBit\PCRepairKit\Lang\is-J7B7S.tmp
%Program Files%\TweakBit\PCRepairKit\is-39G8L.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-VEDAU.tmp
%Program Files%\TweakBit\PCRepairKit\RegistryCleanerHelper.dll
%Program Files%\TweakBit\PCRepairKit\vclimg160.bpl
%User Temp%\is-HMAM3.tmp\Localizer.dll
%Program Files%\TweakBit\PCRepairKit\Data\is-GTQTJ.tmp
%Program Files%\TweakBit\PCRepairKit\MalwareHeuristicHelper.dll
%Program Files%\TweakBit\PCRepairKit\Data\is-157J8.tmp
%Program Files%\TweakBit\PCRepairKit\is-MNSO5.tmp
%Program Files%\TweakBit\PCRepairKit\VolumesHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-JBPU0.tmp
%User Temp%\is-HMAM3.tmp\vclimg160.bpl
%Program Files%\TweakBit\PCRepairKit\is-DFAD9.tmp
%Desktop%\TweakBit PCRepairKit.lnk
%User Temp%\is-HMAM3.tmp\$Databases.db119774270
%Program Files%\TweakBit\PCRepairKit\InternetOptimizer.exe
%Program Files%\TweakBit\PCRepairKit\AxComponentsVCL.bpl
%Program Files%\TweakBit\PCRepairKit\CommonForms.dll
%Program Files%\TweakBit\PCRepairKit\Lang\deu.lng
%Program Files%\TweakBit\PCRepairKit\RegistryDefrag.exe
%Program Files%\TweakBit\PCRepairKit\Lang\is-4VBR0.tmp
%Program Files%\TweakBit\PCRepairKit\is-OQ2KM.tmp
%Program Files%\TweakBit\PCRepairKit\Data\hwscheme.mdict
%Program Files%\TweakBit\PCRepairKit\Downloader.exe
%Program Files%\TweakBit\PCRepairKit\Data\security_db.dat
%Program Files%\TweakBit\PCRepairKit\is-3K3TB.tmp
%Program Files%\TweakBit\PCRepairKit\is-6PU1I.tmp
%Program Files%\TweakBit\PCRepairKit\is-QBB9D.tmp
%Program Files%\TweakBit\PCRepairKit\is-TSG89.tmp
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.url
%Program Files%\TweakBit\PCRepairKit\Data\is-9QCDU.tmp
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.lnk
%Program Files%\TweakBit\PCRepairKit\is-0OHG3.tmp
%Program Files%\TweakBit\PCRepairKit\RegistryDefragHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-8KBR3.tmp
%Program Files%\TweakBit\PCRepairKit\is-G5HH0.tmp
%User Temp%\is-HMAM3.tmp\vcl160.bpl
%Program Files%\TweakBit\PCRepairKit\AxBrowsers.dll
%Program Files%\TweakBit\PCRepairKit\is-RUI8K.tmp
%Program Files%\TweakBit\PCRepairKit\is-MC0DD.tmp
%User Temp%\is-HMAM3.tmp\esp.lng
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite
%Program Files%\TweakBit\PCRepairKit\FileShredder.exe
%Program Files%\TweakBit\PCRepairKit\RescueCenterForm.dll
%Program Files%\TweakBit\PCRepairKit\DuplicateFileFinderHelper.dll
%Program Files%\TweakBit\PCRepairKit\MalwareDetectionHelper.dll
%User Temp%\is-HMAM3.tmp\GoogleAnalyticsHelper.dll
%User Temp%\is-HMAM3.tmp\ita.lng
%User Temp%\is-HMAM3.tmp\CommonForms.Site.dll
%Program Files%\TweakBit\PCRepairKit\is-BCTHK.tmp
%User Temp%\is-HMAM3.tmp\main.ini
%Program Files%\TweakBit\PCRepairKit\SpywareCheckerHelper.dll
%User Temp%\is-HMAM3.tmp\$Cookies119774208
%Program Files%\TweakBit\PCRepairKit\Lang\is-KT988.tmp
%Program Files%\TweakBit\PCRepairKit\SendDebugLog.exe
%Program Files%\TweakBit\PCRepairKit\is-42EQC.tmp
%Program Files%\TweakBit\PCRepairKit\is-V3NST.tmp
%Program Files%\TweakBit\PCRepairKit\AxComponentsRTL.bpl
%Program Files%\TweakBit\PCRepairKit\is-525OP.tmp

En la lista desplegable Buscar en, seleccione Mi PC y pulse Intro.

Una vez haya encontrado el archivo, selecciónelo y, a continuación, pulse MAYÚS+SUPR para eliminarlo definitivamente.

Repita los pasos 2 a 4 con el resto de archivos: %Program Files%\TweakBit\PCRepairKit\Data\is-E9QP4.tmp
%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x32.dll
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite
%Program Files%\TweakBit\PCRepairKit\Lang\enu.lng
%Program Files%\TweakBit\PCRepairKit\is-PE5UR.tmp
%Program Files%\TweakBit\PCRepairKit\ATUpdatersHelper.dll
%Program Files%\TweakBit\PCRepairKit\TweakManager.exe
%Program Files%\TweakBit\PCRepairKit\Lang\esp.lng
%User Temp%\is-HMAM3.tmp\AxComponentsRTL.bpl
%Program Files%\TweakBit\PCRepairKit\SystemInformationHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-DSCPP.tmp
%Program Files%\TweakBit\PCRepairKit\is-EF98D.tmp
%Program Files%\TweakBit\PCRepairKit\Lang\is-PME8V.tmp
%Program Files%\TweakBit\PCRepairKit\is-7PMGM.tmp
%Program Files%\TweakBit\PCRepairKit\is-Q8V9I.tmp
%User Temp%\is-HMAM3.tmp\$Databases.db119761213
%Program Files%\TweakBit\PCRepairKit\Data\hmthinfo.mdict
%Program Files%\TweakBit\PCRepairKit\TaskSchedulerHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-I43K4.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-0CIIC.tmp
%Program Files%\TweakBit\PCRepairKit\WizardHelper.dll
%User Temp%\is-HMAM3.tmp\$Cookies119761026
%Program Files%\TweakBit\PCRepairKit\Data\cmpdw.dict
%Program Files%\TweakBit\PCRepairKit\is-1HQ19.tmp
%Program Files%\TweakBit\PCRepairKit\Data\hsysfiles.mdict
%Program Files%\TweakBit\PCRepairKit\unins000.msg
%Program Files%\TweakBit\PCRepairKit\is-E0O7V.tmp
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite-wal
%Program Files%\TweakBit\PCRepairKit\vcl160.bpl
%Program Files%\TweakBit\PCRepairKit\GoogleAnalyticsHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-AOG0L.tmp
%Program Files%\TweakBit\PCRepairKit\is-K2R23.tmp
%Desktop%\Resume TweakBit Internet Optimizer Installation.lnk
%Program Files%\TweakBit\PCRepairKit\is-DCI2A.tmp
%All Users Profile%\Microsoft\Network\Downloader\qmgr0.dat
%User Temp%\is-HMAM3.tmp\AxComponentsVCL.bpl
%Program Files%\TweakBit\PCRepairKit\Lang\is-N0RIV.tmp
%Program Files%\TweakBit\PCRepairKit\is-KA7QJ.tmp
%Program Files%\TweakBit\PCRepairKit\is-BCFPD.tmp
%Program Files%\TweakBit\PCRepairKit\is-LU7HK.tmp
%Program Files%\TweakBit\PCRepairKit\is-TOKQO.tmp
%Program Files%\TweakBit\PCRepairKit\CommonForms.Routine.dll
%User Temp%\is-HMAM3.tmp\sqlite3.dll
%Program Files%\TweakBit\PCRepairKit\is-VGJI6.tmp
%AppDataLocal%\GDIPFONTCACHEV1.DAT
%Program Files%\TweakBit\PCRepairKit\is-F8KCN.tmp
%User Temp%\is-HMAM3.tmp\ptb.lng
%Program Files%\TweakBit\PCRepairKit\is-4UI09.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-SG3AJ.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-CKOBQ.tmp
%Program Files%\TweakBit\PCRepairKit\RescueCenterHelper.dll
%Program Files%\TweakBit\PCRepairKit\Localizer.dll
%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.dll
%Program Files%\TweakBit\PCRepairKit\TweakManagerHelper.dll
%User Temp%\2AC02BED-480E-4564-9122-78206DF1326C_internet_optimizer_setup.exe
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite-shm
%Program Files%\TweakBit\PCRepairKit\Data\database.dat
%User Temp%\is-HMAM3.tmp\WizardHelper.dll
%User Temp%\is-HMAM3.tmp\reader.exe
%Program Files%\TweakBit\PCRepairKit\is-PQJAG.tmp
%Program Files%\TweakBit\PCRepairKit\is-545PP.tmp
%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x64.dll
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.lnk
%Program Files%\TweakBit\PCRepairKit\DiskWipeHelper.dll
%Program Files%\TweakBit\PCRepairKit\Lang\is-0Q2UJ.tmp
%Program Files%\TweakBit\PCRepairKit\rdboot64.exe
%Program Files%\TweakBit\PCRepairKit\DebugHelper.dll
%Program Files%\TweakBit\PCRepairKit\sqlite3.dll
%Program Files%\TweakBit\PCRepairKit\is-L9G8N.tmp
%Program Files%\TweakBit\PCRepairKit\Lang\ptb.lng
%Program Files%\TweakBit\PCRepairKit\rtl160.bpl
%All Users Profile%\Microsoft\Network\Downloader\qmgr1.dat
%Program Files%\TweakBit\PCRepairKit\Lang\fra.lng
%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe
%Program Files%\TweakBit\PCRepairKit\PCRepairKit.url
%Program Files%\TweakBit\PCRepairKit\CommonForms.Site.dll
%Program Files%\TweakBit\PCRepairKit\CFAHelper.dll
%Program Files%\TweakBit\PCRepairKit\Data\cmpdw.dict-journal
%Program Files%\TweakBit\PCRepairKit\RescueCenter.exe
%Program Files%\TweakBit\PCRepairKit\unins000.exe
%Program Files%\TweakBit\PCRepairKit\InternetOptimizerHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-OGS8S.tmp
%Program Files%\TweakBit\PCRepairKit\is-83L0D.tmp
%Program Files%\TweakBit\PCRepairKit\Lang\ita.lng
%User Temp%\is-HMAM3.tmp\fra.lng
%User Temp%\is-HMAM3.tmp\downloader.exe
%Program Files%\TweakBit\PCRepairKit\ATPopupsHelper.dll
%Program Files%\TweakBit\PCRepairKit\Data\main.ini
%User Temp%\is-HMAM3.tmp\PCRepairKit.exe
%User Temp%\is-HMAM3.tmp\deu.lng
%Program Files%\TweakBit\PCRepairKit\unins000.dat
%Program Files%\TweakBit\PCRepairKit\is-QDN1M.tmp
%Program Files%\TweakBit\PCRepairKit\Data\compromised_passwords.txt
%Program Files%\TweakBit\PCRepairKit\Data\hbwlists.mdict
%Program Files%\TweakBit\PCRepairKit\is-BBOBE.tmp
%Program Files%\TweakBit\PCRepairKit\is-7B5VM.tmp
%Program Files%\TweakBit\PCRepairKit\is-F0L5F.tmp
%Program Files%\TweakBit\PCRepairKit\is-MC41S.tmp
%Program Files%\TweakBit\PCRepairKit\DiskCleanerHelper.dll
%Program Files%\TweakBit\PCRepairKit\DuplicateFileFinder.exe
%Program Files%\TweakBit\PCRepairKit\ReportHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-H6CQQ.tmp
%User Temp%\is-HMAM3.tmp\rtl160.bpl
%User Temp%\is-HMAM3.tmp\CFAHelper.dll
%Program Files%\TweakBit\PCRepairKit\rdboot32.exe
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite-shm
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite-wal
%Program Files%\TweakBit\PCRepairKit\Lang\is-J7B7S.tmp
%Program Files%\TweakBit\PCRepairKit\is-39G8L.tmp
%Program Files%\TweakBit\PCRepairKit\Data\is-VEDAU.tmp
%Program Files%\TweakBit\PCRepairKit\RegistryCleanerHelper.dll
%Program Files%\TweakBit\PCRepairKit\vclimg160.bpl
%User Temp%\is-HMAM3.tmp\Localizer.dll
%Program Files%\TweakBit\PCRepairKit\Data\is-GTQTJ.tmp
%Program Files%\TweakBit\PCRepairKit\MalwareHeuristicHelper.dll
%Program Files%\TweakBit\PCRepairKit\Data\is-157J8.tmp
%Program Files%\TweakBit\PCRepairKit\is-MNSO5.tmp
%Program Files%\TweakBit\PCRepairKit\VolumesHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-JBPU0.tmp
%User Temp%\is-HMAM3.tmp\vclimg160.bpl
%Program Files%\TweakBit\PCRepairKit\is-DFAD9.tmp
%Desktop%\TweakBit PCRepairKit.lnk
%User Temp%\is-HMAM3.tmp\$Databases.db119774270
%Program Files%\TweakBit\PCRepairKit\InternetOptimizer.exe
%Program Files%\TweakBit\PCRepairKit\AxComponentsVCL.bpl
%Program Files%\TweakBit\PCRepairKit\CommonForms.dll
%Program Files%\TweakBit\PCRepairKit\Lang\deu.lng
%Program Files%\TweakBit\PCRepairKit\RegistryDefrag.exe
%Program Files%\TweakBit\PCRepairKit\Lang\is-4VBR0.tmp
%Program Files%\TweakBit\PCRepairKit\is-OQ2KM.tmp
%Program Files%\TweakBit\PCRepairKit\Data\hwscheme.mdict
%Program Files%\TweakBit\PCRepairKit\Downloader.exe
%Program Files%\TweakBit\PCRepairKit\Data\security_db.dat
%Program Files%\TweakBit\PCRepairKit\is-3K3TB.tmp
%Program Files%\TweakBit\PCRepairKit\is-6PU1I.tmp
%Program Files%\TweakBit\PCRepairKit\is-QBB9D.tmp
%Program Files%\TweakBit\PCRepairKit\is-TSG89.tmp
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.url
%Program Files%\TweakBit\PCRepairKit\Data\is-9QCDU.tmp
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.lnk
%Program Files%\TweakBit\PCRepairKit\is-0OHG3.tmp
%Program Files%\TweakBit\PCRepairKit\RegistryDefragHelper.dll
%Program Files%\TweakBit\PCRepairKit\is-8KBR3.tmp
%Program Files%\TweakBit\PCRepairKit\is-G5HH0.tmp
%User Temp%\is-HMAM3.tmp\vcl160.bpl
%Program Files%\TweakBit\PCRepairKit\AxBrowsers.dll
%Program Files%\TweakBit\PCRepairKit\is-RUI8K.tmp
%Program Files%\TweakBit\PCRepairKit\is-MC0DD.tmp
%User Temp%\is-HMAM3.tmp\esp.lng
%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite
%Program Files%\TweakBit\PCRepairKit\FileShredder.exe
%Program Files%\TweakBit\PCRepairKit\RescueCenterForm.dll
%Program Files%\TweakBit\PCRepairKit\DuplicateFileFinderHelper.dll
%Program Files%\TweakBit\PCRepairKit\MalwareDetectionHelper.dll
%User Temp%\is-HMAM3.tmp\GoogleAnalyticsHelper.dll
%User Temp%\is-HMAM3.tmp\ita.lng
%User Temp%\is-HMAM3.tmp\CommonForms.Site.dll
%Program Files%\TweakBit\PCRepairKit\is-BCTHK.tmp
%User Temp%\is-HMAM3.tmp\main.ini
%Program Files%\TweakBit\PCRepairKit\SpywareCheckerHelper.dll
%User Temp%\is-HMAM3.tmp\$Cookies119774208
%Program Files%\TweakBit\PCRepairKit\Lang\is-KT988.tmp
%Program Files%\TweakBit\PCRepairKit\SendDebugLog.exe
%Program Files%\TweakBit\PCRepairKit\is-42EQC.tmp
%Program Files%\TweakBit\PCRepairKit\is-V3NST.tmp
%Program Files%\TweakBit\PCRepairKit\AxComponentsRTL.bpl
%Program Files%\TweakBit\PCRepairKit\is-525OP.tmp

Step 7

Buscar y eliminar estas carpetas

[ learnMore ]

Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción Más opciones avanzadas para que el resultado de la búsqueda incluya todas las carpetas ocultas.

%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit
%User Temp%\PCRepairKit.madExcept
%All Users Profile%\TweakBit\PCRepairKit
%All Users Profile%\TweakBit\PCRepairKit\1.x
%User Temp%\is-HMAM3.tmp\_isetup
%Program Files%\TweakBit
%Program Files%\TweakBit\PCRepairKit\Data
%Program Files%\TweakBit\PCRepairKit\Lang
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit
%All Users Profile%\TweakBit
%Program Files%\TweakBit\PCRepairKit
%All Users Profile%\TweakBit\PCRepairKit\1.x\Data

Step 8

Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como PUA.Win32.Auslogics.AH En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.

Step 9

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.pif
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.pif
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.lnk
%Desktop%\TweakBit PCRepairKit.pif
%Program Files%\TweakBit\PCRepairKit\is-5QCKG.tmp
%User Temp%\PCRepairKit.madExcept
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.url
%Desktop%\TweakBit PCRepairKit.url
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.pif
%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.url

Step 10

Restore these deleted registry keys/values from backup

*Note: Only Microsoft-related keys/values will be restored. If the malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.

In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings
- General.DefWebBrowser

Sondaggio

PUA.Win32.Auslogics.AH

Panoramica e descrizione

Dettagli tecnici

Soluzioni

Risorse

Assistenza

Informazioni su Trend

PUA.Win32.Auslogics.AH

Panoramica e descrizione

Dettagli tecnici

Soluzioni

Risorse

Assistenza

Informazioni su Trend

America

Medio Oriente e Africa

Europa

Asia e Pacifico