ADW_ADVSYSTEMPROTECTOR
AdvSystemProtector (Symantec)
Windows
Tipo de malware
Adware
Destructivo?
No
Cifrado
In the Wild:
Sí
Resumen y descripción
Detalles técnicos
Instalación
Infiltra los archivos siguientes:
- %User Temp%\is-{random}.tmp\{grayware file name}.tmp
- %User Temp%\is-{random}.tmp\_isetup\_shfoldr.dll
- %User Temp%\is-{random}.tmp\_isetup\_iscrypt.dll
- %User Temp%\is-{random}.tmp\isxdl.dll
- %User Temp%\is-{random}.tmp\sasnative32.exe
- %Program Files%\ASP\AdvancedSystemProtector.exe
- %Program Files%\ASP\AdvancedSystemProtector.exe.config
- %Program Files%\ASP\AppResource.dll
- %Program Files%\ASP\asp.ico
- %Program Files%\ASP\AspManager.exe
- %Program Files%\ASP\aspsys.dll
- %Program Files%\ASP\ASPUninstall.exe
- %Program Files%\ASP\categories.ini
- %Program Files%\ASP\Chinese_asp_ZH-CN.ini
- %Program Files%\ASP\Chinese_uninst.ini
- %Program Files%\ASP\clamunpack\clamscan.exe
- %Program Files%\ASP\clamunpack\libclamav.dll
- %Program Files%\ASP\clamunpack\readme.txt
- %Program Files%\ASP\Communication.dll
- %Program Files%\ASP\danish_asp_DA.ini
- %Program Files%\ASP\Danish_uninst.ini
- %Program Files%\ASP\dutch_asp_NL.ini
- %Program Files%\ASP\Dutch_uninst.ini
- %Program Files%\ASP\eng_asp_en.ini
- %Program Files%\ASP\eng_uninst.ini
- %Program Files%\ASP\filetypehelper.exe
- %Program Files%\ASP\Finnish_asp_FI.ini
- %Program Files%\ASP\Finnish_uninst_fi.ini
- %Program Files%\ASP\french_asp_FR.ini
- %Program Files%\ASP\French_uninst.ini
- %Program Files%\ASP\german_asp_DE.ini
- %Program Files%\ASP\German_uninst.ini
- %Program Files%\ASP\greek_uninst_el.ini
- %Program Files%\ASP\Interop.IWshRuntimeLibrary.dll
- %Program Files%\ASP\italian_asp_IT.ini
- %Program Files%\ASP\Italian_uninst.ini
- %Program Files%\ASP\japanese_asp_JA.ini
- %Program Files%\ASP\Japanese_uninst.ini
- %Program Files%\ASP\korean_uninst_ko.ini
- %Program Files%\ASP\loading_withWhiteBG.avi
- %Program Files%\ASP\Microsoft.Win32.TaskScheduler.DLL
- %Program Files%\ASP\norwegian_asp_NO.ini
- %Program Files%\ASP\Norwegian_uninst.ini
- %Program Files%\ASP\polish_uninst_pl.ini
- %Program Files%\ASP\portugese_uninst_pt.ini
- %Program Files%\ASP\portuguese_asp_PT-BR.ini
- %Program Files%\ASP\Portuguese_uninst.ini
- %Program Files%\ASP\russian_asp_ru.ini
- %Program Files%\ASP\russian_uninst_ru.ini
- %Program Files%\ASP\scandll.dll
- %Program Files%\ASP\spanish_asp_ES.ini
- %Program Files%\ASP\spanish_uninst.ini
- %Program Files%\ASP\swedish_asp_SV.ini
- %Program Files%\ASP\swedish_uninst.ini
- %Program Files%\ASP\System.Core.dll
- %Program Files%\ASP\System.Data.SQLite.dll
- %Program Files%\ASP\TPS.ico
- %Program Files%\ASP\traditionalcn_uninst_zh-tw.ini
- %Program Files%\ASP\Troubleshooter\asp-fixer.com
- %Program Files%\ASP\Troubleshooter\asp-fixer.exe
- %Program Files%\ASP\Troubleshooter\asp-fixer.pif
- %Program Files%\ASP\Troubleshooter\asp-fixer.scr
- %Program Files%\ASP\Troubleshooter\ASP-Troubleshooter.chm
- %Program Files%\ASP\Troubleshooter\firefox.com
- %Program Files%\ASP\Troubleshooter\iexplore.exe
- %Program Files%\ASP\Troubleshooter\iexplore.lnk
- %Program Files%\ASP\Turkish_uninst_tr.ini
- %Program Files%\ASP\unins000.dat
- %Program Files%\ASP\unins000.exe
- %Program Files%\ASP\unins000.msg
- %Program Files%\ASP\unrar.dll
- %Program Files%\ASP\Xceed.Compression.dll
- %Program Files%\ASP\Xceed.Compression.Formats.dll
- %Program Files%\ASP\Xceed.FileSystem.dll
- %Program Files%\ASP\Xceed.Zip.dll
- %Start Menu%\Programs\Advanced-System Protector\Advanced-System Protector.lnk
- %Start Menu%\Programs\Advanced-System Protector\Register Advanced-System Protector.lnk
- %Start Menu%\Programs\Advanced-System Protector\Advanced-System Protector Trouble Shooter.lnk
- %Start Menu%\Programs\Advanced-System Protector\Uninstall Advanced-System Protector.lnk
- %Desktop%\Advanced-System Protector.lnk
- %Application Data%\Systweak\Advanced-System Protector\2.1.1000.14155\ASPLog.txt
- %Application Data%\Systweak\Advanced-System Protector\QDetail.db
- %Application Data%\Systweak\Advanced-System Protector\Settings.db
- %All Users'Application Data%\Systweak\Advanced-System Protector\AddonSafelist
- %All Users'Application Data%\Systweak\Advanced-System Protector\log.xslt
- %System%\sasnative32.exe
Crea las carpetas siguientes:
- %User Temp%\is-{random}.tmp
- %User Temp%\is-{random}.tmp\_isetup
- %Program Files%\ASP
- %Program Files%\ASP\clamunpack
- %Program Files%\ASP\Troubleshooter
- %Application Data%\Systweak
- %Application Data%\Systweak\Advanced-System Protector
- %Start Menu%\Programs\Advanced-System Protector
- %All Users' Application Data%\Systweak\
- %All Users' Application Data%\Systweak\Advanced-System Protector
- %All Users' Application Data%\Systweak\Advanced-System Protector\signatures
- %All Users' Application Data%\Systweak\Advanced-System Protector\updates
- %User Temp%\sptemp
(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000, XP y Server 2003 suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp).
. %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).. %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data).. %Start Menu% es la carpeta Menú Inicio del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Menú Inicio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Menú Inicio y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}\Menú Inicio).)Técnica de inicio automático
Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Advanced-System Protector_startup = "%Program Files%\ASP\AdvancedSystemProtector.exe autolaunch"
Otras modificaciones del sistema
Agrega las siguientes entradas de registro como parte de la rutina de instalación:
HKEY_LOCAL_MACHINE\Software\Systweak\
Advanced-System Protector
HKEY_LOCAL_MACHINE\Software\Systweak\
Params
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector\2.1.1000.14155
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
HKEY_CURRENT_USER\Software\Systweak\
params
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector\LANG
HKEY_LOCAL_MACHINE\Software\Systweak\
Advanced-System Protector\LANG
HKEY_CURRENT_USER\Software\Licenses
HKEY_CLASSES_ROOT\CLSID\{A2BB8BF3-B6B7-ED30-0CBD-449D02DDDDAA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A2BB8BF3-B6B7-ED30-0CBD-449D02DDDDAA}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
aso3
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Unknown\shell\opendlg
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Unknown\shell\opendlg\
command
Agrega las siguientes entradas de registro:
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
TELNO = "(800)-935-0758"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
TELNOFR = "+33 975 184 234"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
TELNOJA = "03-4578-1515"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
isphone = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
issilent = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
showpb = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
showfth = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
showfthsetting = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
showsm = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
showbc = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
IsScanOptional = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Params
utm_source = "systweak"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Params
utm_campaign = "default"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Params
utm_medium = "newbuild"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Params
TELNO = "(800)-935-0758"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
utm_source = "systweak"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
utm_campaign = "default"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
utm_medium = "newbuild"
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector
utm_source = "systweak"
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector
utm_campaign = "default"
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector
utm_medium = "newbuild"
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector
TELNO = "(800)-935-0758"
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector
TELNOFR = "+33 975 184 234"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
BuyNowURL = "http://www.{BLOCKED}ak.com/antispyware/price.asp?"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
RenewNowURL = "http://www.{BLOCKED}ak.com/antispyware/price.asp?renew=1&"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
BuyNowURLADU = "http://powerbundle.{BLOCKED}ak.com/pb/price/?pname=adu&"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
BuyNowURLRCP = "http://powerbundle.{BLOCKED}ak.com/pb/price/?pname=rcp&"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
BuyNowURLASP = "http://powerbundle.{BLOCKED}ak.com/pb/price/?pname=asp&"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
BuyNowURLPB = "http://powerbundle.{BLOCKED}ak.com/PB/purchase/?pname=asp&"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
RenewNowURLADU = "http://powerbundle.{BLOCKED}ak.com/pb/renewal/?pname=adu&"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
RenewNowURLRCP = "http://powerbundle.{BLOCKED}ak.com/pb/renewal/?pname=rcp&"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
RenewNowURLASP = "http://powerbundle.{BLOCKED}ak.com/pb/renewal/?pname=asp&"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
RenewNowURLPB = "http://powerbundle.{BLOCKED}ak.com/PB/pbrenewal/?pname=asp&"
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector
InstalledPath = "%Program Files%\ASP"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
InstalledPath = "%Program Files%\ASP"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
Inno Setup: Setup Version = "5.5.1 (u)"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
Inno Setup: App Path = "%Program Files%\ASP"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
InstallLocation = "%Program Files%\ASP"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
Inno Setup: Icon Group = "Advanced-System Protector"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
Inno Setup: User = "Wilbert"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
Inno Setup: Language = "en"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
DisplayName = "Advanced-System Protector"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
DisplayIcon = "%Program Files%\ASP\AdvancedSystemProtector.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
UninstallString = "%Program Files%\ASP\unins000.exe "
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
QuietUninstallString = "%Program Files%\ASP\unins000.exe /SILENT"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
DisplayVersion = "2.1.1000.14155"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
Publisher = "systweak.com"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
URLInfoAbout = "http://www.{BLOCKED}ak.com/antispyware"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
HelpLink = "http://www.{BLOCKED}ak.com/antispyware"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
NoModify = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
NoRepair = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
InstallDate = "20141127"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
MajorVersion = "2"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{random key}
MinorVersion = "1"
HKEY_CURRENT_USER\Software\Systweak\
params
ASPInstalledPath = "%Program Files%\ASP"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Params
ASPInstalledPath = "%Program Files%\ASP"
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector\LANG
LangCode = "en"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector\LANG
LangCode = "en"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector\LANG
LangID = "0"
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector\LANG
LangID = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
afterInstallUrl = "{random characters}"
HKEY_CURRENT_USER\Software\Licenses
{R7C0DB872A3F777C0} = "{random values}"
HKEY_CURRENT_USER\Software\Licenses
{K7C0DB872A3F777C0} = "{random values}"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{A2BB8BF3-B6B7-ED30-0CBD-449D02DDDDAA}\InprocServer32
ThreadingModel = "Both"
HKEY_CURRENT_USER\Software\Licenses
{IAEC6047875E3CE39} = "{random values}"
HKEY_CURRENT_USER\Software\Licenses
{0AEC6047875E3CE39} = "{random values}"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
Expired = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
REGVER = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
REGVER-UNINSTALL = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced-System Protector
MaxFixLimit = "0"
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector
Expired = "0"
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector
REGVER = "0"
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector
REGVER-UNINSTALL = "0"
HKEY_CURRENT_USER\Software\Systweak\
Advanced-System Protector
MaxFixLimit = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Unknown\shell\openas\
command
Advanced-System Protector.bak = "%System%\rundll32.exe %System%\shell32.dll,OpenAs_RunDLL %1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Unknown\shell\opendlg
MultiSelectModel = "Single"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Unknown\shell\opendlg\
command
Advanced-System Protector.bak = "%System%\rundll32.exe %System%\shell32.dll,OpenAs_RunDLL %1"
Soluciones
Step 1
Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.
Step 3
Reiniciar en modo seguro
Step 4
Eliminar esta clave del Registro
Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.
- In HKEY_LOCAL_MACHINE\Software\Systweak
- Advanced-System Protector
- In HKEY_LOCAL_MACHINE\Software\Systweak
- Params
- In HKEY_CURRENT_USER\Software\Systweak
- Advanced-System Protector
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector
- 2.1.1000.14155
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
- {random key}
- In HKEY_CURRENT_USER\Software\Systweak
- params
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector
- LANG
- In HKEY_LOCAL_MACHINE\Software\Systweak\Advanced-System Protector
- LANG
- In HKEY_CURRENT_USER\Software
- Licenses
- In HKEY_CLASSES_ROOT\CLSID
- {A2BB8BF3-B6B7-ED30-0CBD-449D02DDDDAA}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A2BB8BF3-B6B7-ED30-0CBD-449D02DDDDAA}
- InprocServer32
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak
- aso3
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell
- opendlg
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg
- command
Step 5
Eliminar este valor del Registro
Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Advanced-System Protector_startup = %Program Files%\ASP\AdvancedSystemProtector.exe autolaunch
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- TELNO = (800)-935-0758
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- TELNOFR = +33 975 184 234
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- TELNOJA = 03-4578-1515
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- isphone = 1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- issilent = 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- showpb = 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- showfth = 1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- showfthsetting = 1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- showsm = 1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- showbc = 1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- IsScanOptional = 1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Params
- utm_source = systweak
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Params
- utm_campaign = default
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Params
- utm_medium = newbuild
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Params
- TELNO = (800)-935-0758
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- utm_source = systweak
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- utm_campaign = default
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- utm_medium = newbuild
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector
- utm_source = systweak
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector
- utm_campaign = default
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector
- utm_medium = newbuild
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector
- TELNO = (800)-935-0758
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector
- TELNOFR = +33 975 184 234
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- BuyNowURL = http://www.{BLOCKED}ak.com/antispyware/price.asp?
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- RenewNowURL = http://www.{BLOCKED}ak.com/antispyware/price.asp?renew=1&
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- BuyNowURLADU = http://powerbundle.{BLOCKED}ak.com/pb/price/?pname=adu&
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- BuyNowURLRCP = http://powerbundle.{BLOCKED}ak.com/pb/price/?pname=rcp&
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- BuyNowURLASP = http://powerbundle.{BLOCKED}ak.com/pb/price/?pname=asp&
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- BuyNowURLPB = http://powerbundle.{BLOCKED}ak.com/PB/purchase/?pname=asp&
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- RenewNowURLADU = http://powerbundle.{BLOCKED}ak.com/pb/renewal/?pname=adu&
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- RenewNowURLRCP = http://powerbundle.{BLOCKED}ak.com/pb/renewal/?pname=rcp&
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- RenewNowURLASP = http://powerbundle.{BLOCKED}ak.com/pb/renewal/?pname=asp&
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- RenewNowURLPB = http://powerbundle.{BLOCKED}ak.com/PB/pbrenewal/?pname=asp&
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector
- InstalledPath = %Program Files%\ASP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- InstalledPath = %Program Files%\ASP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- Inno Setup: Setup Version = 5.5.1 (u)
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- Inno Setup: App Path = %Program Files%\ASP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- InstallLocation = %Program Files%\ASP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- Inno Setup: Icon Group = Advanced-System Protector
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- Inno Setup: User = Wilbert
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- Inno Setup: Language = en
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- DisplayName = Advanced-System Protector
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- DisplayIcon = %Program Files%\ASP\AdvancedSystemProtector.exe
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- UninstallString = %Program Files%\ASP\unins000.exe
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- QuietUninstallString = %Program Files%\ASP\unins000.exe /SILENT
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- DisplayVersion = 2.1.1000.14155
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- Publisher = systweak.com
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- URLInfoAbout = http://www.{BLOCKED}ak.com/antispyware
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- HelpLink = http://www.{BLOCKED}ak.com/antispyware
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- NoModify = 1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- NoRepair = 1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- InstallDate = 20141127
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- MajorVersion = 2
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{random key}
- MinorVersion = 1
- In HKEY_CURRENT_USER\Software\Systweak\params
- ASPInstalledPath = %Program Files%\ASP
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Params
- ASPInstalledPath = %Program Files%\ASP
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector\LANG
- LangCode = en
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector\LANG
- LangCode = en
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector\LANG
- LangID = 0
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector\LANG
- LangID = 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- afterInstallUrl = {random characters}
- In HKEY_CURRENT_USER\Software\Licenses
- {R7C0DB872A3F777C0} = {random values}
- In HKEY_CURRENT_USER\Software\Licenses
- {K7C0DB872A3F777C0} = {random values}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A2BB8BF3-B6B7-ED30-0CBD-449D02DDDDAA}\InprocServer32
- ThreadingModel = Both
- In HKEY_CURRENT_USER\Software\Licenses
- {IAEC6047875E3CE39} = {random values}
- In HKEY_CURRENT_USER\Software\Licenses
- {0AEC6047875E3CE39} = {random values}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- Expired = 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- REGVER = 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- REGVER-UNINSTALL = 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\Advanced-System Protector
- MaxFixLimit = 0
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector
- Expired = 0
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector
- REGVER = 0
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector
- REGVER-UNINSTALL = 0
- In HKEY_CURRENT_USER\Software\Systweak\Advanced-System Protector
- MaxFixLimit = 0
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command
- Advanced-System Protector.bak = %System%\rundll32.exe %System%\shell32.dll,OpenAs_RunDLL %1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg
- MultiSelectModel = Single
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg\command
- Advanced-System Protector.bak = %System%\rundll32.exe %System%\shell32.dll,OpenAs_RunDLL %1
Step 6
Buscar y eliminar estas carpetas
- %User Temp%\is-{random}.tmp
- %Program Files%\ASP
- %Application Data%\Systweak
- %Start Menu%\Programs\Advanced-System Protector
- %All Users' Application Data%\Systweak\
- %User Temp%\sptemp
Step 7
Buscar y eliminar este archivo
- %Desktop%\Advanced-System Protector.lnk
- %System%\sasnative32.exe
Step 8
Reinicie en modo normal y explore el equipo con su producto de Trend Micro para buscar los archivos identificados como ADW_ADVSYSTEMPROTECTOR En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.
Rellene nuestra encuesta!