PLATFORM:

Windows

 OVER ALL RISK RATING:
 DAMAGE POTENTIAL::
 DISTRIBUTION POTENTIAL::
 REPORTED INFECTION:
Low
Medium
High
Critical

  • Threat Type:
    Trojan

  • Destructiveness:
    No

  • Encrypted:
     

  • In the wild::
    Yes

  OVERVIEW

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

  TECHNICAL DETAILS

File size: 6,970,304 bytes
File type: EXE
Memory resident: Yes
INITIAL SAMPLES RECEIVED DATE: 04 de февраля de 2016

Instalación

Crea las carpetas siguientes:

  • %User Temp%\{8BAD6F3F-BA9B-44BD-80FB-5358297F7044}
  • %User Temp%\is-BFIOA.tmp
  • %User Temp%\is-NRNHE.tmp
  • %User Temp%\is-NRNHE.tmp\_isetup
  • %Program Files%\Optimizer Pro
  • %Start Menu%\Programs\Optimizer Pro v3.2

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000, XP y Server 2003 suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp).

. %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

. %Start Menu% es la carpeta Menú Inicio del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Menú Inicio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Menú Inicio y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}\Menú Inicio).

)

Técnica de inicio automático

Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Optimizer Pro = "%Program Files%\Optimizer Pro\OptProLauncher.exe"

Otras modificaciones del sistema

Elimina los archivos siguientes:

  • %Desktop%\Optimizer Pro.pif
  • %Desktop%\Optimizer Pro.url
  • %Start Menu%\Programs\Optimizer Pro v3.2\Optimizer Pro.pif
  • %Start Menu%\Programs\Optimizer Pro v3.2\Optimizer Pro.url
  • %Start Menu%\Programs\Optimizer Pro v3.2\Help.pif
  • %Start Menu%\Programs\Optimizer Pro v3.2\Help.url
  • %Start Menu%\Programs\Optimizer Pro v3.2\Optimizer Pro on the Web.pif
  • %Start Menu%\Programs\Optimizer Pro v3.2\Optimizer Pro on the Web.url
  • %Start Menu%\Programs\Optimizer Pro v3.2\Uninstall Optimizer Pro.pif
  • %Start Menu%\Programs\Optimizer Pro v3.2\Uninstall Optimizer Pro.url
  • %Start Menu%\Programs\Optimizer Pro v3.2\Check updates.pif
  • %Start Menu%\Programs\Optimizer Pro v3.2\Check updates.url

(Nota: %Desktop% es la carpeta Escritorio del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}\Escritorio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Escritorio y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}\Escritorio).

. %Start Menu% es la carpeta Menú Inicio del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Menú Inicio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Menú Inicio y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}\Menú Inicio).

)

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_CURRENT_USER\SOFTWARE\Optimizer Pro

HKEY_CURRENT_USER\SOFTWARE\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_12887dd8\eae10f9d

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1

HKEY_CURRENT_USER\SOFTWARE\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5

HKEY_CURRENT_USER\SOFTWARE\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d

HKEY_CURRENT_USER\SOFTWARE\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\00000000

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\00000000

HKEY_LOCAL_MACHINE\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

HKEY_LOCAL_MACHINE\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Agrega las siguientes entradas de registro:

HKEY_CURRENT_USER\Software\Optimizer Pro
SetupName = "{malware path and file name}"

HKEY_CURRENT_USER\Software\Optimizer Pro
cufValue = "CUF=0"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_12887dd8\eae10f9d
340d3099 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_12887dd8\eae10f9d
dbaf3ce3 = "/P////%%"

HKEY_CURRENT_USER\Software\Optimizer Pro
Language = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
Inno Setup: Setup Version = "5.5.3 (u)"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
Inno Setup: App Path = "%Program Files%\Optimizer Pro"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
InstallLocation = "%Program Files%\Optimizer Pro"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
Inno Setup: Icon Group = "Optimizer Pro v3.2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
Inno Setup: User = "Wilbert"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
Inno Setup: Selected Tasks = "desktopicon"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
Inno Setup: Language = "en"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
DisplayName = "Optimizer Pro v3.2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
DisplayIcon = "%Program Files%\Optimizer Pro\OptProLauncher.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
UninstallString = "%Program Files%\Optimizer Pro\unins000.exe "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
QuietUninstallString = "%Program Files%\Optimizer Pro\unins000.exe /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1
InstallDate = "20160104"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
date = "1451974731"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
date = "1451974731"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
data.0 = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
data.0 = "{random characters}"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
data.1 = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
data.1 = "{random characters}"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
usr.0 = "6AN02rvqomjlhabcde"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
usr.0 = "6AN02rvqomjlhabcde"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
usr.1 = "hHtDYhOQIKEG+xztvq"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
usr.1 = "hHtDYhOQIKEG+xztvq"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
version = "1575d"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
uuid = "1206952858"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
uuid = "1206952858"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
51d2f2ea = "IlAl/YP/J/Af/X6/PlAf/XD/blAq/B//VP/j/Cx/V//j/CD/N//2/CJ////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
51d2f2ea = "IlAl/YP/J/Af/X6/PlAf/XD/blAq/B//VP/j/Cx/V//j/CD/N//2/CJ////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
a2e3b941 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
a2e3b941 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
bbf88800 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
appid.0 = "9y3FwDzpImHqPTVNPRoNw77XqTxCEeMJgsAw"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
state = "0"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
a1dcff5b = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
a1dcff5b = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
340d3099 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
340d3099 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
0e93c3f3 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
0e93c3f3 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
0c230bcb = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
0c230bcb = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
27ddcf6f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
27ddcf6f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
414bc593 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
414bc593 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
f0bf0bde = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
f0bf0bde = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
c99a5f5c = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
c99a5f5c = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
72758a5d = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
72758a5d = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
e46c271e = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
e46c271e = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
7f69fa1f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
7f69fa1f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
3c09c42b = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
3c09c42b = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
7367429f = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
7367429f = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
0dc3ee96 = "/P////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
d1abcdb6 = "///%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
d1abcdb6 = "///%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
38583bc3 = "Ml/2/CF/M//g/CZ////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
c24899a6 = "MP/f/CF/MP/3/CZ////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
c24899a6 = "MP/f/CF/MP/3/CZ////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
f1f24e29 = "Vl/l/C/////%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
c5705860 = "Vx////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
c5705860 = "Vx////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
a0743acc = "N/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
a0743acc = "N/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
c6c5dd44 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
1520c6f1 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
1520c6f1 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
2d71d5ab = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
2d71d5ab = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
8b9e4cbc = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
fe94ce1e = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
fe94ce1e = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
587b5709 = "V/////%%"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\eae10f9d
587b5709 = "V/////%%"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
lrts = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
lrts = "0"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
mode = "f"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
mode = "f"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
svn = "Optimizer Pro Crash Monitor"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
svi = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
svt = "568b64c"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\00000000
370856c7 = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\00000000
370856c7 = "{random characters}"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\00000000
3efeb33e = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5\00000000
3efeb33e = "{random characters}"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
iiid = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
LoadAppInit_DLLs = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
ca82e1a5 = "%Program Files%\Optimizer Pro\OptProCrash.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
dlpath = "%Program Files%\optimi~1\optpro~1.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\
_ca82e1a5
svpath = "%Program Files%\optimi~1\OptProCrashSvc.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
n = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
n = "1"

HKEY_CURRENT_USER\Software\AppDataLow\
{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
dbaf3ce3 = "/P////%%"

HKEY_CURRENT_USER\Software\Optimizer Pro
InstallDate = "{random values}"

HKEY_CURRENT_USER\Software\Optimizer Pro
AppStart = "0"

HKEY_CURRENT_USER\Software\Optimizer Pro
Os = "102"

HKEY_CURRENT_USER\Software\Optimizer Pro
MachineGuid = "5854631E-A37E-7CF7-B99B-C1CDF2D524A3"

HKEY_CURRENT_USER\Software\Optimizer Pro
DelayedStart = "5"

HKEY_CURRENT_USER\Software\Optimizer Pro
Querry = "{random characters}"

HKEY_CURRENT_USER\Software\Optimizer Pro
SupportURL = "http://support.{BLOCKED}itiespro.com"

HKEY_CURRENT_USER\Software\Optimizer Pro
HomePageURL = "http://www.{BLOCKED}itiespro.com"

HKEY_CURRENT_USER\Software\Optimizer Pro
BuyNowURL = "{random characters}"

HKEY_CURRENT_USER\Software\Optimizer Pro
UseAds = "1"

HKEY_CURRENT_USER\Software\Optimizer Pro
AdsHost = "dl.softservers.net"

HKEY_CURRENT_USER\Software\Optimizer Pro
AdsDownloadURL = "http://dl.{BLOCKED}rvers.net/121000601/DriverPro.exe"

HKEY_CURRENT_USER\Software\Optimizer Pro
AdsBuyNowURL = "{random characters}"

HKEY_CURRENT_USER\Software\Optimizer Pro
ShowEUA = "1"

Modifica las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Windows
AppInit_DLLs = "%Program Files%\optimi~1\optpro~1.dll"

Elimina las siguientes claves de registro:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Tracing\OptimizerPro_RASAPI32

HKEY_LOCAL_MACHINE\Software\Microsoft\
Tracing\OptimizerPro_RASMANCS

HKEY_LOCAL_MACHINE\Software\Microsoft\
Tracing\OptProStart_RASAPI32

HKEY_LOCAL_MACHINE\Software\Microsoft\
Tracing\OptProStart_RASMANCS

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
MenuOrder\Start Menu2\Programs\
Optimizer Pro

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Optimizer Pro_is1

Rutina de infiltración

Infiltra los archivos siguientes:

  • %User Temp%\{8BAD6F3F-BA9B-44BD-80FB-5358297F7044}\setup.exe
  • %User Temp%\is-BFIOA.tmp\setup.tmp
  • %User Temp%\is-NRNHE.tmp\_isetup\_shfoldr.dll
  • %User Temp%\is-NRNHE.tmp\itdownload.dll
  • %User Temp%\is-NRNHE.tmp\OptProCrash.dll
  • %Program Files%\Optimizer Pro\unins000.dat
  • %Program Files%\Optimizer Pro\is-VQ91A.tmp
  • %Program Files%\Optimizer Pro\is-C3Q1V.tmp
  • %Program Files%\Optimizer Pro\is-V0MRJ.tmp
  • %Program Files%\Optimizer Pro\is-AHLAR.tmp
  • %Program Files%\Optimizer Pro\is-MVU3B.tmp
  • %Program Files%\Optimizer Pro\is-JR3R7.tmp
  • %Program Files%\Optimizer Pro\is-8BA4N.tmp
  • %Program Files%\Optimizer Pro\is-401FI.tmp
  • %Program Files%\Optimizer Pro\is-UTLE1.tmp
  • %Program Files%\Optimizer Pro\is-4FTFK.tmp
  • %Program Files%\Optimizer Pro\is-SJ35S.tmp
  • %Program Files%\Optimizer Pro\is-I0QSC.tmp
  • %Program Files%\Optimizer Pro\is-4A1H4.tmp
  • %Program Files%\Optimizer Pro\is-RQRE1.tmp
  • %Program Files%\Optimizer Pro\is-VQ08Q.tmp
  • %Program Files%\Optimizer Pro\is-CVH21.tmp
  • %Program Files%\Optimizer Pro\is-D780B.tmp
  • %Program Files%\Optimizer Pro\is-DIHP4.tmp
  • %Program Files%\Optimizer Pro\is-NBTR8.tmp
  • %Desktop%\Optimizer Pro.lnk
  • %Start Menu%\Programs\Optimizer Pro v3.2\Optimizer Pro.lnk
  • %Start Menu%\Programs\Optimizer Pro v3.2\Help.lnk
  • %Start Menu%\Programs\Optimizer Pro v3.2\Optimizer Pro on the Web.lnk
  • %Start Menu%\Programs\Optimizer Pro v3.2\Uninstall Optimizer Pro.lnk
  • %Start Menu%\Programs\Optimizer Pro v3.2\Check updates.lnk
  • %Program Files%\Optimizer Pro\unins000.msg
  • %Program Files%\Optimizer Pro\OptProCrash.dll
  • %Program Files%\optimi~1\OptProCrashSvc.dll

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000, XP y Server 2003 suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp).

. %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).

. %Desktop% es la carpeta Escritorio del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Profiles\{nombre de usuario}\Escritorio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Escritorio y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}\Escritorio).

. %Start Menu% es la carpeta Menú Inicio del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Menú Inicio, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Menú Inicio y en el caso de Windows 2000, XP y Server 2003 en C:\Documents and Settings\{nombre de usuario}\Menú Inicio).

)

  SOLUTION

Minimum scan engine: 9.8

Step 1

Los usuarios de Windows ME y XP, antes de llevar a cabo cualquier exploración, deben comprobar que tienen desactivada la opción Restaurar sistema para permitir la exploración completa del equipo.

Step 2

Reiniciar en modo seguro

[ learnMore ]

Step 3

Eliminar esta clave del Registro

[ learnMore ]

Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.

  • In HKEY_CURRENT_USER\SOFTWARE
    • Optimizer Pro
  • In HKEY_CURRENT_USER\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_12887dd8
    • eae10f9d
  • In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
    • Optimizer Pro_is1
  • In HKEY_CURRENT_USER\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
    • _ca82e1a5
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
    • _ca82e1a5
  • In HKEY_CURRENT_USER\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • eae10f9d
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • eae10f9d
  • In HKEY_CURRENT_USER\SOFTWARE\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • 00000000
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • 00000000
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • {6791A2F3-FC80-475C-A002-C014AF797E9C}
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • {3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Step 4

Eliminar este valor del Registro

[ learnMore ]

Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Optimizer Pro = "%Program Files%\Optimizer Pro\OptProLauncher.exe"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • SetupName = "{malware path and file name}"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • cufValue = "CUF=0"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_12887dd8\eae10f9d
    • 340d3099 = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_12887dd8\eae10f9d
    • dbaf3ce3 = "/P////%%"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • Language = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • Inno Setup: Setup Version = "5.5.3 (u)"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • Inno Setup: App Path = "%Program Files%\Optimizer Pro"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • InstallLocation = "%Program Files%\Optimizer Pro"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • Inno Setup: Icon Group = "Optimizer Pro v3.2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • Inno Setup: User = "Wilbert"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • Inno Setup: Selected Tasks = "desktopicon"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • Inno Setup: Language = "en"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • DisplayName = "Optimizer Pro v3.2"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • DisplayIcon = "%Program Files%\Optimizer Pro\OptProLauncher.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • UninstallString = "%Program Files%\Optimizer Pro\unins000.exe "
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • QuietUninstallString = "%Program Files%\Optimizer Pro\unins000.exe /SILENT"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • NoModify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • NoRepair = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
    • InstallDate = "20160104"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • date = "1451974731"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • date = "1451974731"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • data.0 = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • data.0 = "{random characters}"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • data.1 = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • data.1 = "{random characters}"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • usr.0 = "6AN02rvqomjlhabcde"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • usr.0 = "6AN02rvqomjlhabcde"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • usr.1 = "hHtDYhOQIKEG+xztvq"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • usr.1 = "hHtDYhOQIKEG+xztvq"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • version = "1575d"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • uuid = "1206952858"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • uuid = "1206952858"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 51d2f2ea = "IlAl/YP/J/Af/X6/PlAf/XD/blAq/B//VP/j/Cx/V//j/CD/N//2/CJ////%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 51d2f2ea = "IlAl/YP/J/Af/X6/PlAf/XD/blAq/B//VP/j/Cx/V//j/CD/N//2/CJ////%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • a2e3b941 = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • a2e3b941 = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • bbf88800 = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • bbf88800 = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • appid.0 = "9y3FwDzpImHqPTVNPRoNw77XqTxCEeMJgsAw"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • state = "0"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • a1dcff5b = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • a1dcff5b = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 340d3099 = "/P////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 340d3099 = "/P////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 0e93c3f3 = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 0e93c3f3 = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 0c230bcb = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 0c230bcb = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 27ddcf6f = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 27ddcf6f = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 414bc593 = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 414bc593 = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • f0bf0bde = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • f0bf0bde = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • c99a5f5c = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • c99a5f5c = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 72758a5d = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 72758a5d = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • e46c271e = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • e46c271e = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 7f69fa1f = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 7f69fa1f = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 3c09c42b = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 3c09c42b = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 7367429f = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 7367429f = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 0dc3ee96 = "/P////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 0dc3ee96 = "/P////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • d1abcdb6 = "///%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • d1abcdb6 = "///%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 38583bc3 = "Ml/2/CF/M//g/CZ////%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 38583bc3 = "Ml/2/CF/M//g/CZ////%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • c24899a6 = "MP/f/CF/MP/3/CZ////%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • c24899a6 = "MP/f/CF/MP/3/CZ////%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • f1f24e29 = "Vl/l/C/////%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • f1f24e29 = "Vl/l/C/////%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • c5705860 = "Vx////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • c5705860 = "Vx////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • a0743acc = "N/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • a0743acc = "N/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • c6c5dd44 = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • c6c5dd44 = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 1520c6f1 = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 1520c6f1 = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 2d71d5ab = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 2d71d5ab = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 8b9e4cbc = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 8b9e4cbc = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • fe94ce1e = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • fe94ce1e = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 587b5709 = "V/////%%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • 587b5709 = "V/////%%"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • lrts = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • lrts = "0"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • mode = "f"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • mode = "f"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • svn = "Optimizer Pro Crash Monitor"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • svi = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • svt = "568b64c"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\00000000
    • 370856c7 = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\00000000
    • 370856c7 = "{random characters}"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\00000000
    • 3efeb33e = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\00000000
    • 3efeb33e = "{random characters}"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • iiid = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • iiid = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    • LoadAppInit_DLLs = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
    • ca82e1a5 = "%Program Files%\Optimizer Pro\OptProCrash.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • dlpath = "%Program Files%\optimi~1\optpro~1.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5
    • svpath = "%Program Files%\optimi~1\OptProCrashSvc.dll"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
    • n = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
    • n = "1"
  • In HKEY_CURRENT_USER\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_ca82e1a5\eae10f9d
    • dbaf3ce3 = "/P////%%"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • InstallDate = "{random values}"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • AppStart = "0"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • Os = "102"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • MachineGuid = "5854631E-A37E-7CF7-B99B-C1CDF2D524A3"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • DelayedStart = "5"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • Querry = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • SupportURL = "http://support.{BLOCKED}itiespro.com"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • HomePageURL = "http://www.{BLOCKED}itiespro.com"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • BuyNowURL = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • UseAds = "1"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • AdsHost = "dl.softservers.net"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • AdsDownloadURL = "http://dl.{BLOCKED}rvers.net/121000601/DriverPro.exe"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • AdsBuyNowURL = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Optimizer Pro
    • ShowEUA = "1"

Step 5

Restaurar este valor del Registro modificado

[ learnMore ]

Importante: si modifica el Registro de Windows incorrectamente, podría hacer que el sistema funcione mal de manera irreversible. Lleve a cabo este paso solo si sabe cómo hacerlo o si puede contar con ayuda de su administrador del sistema. De lo contrario, lea este artículo de Microsoft antes de modificar el Registro del equipo.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    • AppInit_DLLs = "%Program Files%\optimi~1\optpro~1.dll"

Step 6

Buscar y eliminar estos archivos

[ learnMore ]
Puede que algunos de los archivos del componente estén ocultos. Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción "Más opciones avanzadas" para que el resultado de la búsqueda incluya todos los archivos y carpetas ocultos.
  • %User Temp%\{8BAD6F3F-BA9B-44BD-80FB-5358297F7044}\setup.exe
  • %User Temp%\is-BFIOA.tmp\setup.tmp
  • %User Temp%\is-NRNHE.tmp\_isetup\_shfoldr.dll
  • %User Temp%\is-NRNHE.tmp\itdownload.dll
  • %User Temp%\is-NRNHE.tmp\OptProCrash.dll
  • %Program Files%\Optimizer Pro\unins000.dat
  • %Program Files%\Optimizer Pro\is-VQ91A.tmp
  • %Program Files%\Optimizer Pro\is-C3Q1V.tmp
  • %Program Files%\Optimizer Pro\is-V0MRJ.tmp
  • %Program Files%\Optimizer Pro\is-AHLAR.tmp
  • %Program Files%\Optimizer Pro\is-MVU3B.tmp
  • %Program Files%\Optimizer Pro\is-JR3R7.tmp
  • %Program Files%\Optimizer Pro\is-8BA4N.tmp
  • %Program Files%\Optimizer Pro\is-401FI.tmp
  • %Program Files%\Optimizer Pro\is-UTLE1.tmp
  • %Program Files%\Optimizer Pro\is-4FTFK.tmp
  • %Program Files%\Optimizer Pro\is-SJ35S.tmp
  • %Program Files%\Optimizer Pro\is-I0QSC.tmp
  • %Program Files%\Optimizer Pro\is-4A1H4.tmp
  • %Program Files%\Optimizer Pro\is-RQRE1.tmp
  • %Program Files%\Optimizer Pro\is-VQ08Q.tmp
  • %Program Files%\Optimizer Pro\is-CVH21.tmp
  • %Program Files%\Optimizer Pro\is-D780B.tmp
  • %Program Files%\Optimizer Pro\is-DIHP4.tmp
  • %Program Files%\Optimizer Pro\is-NBTR8.tmp
  • %Desktop%\Optimizer Pro.lnk
  • %Start Menu%\Programs\Optimizer Pro v3.2\Optimizer Pro.lnk
  • %Start Menu%\Programs\Optimizer Pro v3.2\Help.lnk
  • %Start Menu%\Programs\Optimizer Pro v3.2\Optimizer Pro on the Web.lnk
  • %Start Menu%\Programs\Optimizer Pro v3.2\Uninstall Optimizer Pro.lnk
  • %Start Menu%\Programs\Optimizer Pro v3.2\Check updates.lnk
  • %Program Files%\Optimizer Pro\unins000.msg
  • %Program Files%\Optimizer Pro\OptProCrash.dll
  • %Program Files%\optimi~1\OptProCrashSvc.dll

Step 7

Buscar y eliminar estas carpetas

[ learnMore ]
Asegúrese de que tiene activada la casilla Buscar archivos y carpetas ocultos en la opción Más opciones avanzadas para que el resultado de la búsqueda incluya todas las carpetas ocultas.
  • %User Temp%\{8BAD6F3F-BA9B-44BD-80FB-5358297F7044}
  • %User Temp%\is-BFIOA.tmp
  • %User Temp%\is-NRNHE.tmp
  • %User Temp%\is-NRNHE.tmp\_isetup
  • %Program Files%\Optimizer Pro
  • %Start Menu%\Programs\Optimizer Pro v3.2

Step 8

Reinicie en modo normal y explore el equipo con su producto de Trend Micro para buscar los archivos identificados como PUA_PCUtilities En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.


Did this description help? Tell us how we did.