Gen.Variant.Adware.Mikey.11354_7a7f38ffe4

by malwarelabrobot on May 2nd, 2015 in Malware Descriptions.

Gen:Variant.Adware.Mikey.11354 (B) (Emsisoft), Gen:Variant.Adware.Mikey.11354 (AdAware), Backdoor.Win32.PcClient.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD (Lavasoft MAS)
Behaviour: Trojan, Backdoor, VirTool, Adware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 7a7f38ffe4d4bc915636e5224efae388
SHA1: 94b0d41b0223bf141cf807997548287d639f3c4b
SHA256: a3db3993f29d4a1c08f247bcfbd6a488f9fc46ce8798acb4b321fe6ac2f2b121
SSDeep: 196608:dw1LfRRpNfDKjnPIAB4bilEbOnWd5edLn:dwlfRRpN jnPzdEUWdcn
Size: 6368728 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Super PC Tools Ltd
Created at: 2015-04-07 16:23:19
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

rundll32.exe:1512
supoptsetup.tmp:860
%original file name%.exe:1136
supoptsetup.exe:284

The Trojan injects its code into the following process(es):

rundll32.exe:972
SupOptStart.exe:596

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process supoptsetup.tmp:860 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Super Optimizer\is-98KI8.tmp (7726 bytes)
%Program Files%\Super Optimizer\is-LBR8R.tmp (11 bytes)
%Program Files%\Super Optimizer\is-3K119.tmp (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-73IHD.tmp\SupOptHelper.dll (7971 bytes)
%Program Files%\Super Optimizer\is-J9KPU.tmp (601 bytes)
%Program Files%\Super Optimizer\is-OSB1K.tmp (127 bytes)
%Program Files%\Super Optimizer\is-8TFGT.tmp (7345 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Super Optimizer.lnk (773 bytes)
%Program Files%\Super Optimizer\is-6USPS.tmp (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-73IHD.tmp\_isetup\_shfoldr.dll (23 bytes)
%Program Files%\Super Optimizer\is-1OL4K.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-73IHD.tmp\SupOptStats.dll (15506 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Super Optimizer on the Web.lnk (743 bytes)
%Program Files%\Super Optimizer\unins000.dat (15297 bytes)
%Program Files%\Super Optimizer\SupOptStats.dll (133377 bytes)
%Program Files%\Super Optimizer\is-RHLAS.tmp (7433 bytes)
%Program Files%\Super Optimizer\is-7KE0J.tmp (909 bytes)
%Program Files%\Super Optimizer\unins000.msg (646 bytes)
%Program Files%\Super Optimizer\is-BQ8G8.tmp (32242 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Uninstall Super Optimizer.lnk (769 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Check updates.lnk (801 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Help.lnk (773 bytes)
%Program Files%\Super Optimizer\is-5PP5K.tmp (30 bytes)
%Program Files%\Super Optimizer\is-1U2EK.tmp (712 bytes)
%Program Files%\Super Optimizer\is-FDNN4.tmp (7971 bytes)
%Program Files%\Super Optimizer\is-VS9VG.tmp (33652 bytes)
%Program Files%\Super Optimizer\is-KR9M8.tmp (7345 bytes)
%Documents and Settings%\%current user%\Desktop\Super Optimizer.lnk (761 bytes)
%Program Files%\Super Optimizer\is-B2DOD.tmp (6841 bytes)
%Program Files%\Super Optimizer\is-INSHL.tmp (6841 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-73IHD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-73IHD.tmp\SupOptHelper.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-73IHD.tmp\SupOptStats.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-73IHD.tmp\_isetup (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-73IHD.tmp\_isetup\_shfoldr.dll (0 bytes)

The process %original file name%.exe:1136 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\All Users\Application Data\{2ae2ad5d-5db4-0430-2ae2-2ad5d5dbb575}\hqghumeaylnlf.dat (962 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ZH0F69IG\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0JOQR15G\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\supoptsetup.exe (776878 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MGJC8WKP\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (6588 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (660 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (776 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\hqghumeaylnlf.lnk (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6T81M5M4\desktop.ini (67 bytes)
%Documents and Settings%\All Users\Application Data\{2ae2ad5d-5db4-0430-2ae2-2ad5d5dbb575}\hqghumeaylnlf.exe (201856 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (6640 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)

The process supoptsetup.exe:284 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-GEVMV.tmp\supoptsetup.tmp (7386 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-GEVMV.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-GEVMV.tmp\supoptsetup.tmp (0 bytes)

Registry activity

The process rundll32.exe:972 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"iiid" = "1"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7f69fa1f" = "///%"
"65114b36" = "VP/ ////"
"48bd1aff" = "V/////%%"
"c6c5dd44" = "V/////%%"
"a0743acc" = "N/////%%"
"51d2f2ea" = "JlA /Y//GPAf/D6/b/Ah/Xt/aPAp/Yq/GPAf/B//JlAh/XD/c/Ag/B//VP/j/Cx/V//j/CZ/V//h/CD////%"
"27ddcf6f" = "///%"
"414bc593" = "///%"
"c5705860" = "Vx////%%"
"8b9e4cbc" = "V/////%%"
"587b5709" = "V/////%%"
"2d71d5ab" = "V/////%%"
"d94388d2" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
"f2c53c49" = "UlAr/XJ/c//k////"
"d1abcdb6" = "///%"
"6185d035" = "VP/h/CP/V//l////"
"0dc3ee96" = "/P////%%"
"1520c6f1" = "V/////%%"
"c99a5f5c" = "///%"
"c24899a6" = "VP/g/CV/Vl/1/CF////%"
"fe94ce1e" = "V/////%%"
"1c311243" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
"a2e3b941" = "///%"
"f6ad6fa6" = "V/////%%"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"370856c7" = ""

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"493c7345" = "mU1P0700px1M06E0m01O06h0nx1D07C0px1M07b0al1D06I0pl1T00%%, mU1P0700px1M06E0m01O06h0nx1D07C0px1M07x0ox1Z06t0al1S06t0i00%"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 2A D7 A1 75 7C 0B 90 A4 80 83 A0 0B 90 AC 90"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0e93c3f3" = "///%"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"a47da861" = "o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780i01D06O0px1g02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780mU1P0780pl1h02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y06h0i01J02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1O06l0px1R06t0ql0Z07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1O0640oU1 07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y07b0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1R06l0qx1O0640iU1 0680mU1P0700px1M06E0m01O06h0nx1D07C0px1M02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06I0px1O02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780iU1 0680ql1D06I0pU0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1T0700i01D06O0ox1K06t0ml1N07t0m01 0780mU1 07x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y!"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"340d3099" = "/P////%%"
"0c230bcb" = "///%"
"f1f24e29" = "Vl/l/C/////%"
"38583bc3" = "Ml/2/CF/M//g/CZ////%"
"bbf88800" = "///%"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"3efeb33e" = ""

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"72758a5d" = "///%"
"2e22d94e" = "///%"
"f0bf0bde" = "///%"
"7367429f" = "///%"
"e8f9dcc7" = "UlAr/XJ/c//k////"
"a1dcff5b" = "V/////%%"
"e46c271e" = "///%"
"3c09c42b" = "///%"
"060df2cd" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAp/YP/UxAs/X6/aP////%%"

The process rundll32.exe:1512 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 80 88 C4 F0 1C 49 47 3D E7 EC BA D2 9F 52 51"

The process SupOptStart.exe:596 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 CF 21 77 CA 47 44 AB FE 86 D2 19 06 15 DA 1F"

[HKCU\Software\Super Optimizer]
"AppStart" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Super Optimizer]
"InstallDate" = "A4 1F 5C E3 B0 91 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process supoptsetup.tmp:860 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"340d3099" = "/P////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f0bf0bde" = "///%"
"bbf88800" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"MajorVersion" = "3"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"65114b36" = "VP/ ////"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"appid.0" = "wpGfBPQJEa6LJmjlhaYk4Cw5GfPOvVs7d/87Kg"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"usr.1" = "3jYmlYhabcdefABCDW"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_f4b8651c\eae10f9d]
"dbaf3ce3" = "/P////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"uuid" = "754687653"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: Icon Group" = "Super Optimizer"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f2c53c49" = "UlAr/XJ/c//k////"
"f1f24e29" = "Vl/l/C/////%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"370856c7" = ""

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7f69fa1f" = "///%"
"38583bc3" = "Ml/2/CF/M//g/CZ////%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"a0743acc" = "N/////%%"
"38583bc3" = "Ml/2/CF/M//g/CZ////%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c99a5f5c" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"414bc593" = "///%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"URLUpdateInfo" = "http://www.superpctools.com/"

[HKCU\Software\Super Optimizer]
"UninstallURL" = "https://safecart.com/superpctools/.spo-special/purchase?sid=211001894-CA-204"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"a47da861" = "o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780i01D06O0px1g02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780mU1P0780pl1h02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y06h0i01J02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1O06l0px1R06t0ql0Z07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1O0640oU1 07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y07b0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1R06l0qx1O0640iU1 0680mU1P0700px1M06E0m01O06h0nx1D07C0px1M02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06I0px1O02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780iU1 0680ql1D06I0pU0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1T0700i01D06O0ox1K06t0ml1N07t0m01 0780mU1 07x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y翨"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"414bc593" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"DisplayVersion" = "3.2.0.1"
"DisplayIcon" = "%Program Files%\Super Optimizer\SupOptLauncher.exe"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"1c311243" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"d1abcdb6" = "///%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"svt" = "1430473178"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"1c311243" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f6ad6fa6" = "V/////%%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"0e93c3f3" = "///%"
"2e22d94e" = "///%"
"72758a5d" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"587b5709" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs" = "1"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"uuid" = "754687653"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"svi" = "0"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a1dcff5b" = "V/////%%"
"0dc3ee96" = "/P////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: Selected Tasks" = "desktopicon"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"svn" = "SuperOptimizer Stats"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"NoRepair" = "1"

[HKCU\Software\Super Optimizer]
"AdsBuyNowURL" = "http://supc20.superpctools.revenuewire.net/spu/register?221001894_A3FB173B-6644-44E1-8860-7132BFE9D31F"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0dc3ee96" = "/P////%%"

[HKCU\Software\Super Optimizer]
"sc" = "http://gen.securedshopgate.com/?t=01&b=21&tid=211001894-CA-204_A3FB173B-6644-44E1-8860-7132BFE9D31F"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c6c5dd44" = "V/////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"fe94ce1e" = "V/////%%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"appid.0" = "wpGfBPQJEa6LJmjlhaYk4Cw5GfPOvVs7d/87Kg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"493c7345" = "mU1P0700px1M06E0m01O06h0nx1D07C0px1M07b0al1D06I0pl1T00%%, mU1P0700px1M06E0m01O06h0nx1D07C0px1M07x0ox1Z06t0al1S06t0i00%"

[HKCU\Software\Super Optimizer]
"Language" = "1"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"48bd1aff" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"1c311243" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"State" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: Deselected Tasks" = ""

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7367429f" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"LRTS" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"HelpLink" = "http://www.superpctools.com/"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"8b9e4cbc" = "V/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"e46c271e" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svi" = "0"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"2d71d5ab" = "V/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"iiid" = "1"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c5705860" = "Vx////%%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"587b5709" = "V/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"a47da861" = "o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780i01D06O0px1g02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780mU1P0780pl1h02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y06h0i01J02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1O06l0px1R06t0ql0Z07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1O0640oU1 07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y07b0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1R06l0qx1O0640iU1 0680mU1P0700px1M06E0m01O06h0nx1D07C0px1M02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06I0px1O02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780iU1 0680ql1D06I0pU0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1T0700i01D06O0ox1K06t0ml1N07t0m01 0780mU1 07x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"51d2f2ea" = "JlA /Y//GPAf/D6/b/Ah/Xt/aPAp/Yq/GPAf/B//JlAh/XD/c/Ag/B//VP/j/Cx/V//j/CZ/V//h/CD////%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"f6ad6fa6" = "V/////%%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\00000000]
"370856c7" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Super Optimizer]
"SessionID" = "A3FB173B-6644-44E1-8860-7132BFE9D31F"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"usr.0" = "B 6yuH456789/XZTVN"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0e93c3f3" = "///%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"414bc593" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"e46c271e" = "///%"
"65114b36" = "VP/ ////"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"usr.0" = "B 6yuH456789/XZTVN"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"NoModify" = "1"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"Version" = "22022137"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"38583bc3" = "Ml/2/CF/M//g/CZ////%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\00000000]
"3efeb33e" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"iiid" = "1"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f2c53c49" = "UlAr/XJ/c//k////"

[HKCU\Software\Super Optimizer]
"Querry" = "http://bi.superpcdownload.net/t/i/sp?sid=211001894-CA-204&dt=%dt%&gid=A3FB173B-6644-44E1-8860-7132BFE9D31F&tz=%tz%&ln=%ln%&lc=%lc%&bis=%bis%&bief=%bief%&biefx=%biefx%&bif=%bif%&os=%os%&f=4195579146"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"e8f9dcc7" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1146AC44-2F03-4431-B4FD-889BC837521F}{22134214}]
"Cache" = "9454923552424339446"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"51d2f2ea" = "JlA /Y//GPAf/D6/b/Ah/Xt/aPAp/Yq/GPAf/B//JlAh/XD/c/Ag/B//VP/j/Cx/V//j/CZ/V//h/CD////%"
"2e22d94e" = "///%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\00000000]
"a47da861" = "o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780i01D06O0px1g02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780mU1P0780pl1h02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y06h0i01J02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1O06l0px1R06t0ql0Z07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1O0640oU1 07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y07b0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1R06l0qx1O0640iU1 0680mU1P0700px1M06E0m01O06h0nx1D07C0px1M02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06I0px1O02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780iU1 0680ql1D06I0pU0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1T0700i01D06O0ox1K06t0ml1N07t0m01 0780mU1 07x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y\"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"uuid" = "754687653"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0c230bcb" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c5705860" = "Vx////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0c230bcb" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"72758a5d" = "///%"

[HKCU\Software\Super Optimizer]
"UseAds" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: App Path" = "%Program Files%\Super Optimizer"

[HKCU\Software\Super Optimizer]
"Ir" = "1"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"3c09c42b" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}]
"22134214" = "%Program Files%\Super Optimizer\SupOptStats.dll"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 E7 7D BB 38 42 6B BF 4B 3E 65 47 67 A3 73 B7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"QuietUninstallString" = "%Program Files%\Super Optimizer\unins000.exe /SILENT"

[HKCU\Software\Super Optimizer]
"BuyNowURL" = "http://gen.securedshopgate.com/?t=01&b=21&tid=211001894-CA-204_A3FB173B-6644-44E1-8860-7132BFE9D31F"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a2e3b941" = "///%"

[HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}]
"n" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"493c7345" = "mU1P0700px1M06E0m01O06h0nx1D07C0px1M07b0al1D06I0pl1T00%%, mU1P0700px1M06E0m01O06h0nx1D07C0px1M07x0ox1Z06t0al1S06t0i00%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"data.0" = "JkN022REkM1M8WdefAaPrQn/tGxT1ZkhrLqsArZr3VW1DLU5PZ4OT7sPpAdTmQj1pqI9UOj9F8kYHbRxpH9VjXuAB"
"data.1" = "wnzCWolhx2oFZabcdeYy7dJ6BdqphW7RxT5 fIGyMZ4I52T6DiWjEYWtde4imrJSxBKVNzMKH wrBb4FnH IKzMO 7V9bEjpCwP/TD9xfl6DZhf/sDcdESEtvyIcetXHx0g88C6p8rIJS/C84lNwaHaErxyN0Sh U"

[HKCU\Software\Super Optimizer]
"homepageurl" = "http://www.superpctools.com"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a2e3b941" = "///%"

[HKCU\Software\Super Optimizer]
"CBM" = "1"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"48bd1aff" = "V/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"27ddcf6f" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"dlpath" = "c:\progra~1\supero~1\supopt~2.dll"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"c99a5f5c" = "///%"
"c24899a6" = "VP/g/CV/Vl/1/CF////%"

[HKCU\Software\Super Optimizer]
"SupportURL" = "http://superpctools.com/support/"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"3c09c42b" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"fe94ce1e" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"Version" = "22022137"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"060df2cd" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAp/YP/UxAs/X6/aP////%%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"LRTS" = "0"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"a2e3b941" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"48bd1aff" = "V/////%%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"c6c5dd44" = "V/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"1520c6f1" = "V/////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"587b5709" = "V/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"370856c7" = ""

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"65114b36" = "VP/ ////"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"1520c6f1" = "V/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"d94388d2" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
"f1f24e29" = "Vl/l/C/////%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"DisplayName" = "Super Optimizer v3.2"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c24899a6" = "VP/g/CV/Vl/1/CF////%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: Setup Version" = "5.5.3 (u)"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Super Optimizer]
"SupOptStart.exe" = "Super Optimizer Launcher"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"iiid" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"0c230bcb" = "///%"
"7f69fa1f" = "///%"
"f2c53c49" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Super Optimizer]
"AdsHost" = "dl.superpcdownload.net"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"InstallDate" = "20150501"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0e93c3f3" = "///%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"7367429f" = "///%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"c5705860" = "Vx////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"340d3099" = "/P////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"3efeb33e" = ""

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c6c5dd44" = "V/////%%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"d1abcdb6" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"d94388d2" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"e8f9dcc7" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"data.1" = "wnzCWolhx2oFZabcdeYy7dJ6BdqphW7RxT5 fIGyMZ4I52T6DiWjEYWtde4imrJSxBKVNzMKH wrBb4FnH IKzMO 7V9bEjpCwP/TD9xfl6DZhf/sDcdESEtvyIcetXHx0g88C6p8rIJS/C84lNwaHaErxyN0Sh U"
"data.0" = "JkN022REkM1M8WdefAaPrQn/tGxT1ZkhrLqsArZr3VW1DLU5PZ4OT7sPpAdTmQj1pqI9UOj9F8kYHbRxpH9VjXuAB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"f1f24e29" = "Vl/l/C/////%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Publisher" = "Super PC Tools ltd"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"27ddcf6f" = "///%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c24899a6" = "VP/g/CV/Vl/1/CF////%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a1dcff5b" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"MinorVersion" = "2"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"51d2f2ea" = "JlA /Y//GPAf/D6/b/Ah/Xt/aPAp/Yq/GPAf/B//JlAh/XD/c/Ag/B//VP/j/Cx/V//j/CZ/V//h/CD////%"
"060df2cd" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAp/YP/UxAs/X6/aP////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"URLInfoAbout" = "http://www.superpctools.com/"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"1520c6f1" = "V/////%%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"d94388d2" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: User" = "%CurrentUserName%"
"UninstallString" = "%Program Files%\Super Optimizer\unins000.exe"
"Inno Setup: Language" = "en"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"bbf88800" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"340d3099" = "/P////%%"
"060df2cd" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAp/YP/UxAs/X6/aP////%%"
"2e22d94e" = "///%"
"c99a5f5c" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_f4b8651c\eae10f9d]
"340d3099" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"e8f9dcc7" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"InstallLocation" = "%Program Files%\Super Optimizer\"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f0bf0bde" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"72758a5d" = "///%"
"8b9e4cbc" = "V/////%%"

[HKCU\Software\Super Optimizer]
"AdsDownloadURL" = "http://dl.superpcdownload.net/221001894/SuperUpdaterSetup.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"d1abcdb6" = "///%"

"27ddcf6f" = "///%"

[HKCU\Software\Super Optimizer]
"DelayedStart" = "5"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f6ad6fa6" = "V/////%%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"usr.1" = "3jYmlYhabcdefABCDW"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"date" = "1430465977"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a0743acc" = "N/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"8b9e4cbc" = "V/////%%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"fe94ce1e" = "V/////%%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"Mode" = "4026531840"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7f69fa1f" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"Mode" = "4026531840"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\00000000]
"493c7345" = "mU1P0700px1M06E0m01O06h0nx1D07C0px1M07b0al1D06I0pl1T00%%, mU1P0700px1M06E0m01O06h0nx1D07C0px1M07x0ox1Z06t0al1S06t0i00%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"date" = "1430465977"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"2d71d5ab" = "V/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a0743acc" = "N/////%%"

[HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}]
"n" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svn" = "SuperOptimizer Stats"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"0dc3ee96" = "/P////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"Mode" = "4026531840"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"dbaf3ce3" = "/P////%%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"2d71d5ab" = "V/////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"3efeb33e" = ""

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svx" = ""

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"State" = "0"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"f0bf0bde" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"usr.1" = "3jYmlYhabcdefABCDW"
"usr.0" = "B 6yuH456789/XZTVN"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svt" = "1430473178"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"a1dcff5b" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svpath" = "c:\Program Files\Super Optimizer\SupOptStats.dll"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420\eae10f9d]
"e46c271e" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7367429f" = "///%"

[HKLM\SOFTWARE\103881e1-8402-35d1-63c9-28de20333306\10162061603631420]
"svx" = ""

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"bbf88800" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"data.0" = "JkN022REkM1M8WdefAaPrQn/tGxT1ZkhrLqsArZr3VW1DLU5PZ4OT7sPpAdTmQj1pqI9UOj9F8kYHbRxpH9VjXuAB"
"data.1" = "wnzCWolhx2oFZabcdeYy7dJ6BdqphW7RxT5 fIGyMZ4I52T6DiWjEYWtde4imrJSxBKVNzMKH wrBb4FnH IKzMO 7V9bEjpCwP/TD9xfl6DZhf/sDcdESEtvyIcetXHx0g88C6p8rIJS/C84lNwaHaErxyN0Sh U"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"date" = "1430465977"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"3c09c42b" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"LRTS" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Super Optimizer" = "%Program Files%\Super Optimizer\SupOptLauncher.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1136 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Super Optimizer]
"setupname" = "c:\%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 AB 5B 06 CA AE B5 E4 0D 09 9C D0 AD 25 29 0E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process supoptsetup.exe:284 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 87 83 38 50 B6 74 18 11 86 FF AD C5 A3 33 B1"

Dropped PE files

MD5 File path
88fbeb785cc9a761b40739243caa826f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\supoptsetup.exe
2fd2f24c7d7351a82f94e8fbc5f5dcf1 c:\Program Files\Super Optimizer\SupOptGuard.exe
48b844f844bcf1efcf0cb0d065249b8a c:\Program Files\Super Optimizer\SupOptHelper.dll
814a3c02de0f1763d7c1eb119f8a8f16 c:\Program Files\Super Optimizer\SupOptLauncher.exe
829cb734df259e9ce0bbe08599ea6a57 c:\Program Files\Super Optimizer\SupOptReminder.exe
511174a2cbfdb1320ea6e7a88a9dd532 c:\Program Files\Super Optimizer\SupOptSchedule.exe
d5cd5724f6bf42780af6fc25b677e296 c:\Program Files\Super Optimizer\SupOptSmartScan.exe
3a3ed0f505ea60641f87e8f2e6f5ce70 c:\Program Files\Super Optimizer\SupOptStart.exe
45041aaaccae7d3a5fb880d18b40336b c:\Program Files\Super Optimizer\SupOptStats.dll
5c7964d540db7b5d317ac0b6a5a87eb1 c:\Program Files\Super Optimizer\SupOptUninstaller.exe
8feabb97c1f115894bbbcf25b77139ad c:\Program Files\Super Optimizer\SuperOptimizer.exe
0f66e8e2340569fb17e774dac2010e31 c:\Program Files\Super Optimizer\sqlite3.dll
8e63df6945b0a57ae63af6e5088e8839 c:\Program Files\Super Optimizer\unins000.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Super PC Tools Ltd
Product Name: Super Optimizer v3.2
Product Version: 3.2.0.0
Legal Copyright: Super PC Tools Ltd
Legal Trademarks:
Original Filename: Super Optimizer
Internal Name: Super Optimizer
File Version: 3.2.0.0
File Description: Fix PC problems and optimize performance
Comments:
Language: English (Canada)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 147037 147456 4.5602 70233bc84a84b26db7d360ca1c45838f
.rdata 151552 31986 32256 3.33653 a81f51068b8d5f65e3db4685ba29be09
.data 184320 19428 7680 2.49007 92acd8add637b0cf82bb1012568e6f40
.rsrc 204800 6146336 6146560 5.52527 1ac4624958d5060b4c87962eb2be7d22
.reloc 6352896 26108 26112 1.91461 c5337aa69107306a56d0bc98d894f698

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://isuperopt.com/inst?hid=28cf1818c556ef78138876c88b33270aa8f8a0af&sid=A3FB173B-6644-44E1-8860-7132BFE9D31F&tr=211001894-CA-204&a=NA&adm=1&os=5.1&x64=0&sil=1&st=201504072&e=200 104.28.19.88
hxxp://isuperopt.com/inst?sid=A3FB173B-6644-44E1-8860-7132BFE9D31F&st=0&e=210 104.28.19.88
hxxp://superoptimizeit.com/install/ 54.213.23.40
hxxp://www-bbc-com.bbc.net.uk/
hxxp://superoptimizeit.com/get/?q=ipXF6IhAyZ3xSHoSUMeDiFTAVUBWWqOY206szNzfvyS4yL+FC9Qmxz47VY92zH7fhU6MnstRyAgMbdJNu9LadF9yEjF9N2v/Y1vMq4uG2Ex5YLxfv2FOVJ4OP9jng1PWsMzu1KO5twquiQLmZKIINj/Lxtwr5PmarGfTvHKIW8Mcv820IiwN2lajTK+8HOfSTR99+xoQNgsZbWogSvPg6DeCZDGJp3PZlbv+49mkeN7I0q52Swf5qKaE71rF/xYfW3ScBoe3fM/yhL5naYCq75+Gz7m2G98Zkala1e8Rf9j0tK1MBss+P/I4IaW4W0oKcpdi9ffIw2FuVyVU3qUSa4dr10UGN37JJ/IFHAHjSyRdQcdfBOyZWjwNtGUVaNHsvL3hDFbKD+D7PhTeVNKJcoG4mk/osTsHicr9Gcf+/OOuwsiw9ihovesE7N0b1O92DSRhGxUeVHnW26WVdMC+Zqzyi8ue0n3BWNWNkiyDQ8WBQJHCt9DId2a1hLKynkroqffZPXL1ACdAzSuETC5VDOuKjV16r73PFSW8u3ctSBtfC+H7kwg2my4DswKiJXkq1nEkH+stXn/MlBQqEORLvV3PrhZyuzBYTZo3gOIbRUvz3XlSNEiwZu2p3BtWueZKWAJkAl1DYxvxeAEBCnngZOiLDk/Fpikg 54.213.23.40
hxxp://isuperopt.com/inst?sid=A3FB173B-6644-44E1-8860-7132BFE9D31F&st=0&du=35437&e=400 104.28.19.88
hxxp://www.bbc.com/ 212.58.244.69
bi.superpcdownload.net


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN W32/SpeedingUpMyPC.Rootkit Install CnC Beacon
ET USER_AGENTS Suspicious Win32 User Agent
ET TROJAN W32/SpeedingUpMyPC.Rootkit CnC Beacon

Traffic

HEAD / HTTP/1.1
Host: VVV.bbc.com
Connection: close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)


HTTP/1.1 200 OK
Server: Apache
X-Cache-Action: HIT
X-Cache-Hits: 1
Vary: X-CDN
Cache-Control: private, max-age=60
X-Cache-Age: 38
Content-Type: text/html
Date: Fri, 01 May 2015 09:39:37 GMT
Expires: Fri, 01 May 2015 09:39:59 GMT
Content-Language: en
Etag: "85478d6931ce1dcde64fe24f342ce15f"
X-LB-NoCache: true
X-PAL-Host: pal133.back.live.telhc.local:80
Connection: close
Set-Cookie: BBC-UID=55a564b354b9cdb9ccddaf634128c03e4c72eec9378404067a3047225ed6d3480Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1); expires=Tue, 30-Apr-19 09:39:37 GMT; path=/; domain=.bbc.com
Content-Length: 116986



GET /get/?q=ipXF6IhAyZ3xSHoSUMeDiFTAVUBWWqOY206szNzfvyS4yL+FC9Qmxz47VY92zH7fhU6MnstRyAgMbdJNu9LadF9yEjF9N2v/Y1vMq4uG2Ex5YLxfv2FOVJ4OP9jng1PWsMzu1KO5twquiQLmZKIINj/Lxtwr5PmarGfTvHKIW8Mcv820IiwN2lajTK+8HOfSTR99+xoQNgsZbWogSvPg6DeCZDGJp3PZlbv+49mkeN7I0q52Swf5qKaE71rF/xYfW3ScBoe3fM/yhL5naYCq75+Gz7m2G98Zkala1e8Rf9j0tK1MBss+P/I4IaW4W0oKcpdi9ffIw2FuVyVU3qUSa4dr10UGN37JJ/IFHAHjSyRdQcdfBOyZWjwNtGUVaNHsvL3hDFbKD+D7PhTeVNKJcoG4mk/osTsHicr9Gcf+/OOuwsiw9ihovesE7N0b1O92DSRhGxUeVHnW26WVdMC+Zqzyi8ue0n3BWNWNkiyDQ8WBQJHCt9DId2a1hLKynkroqffZPXL1ACdAzSuETC5VDOuKjV16r73PFSW8u3ctSBtfC+H7kwg2my4DswKiJXkq1nEkH+stXn/MlBQqEORLvV3PrhZyuzBYTZo3gOIbRUvz3XlSNEiwZu2p3BtWueZKWAJkAl1DYxvxeAEBCnngZOiLDk/Fpikg HTTP/1.1
Accept: */*
User-Agent: win32
Host: superoptimizeit.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: ngx_openresty
Date: Fri, 01 May 2015 09:40:03 GMT
Content-Length: 0
Connection: close



GET /inst?hid=28cf1818c556ef78138876c88b33270aa8f8a0af&sid=A3FB173B-6644-44E1-8860-7132BFE9D31F&tr=211001894-CA-204&a=NA&adm=1&os=5.1&x64=0&sil=1&st=201504072&e=200 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: isuperopt.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 01 May 2015 09:39:22 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: __cfduid=dcd180fa77177cb3f23025a7ccbfefbbb1430473162; expires=Sat, 30-Apr-16 09:39:22 GMT; path=/; domain=.isuperopt.com; HttpOnly
Server: cloudflare-nginx
CF-RAY: 1dfa84ce923f0af6-WAW
HTTP/1.1 200 OK..Date: Fri, 01 May 2015 09:39:22 GMT..Content-Type: te
xt/plain..Content-Length: 0..Connection: keep-alive..Set-Cookie: __cfd
uid=dcd180fa77177cb3f23025a7ccbfefbbb1430473162; expires=Sat, 30-Apr-1
6 09:39:22 GMT; path=/; domain=.isuperopt.com; HttpOnly..Server: cloud
flare-nginx..CF-RAY: 1dfa84ce923f0af6-WAW......


GET /inst?sid=A3FB173B-6644-44E1-8860-7132BFE9D31F&st=0&e=210 HTTP/1.1


Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: isuperopt.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 01 May 2015 09:39:22 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: __cfduid=dcd180fa77177cb3f23025a7ccbfefbbb1430473162; expires=Sat, 30-Apr-16 09:39:22 GMT; path=/; domain=.isuperopt.com; HttpOnly
Server: cloudflare-nginx
CF-RAY: 1dfa84d1b2f40af6-WAW
HTTP/1.1 200 OK..Date: Fri, 01 May 2015 09:39:22 GMT..Content-Type: te
xt/plain..Content-Length: 0..Connection: keep-alive..Set-Cookie: __cfd
uid=dcd180fa77177cb3f23025a7ccbfefbbb1430473162; expires=Sat, 30-Apr-1
6 09:39:22 GMT; path=/; domain=.isuperopt.com; HttpOnly..Server: cloud
flare-nginx..CF-RAY: 1dfa84d1b2f40af6-WAW......


GET /inst?sid=A3FB173B-6644-44E1-8860-7132BFE9D31F&st=0&du=35437&e=400 HTTP/1.1


Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: isuperopt.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Fri, 01 May 2015 09:39:57 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: __cfduid=d3fe52b81c2a0f561215dd005027b82a11430473196; expires=Sat, 30-Apr-16 09:39:56 GMT; path=/; domain=.isuperopt.com; HttpOnly
Server: cloudflare-nginx
CF-RAY: 1dfa85a903c50af6-WAW
HTTP/1.1 200 OK..Date: Fri, 01 May 2015 09:39:57 GMT..Content-Type: te
xt/plain..Content-Length: 0..Connection: keep-alive..Set-Cookie: __cfd
uid=d3fe52b81c2a0f561215dd005027b82a11430473196; expires=Sat, 30-Apr-1
6 09:39:56 GMT; path=/; domain=.isuperopt.com; HttpOnly..Server: cloud
flare-nginx..CF-RAY: 1dfa85a903c50af6-WAW..



POST /install/ HTTP/1.1
Host: superoptimizeit.com
Connection: close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Content-Length: 592
Content-Type: application/x-www-form-urlencoded

q=VtRrn1FpAXRhzabcdeGmzvEzoCY9WqSt+quczo57LOkRcQWELRXkLtjisLqK+/f+ID0xXI6AgVT9Rz2ZbhzIXe8oaEXF5qVp0WvPb7Xgvoi7asJuPgF7nbuMs7nt2V2hdMBJyKIolmdfpwR0X6w8jzVbWz33hYYn+u3ms+Sl2vXjQKkKBb/k/Bvo4GjHnVSNCIx9oH9XiwTStwPLBiTyNyYVzDibm6VadTE6S9qqT7fq6DEJkbaG7o4X0cxpRr2m3HCKEXaL6WMcNhkOVaPGcS6vlB1Xjo68ekpvmx/O2NSkZ9tg7o+/OSFWW47Ns7uZ1lEsUah9/by5HhGOmReq+pbkfxlj6sGA3q1+CV+DetAux4WG31SMlrYUXs+SBsxcfXX77tCtLI76OGI+LN5yUYACA1aWLCO38fbOnRQl8rihUldwlQsvG9JPL6weMaV4gG34F5TS3HWdPWO1bQTOGrWLDmGTgyZQ33tj/Lpe3HWdWv1Md9QYYUmuxHF8MDt2Zi58P2l7cyNPGYaCj3mmhw1+1IfdEnetVg7JuX3RV/DKfcCJfIynI7

HTTP/1.1 200 OK
Server: ngx_openresty
Date: Fri, 01 May 2015 09:39:45 GMT
Content-Type: application/json; charset=UTF-8
Content-Length: 2
Connection: close
{}..







The Trojan connects to the servers at the folowing location(s):







rundll32.exe_972:




.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
GDI32.dll
USER32.dll
IMAGEHLP.dll
rundll32.pdb
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
.manifest
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
Windows
Operating System
5.1.2600.5512
YThere is not enough memory to run the file %s.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Missing entry:%s
Error loading %s

rundll32.exe_972_rwx_10021000_00020000:




.fffff.
.gTu4

SupOptStart.exe_596:




.idata
.rdata
P.reloc
P.rsrc
kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
EInvalidGraphicOperation
USER32.DLL
comctl32.dll
uxtheme.dll
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeyword
crSQLWait
%s (%s)
Uh#%C
imm32.dll
AutoHotkeys
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState
OnKeyDown$
OnKeyPress
OnKeyUp
tagMSG
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
127.0.0.1
TIdSocketListWindows
TIdStackWindowsU
IdStackWindows
%s, %.2d %s %.4d %s %s
%s, %d %s %d %s %s
password
Password
IdHTTPHeaderInfo
ProxyPassword<
ProxyPort
Mozilla/3.0 (compatible; Indy Library)
ftpTransfer
ftpReady
ftpAborted
ClientPortMin<
ClientPortMax
Port
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
libeay32.dll
ssleay32.dll
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_get_peer_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
X509_STORE_CTX_get_current_cert
des_set_key
saUsernamePassword
Password<
0.0.0.1
TIdTCPConnection
IdTCPConnection
EIdTCPConnectionError
Uh;%F
sslvrfFailIfNoPeerCert
TPasswordEvent
Certificate
RootCertFile
CertFile
KeyFile
OnGetPasswordd;F
EIdOSSLLoadingRootCertError
EIdOSSLLoadingCertError
EIdOSSLLoadingKeyError
TIdTCPClient
TIdTCPClient|cF
IdTCPClient
BoundPort
PortU
CommentURL
TIdHTTPMethod
IdHTTP
TIdHTTPOption
TIdHTTPOptions
TIdHTTPProtocolVersion
IdHTTP(
TIdHTTPOnHeadersAvailable
TIdHTTPOnRedirectEvent
TIdHTTPResponse
TIdHTTPResponse\
TIdHTTPRequest
TIdHTTPProtocol(
TIdCustomHTTP
TIdCustomHTTP(
TIdHTTP
TIdHTTPX
HTTPOptions$
EIdHTTPProtocolException
HTTPS
https
This request method is supported in HTTP 1.1
HTTP/1.0 200 OK
HTTP/
OnActionExecute
%s, ClassID: %s
ole32.dll
hXXp://gen.securedshopgate.com/?b=21
superupdater.exe
Super Updater\SuperUpdater.exe
hXXp://VVV.superpctools.com
UninstallURL
AdsDownloadURL
HomePageURL
SupportURL
BuyNowURL
AdsBuyNowURL
WelcomeURL
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1
?456789:;<=
!"#$%&'()* ,-./0123
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
RegFlushKey
RegCreateKeyExA
GetCPInfo
version.dll
gdi32.dll
SetViewportOrgEx
UnhookWindowsHookEx
SetWindowsHookExA
MsgWaitForMultipleObjects
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
shell32.dll
ShellExecuteA
wininet.dll
6!606@6`6
<5=9=\=`=
0 0$0(0,0
7"7&7*7.72767
8,9094989
7 7$7(7,70747
6"616;6@6{6
55v5
1C2i2x2w3%4U4d4
5%5S5{5
5 5$5(5,5054585<5\5|5
6 636\6`6
<*</<><|<
= =$=(=,=0=4=
|||%UUU
|||'}}};
4|||){{{
|||%}}}=
kzzz.yyy
d|||ÿf
|||#}}}1|||@
|||'}}}9
|||)}}}=
|||D|||%xxx
|||!}}}=
|||%}}}3
|||!}}}-
6}}} {{{
"|||#{{{
|||%}}}/
|||#}}} 
|||#|||)}}}/
5}}}/|||)
,}}}-}}}-}}}-}}}-}}}-}}}-
$|||!{{{
|||!|||'
,}}}/}}}/}}}/}}}/
,|||'|||!
/|||'{{{
.xxx${{{
9}}} {{{
|||%}}}5
5|||%uuu
|||#}}}3
|||'{{{:
|||)}}}?
|||'}}}=
|||'{{{>
|||)|||@
Z}}};|||%sss
.zzzE
|||'}}}?
[}}}1{{{
|||!}}} }}}5
(}}}3}}}=
$|||%yyy&yyy&uuu%xxx"www
0{{{8}}}?
|||!|||%|||)}}}/
,}}}1{{{6
9}}}5}}}1
,|||'|||#{{{
.yyy*|||'|||#xxx rrr
|||!|||#
&|||#|||!
*}}} }}}-}}}/}}}/
2}}}3}}}3}}}3}}}3}}}3}}}3
0}}}/}}}/}}}-}}} 
(|||'|||%xxx"|||!{{{
|||!|||%
(|||%|||!{{{
4}}}7{{{6}}}5}}}5
|||#|||)
(|||#{{{
,|||%{{{
|||!|||)
*|||#{{{
/|||%{{{
3|||){{{
5|||){{{
6|||){{{
"|||#|||!
4|||'{{{
1|||%{{{
2|||%{{{
5|||'{{{
7|||'{{{
:|||){{{
|||){{{4
.|||'|||!{{{
 |||%{{{
/|||)|||#{{{
 zzz.xxx3
*|||)|||'|||%|||!{{{
6|||'|||!{{{
|||!|||%|||)
|||#|||'
(|||%|||#
"|||#|||#
$|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%
$|||#|||#
KWindows
UrlMon
0IdHTTPHeaderInfo
 IdTCPServer
IdTCPStream
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
Icon.Data
Could not load certificate.#Could not load key, check password.
SSL status: "%s"
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Command not supported.
Address type not supported.$Error accepting connection with SSL.
Error creating SSL context. Could not load root certificate.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
Chunk StartedDThis authentication method is already registered with class name %s.
%s is not a valid service.
Socket Error # %d
%s is not a valid IP address.
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
Max line length exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
No help keyword specified.
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.
File "%s" not found1Only one TIdAntiFreeze can exist per application."%d: Circular links are not allowed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form
Unsupported clipboard format
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
Ancestor for '%s' not found
Cannot assign a %s to a %s
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
I/O error %d
Integer overflow Invalid floating point operation
3.2.0.0






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    rundll32.exe:1512
    supoptsetup.tmp:860
    %original file name%.exe:1136
    supoptsetup.exe:284
    

    2. 

  2. Delete the original Trojan file.
    3. 

  3. Delete or disinfect the following files created/modified by the Trojan:
    

    %Program Files%\Super Optimizer\is-98KI8.tmp (7726 bytes)
    %Program Files%\Super Optimizer\is-LBR8R.tmp (11 bytes)
    %Program Files%\Super Optimizer\is-3K119.tmp (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-73IHD.tmp\SupOptHelper.dll (7971 bytes)
    %Program Files%\Super Optimizer\is-J9KPU.tmp (601 bytes)
    %Program Files%\Super Optimizer\is-OSB1K.tmp (127 bytes)
    %Program Files%\Super Optimizer\is-8TFGT.tmp (7345 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Super Optimizer.lnk (773 bytes)
    %Program Files%\Super Optimizer\is-6USPS.tmp (3073 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-73IHD.tmp\_isetup\_shfoldr.dll (23 bytes)
    %Program Files%\Super Optimizer\is-1OL4K.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-73IHD.tmp\SupOptStats.dll (15506 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Super Optimizer on the Web.lnk (743 bytes)
    %Program Files%\Super Optimizer\unins000.dat (15297 bytes)
    %Program Files%\Super Optimizer\SupOptStats.dll (133377 bytes)
    %Program Files%\Super Optimizer\is-RHLAS.tmp (7433 bytes)
    %Program Files%\Super Optimizer\is-7KE0J.tmp (909 bytes)
    %Program Files%\Super Optimizer\unins000.msg (646 bytes)
    %Program Files%\Super Optimizer\is-BQ8G8.tmp (32242 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Uninstall Super Optimizer.lnk (769 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Check updates.lnk (801 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Help.lnk (773 bytes)
    %Program Files%\Super Optimizer\is-5PP5K.tmp (30 bytes)
    %Program Files%\Super Optimizer\is-1U2EK.tmp (712 bytes)
    %Program Files%\Super Optimizer\is-FDNN4.tmp (7971 bytes)
    %Program Files%\Super Optimizer\is-VS9VG.tmp (33652 bytes)
    %Program Files%\Super Optimizer\is-KR9M8.tmp (7345 bytes)
    %Documents and Settings%\%current user%\Desktop\Super Optimizer.lnk (761 bytes)
    %Program Files%\Super Optimizer\is-B2DOD.tmp (6841 bytes)
    %Program Files%\Super Optimizer\is-INSHL.tmp (6841 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\All Users\Application Data\{2ae2ad5d-5db4-0430-2ae2-2ad5d5dbb575}\hqghumeaylnlf.dat (962 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ZH0F69IG\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (270 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0JOQR15G\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\supoptsetup.exe (776878 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MGJC8WKP\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\NTUSER.DAT (6588 bytes)
    %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (660 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (776 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\Startup\hqghumeaylnlf.lnk (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6T81M5M4\desktop.ini (67 bytes)
    %Documents and Settings%\All Users\Application Data\{2ae2ad5d-5db4-0430-2ae2-2ad5d5dbb575}\hqghumeaylnlf.exe (201856 bytes)
    %Documents and Settings%\%current user%\NTUSER.DAT.LOG (6640 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\is-GEVMV.tmp\supoptsetup.tmp (7386 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Super Optimizer" = "%Program Files%\Super Optimizer\SupOptLauncher.exe"
    

    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now