Trojan.Generic.12220278_b14471f648

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

ASO3.exe:340
CheckUpdate.exe:516
schtasks.exe:1128
schtasks.exe:1364
regedit.exe:264
%original file name%.exe:228

The Trojan injects its code into the following process(es):

ASO3portable.exe:644

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexShimCacheMutex

File activity

The process ASO3.exe:340 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GDE3MT21\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CRMNWZYD\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GLSHOFWZ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMRY1S9\desktop.ini (67 bytes)

The process CheckUpdate.exe:516 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Systweak\ASO3\Checking for Updates\AppUpdates\LatestVersion.htm (832 bytes)

The process %original file name%.exe:228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Common Files\Advanced System Optimizer\App\SecureDelete.exe (10347 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\Report_header_leftText.jpg (14 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DiskOptimizer.exe (848 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Xceed.FileSystem.dll (584 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Microsoft.VC90.ATL.manifest (353 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\clamunpack\clamscan.exe (15 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\info.ico (1 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\RegClean.exe (11276 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\BackupManager.exe (18844 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\SystemProtector.XmlSerializers.dll (45 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\MFC90ENU.dll (754 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DiskExplorer.exe (9732 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\sqlite3.dll (6101 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\ASOHelper.dll (8600 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\GOHelper.exe (37 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\driveropt.ini (70 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Xceed.Zip.dll (1430 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\extract\copying.txt (26 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\HookDll64.dll (395 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\VolumeControl64.exe (515 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\regclean.ini (82 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\RegistryOptimizer.exe (3599 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\sysfilebackres.ini (23 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\regopt.ini (12 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\extract\7z.exe (267 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\vista\DriverRestore.manifest (682 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\amd64Helper\DriverUpdateHelper64.manifest (689 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\Report_header_top_middle.jpg (7 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\win7i386\DriverRestore.exe (84 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\startupman.ini (10 bytes)
%Program Files%\Common Files\Advanced System Optimizer\Portable1.reg (11 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\ScanDll.dll (64 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\amd64\DriverRestore.exe (1635 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\website.ico (1 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\secencrypt.ini (26 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\aso.ini (135 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\PTBWin7.exe (20 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\AsInvoker.exe (64 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\aspcomm.dll (2741 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\right_border.jpg (11 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\footer_middle.jpg (7 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\extract\readme.txt (1 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\asodemo.exe (6577 bytes)
%Program Files%\Common Files\Advanced System Optimizer\Delete1.reg (11 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\HookDll.dll (56 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Microsoft.VC90.MFCLOC.manifest (670 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\RequireAdministrator.exe (1846 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\BeforeUninstall.exe (13907 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\undelete.ini (28 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DriverUpdater.exe (8022 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\win7amd64\DriverRestore.manifest (682 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\aso3sys.dll (6771 bytes)
%Program Files%\Common Files\Advanced System Optimizer\Delete.reg (5 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\securedelete.ini (39 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\SevenZipSharp.dll (1223 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\clamunpack\readme.txt (535 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\ASEng.dll (1678 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\diskdoc.ini (32 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\atl90.dll (1395 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Advanced System Optimizer Help.url (432 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\SystemCleaner.exe (17655 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\PrivacyProtector.exe (12628 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\vista\DriverRestore.exe (722 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DiskDoctor.exe (3123 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\GameOptLauncher64.exe (2512 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\XceedZip.dll (1468 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\xmllite.dll (861 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\Report_header_left_image.jpg (11 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\launcher.exe (47 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\backupman.ini (78 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\memopt.ini (12 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\win7i386\DriverRestore.manifest (682 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\aspsys.dll (1708 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\MemoryOptimizer.exe (2376 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\difxapi64.dll (4584 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\mfc90u.dll (34642 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\DiskOpt.ini (19 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\UndeleteDLL.dll (1415 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\HighestAvailable.exe (753 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\SystemProtector.exe (38774 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\AppResource.dll (17986 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\VolumeControl.exe (49 bytes)
%Program Files%\Common Files\Advanced System Optimizer\ASO3portable.exe (697 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\asplangs\categories.ini (42 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\ASO3DefragSrv64.exe (2241 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\database.dat (32 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\ASO3DefragSrv.exe (3340 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\ASO3.exe (27333 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\sysadvisor.ini (104 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\GameOptLauncher.exe (1922 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\newscheduler.ini (8 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\extract\license.txt (2 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\msvcp90.dll (7063 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\checkupdate.ini (12 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Systweak Software Website.url (245 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\single_click_care.ico (15 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\gameopt.ini (8 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\clamunpack\libclamav.dll (5447 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Microsoft.VC90.MFC.manifest (349 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Undelete.exe (2603 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\NewScheduler.exe (7142 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Interop.IWshRuntimeLibrary.dll (49 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\KillASOProcesses.exe (227 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\diskexplorer.ini (21 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\client.ini (65 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DefragServiceManager.exe (71 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\amd64\DriverRestore.manifest (682 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\difxapi.dll (3413 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\PCFixer.exe (6753 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Microsoft.Win32.TaskScheduler.dll (1929 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\pcfixer.ini (24 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\asores.dll (65453 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\sysclean.ini (52 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\xp\DriverRestore.exe (62 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\win7amd64\DriverRestore.exe (917 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\msvcr90.dll (3847 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\asplangs\eng_asp_en.ini (101 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Xceed.Compression.dll (552 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\dupfileremover.ini (28 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\rw.dat (7386 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\GameOptimizer.exe (1948 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Downloader.dll (1425 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\SystemProtector.exe.config (4 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\System.Data.SQLite.dll (6225 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\SecureShell.dll (5525 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\extract\7z.dll (8067 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Network.dll (4748 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Buy Advanced System Optimizer.url (331 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\footer_right.jpg (11 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\categories.ini (42 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\line3px_Blue.jpg (11 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\CheckUpdate.exe (27994 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\Report_header_top_right.jpg (12 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\StartupManager.exe (1706 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\SysFileBakRes.exe (4335 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\UninstallManager.ini (5 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\unrar.dll (1349 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Help.ico (1 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\SecureEncryptor.exe (1854 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\extract\History.txt (29 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\System.Core.dll (8923 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\zlibwapi.dll (319 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\rw.ini (54 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Microsoft.VC90.CRT.manifest (391 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DuplicateFilesRemover.exe (460 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\updater\amd64Helper\DriverUpdateHelper64.exe (2221 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\asohtm.dll (3901 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Xceed.Compression.Formats.dll (1916 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\eng\privprotector.ini (44 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\footer_left.jpg (11 bytes)
%Program Files%\Common Files\Advanced System Optimizer\Portable.reg (14 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\left_border.jpg (11 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\UninstallManager.exe (692 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\Order.ico (1 bytes)
%Program Files%\Common Files\Advanced System Optimizer\App\SystemAnalyzerAndAdvisor.exe (5321 bytes)

Registry activity

The process ASO3.exe:340 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Licenses]
"{K7C0DB872A3F777C0}" = "41 22 6C 8B E1 16 1F 05 48 6E 02 90 27 91 BF 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Systweak\ASO3]
"MachineHashID" = "768429272046948335"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Licenses]
"{0F8356A249F37E323}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 DA A5 44 A3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{B0F3F4F9-CB76-9A52-9442-B481A5FF49D3}\InProcServer32]
"(Default)" = "%Program Files%\NetMeeting\nac.dll"

[HKCU\Software\systweak\ASO3]
"SecEncryptAppName" = "Mã hóa an toàn"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\systweak\ASO3]
"KeyExpired" = "0"
"SecDelAppName" = "Xóa vĩnh viễn"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"schtasks.exe" = "Schedule Tasks"

[HKCR\CLSID\{B0F3F4F9-CB76-9A52-9442-B481A5FF49D3}]
"(Default)" = "Microsoft NetMeeting Quality of Service"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Common Files\Advanced System Optimizer\App]
"CheckUpdate.exe" = "Advanced System Optimizer - Checking for Updates"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 55 91 60 C3 BB 91 9E 24 45 39 FA 4A F1 6E 23"

[HKCU\Software\Licenses]
"{R7C0DB872A3F777C0}" = "4A 8D 7D 4C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Systweak\ASO3]
"KeyExpired" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Licenses]
"{IF8356A249F37E323}" = "01 00 00 00"

[HKCR\CLSID\{B0F3F4F9-CB76-9A52-9442-B481A5FF49D3}\InProcServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Systweak\ASO3]
"REGISTEREDVERFOUNINSTALL" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"ProxyServer"
"AutoConfigURL"

[HKCR\CLSID\{B0F3F4F9-CB76-9A52-9442-B481A5FF49D3}]
"0"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Advanced System Optimizer"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced System Optimizer"

The process CheckUpdate.exe:516 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Systweak\ASO3]
"MachineHashID" = "768429272046948335"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Licenses]
"{0F8356A249F37E323}" = "5B 3E 96 0F EF 81 A3 86 00 6A 3D BA 69 DA 2F C9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\systweak\ASO3]
"SecEncryptAppName" = "Mã hóa an toàn"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\systweak\ASO3]
"CFUHWND" = "FC 01 03 00"
"KeyExpired" = "0"
"SecDelAppName" = "Xóa vĩnh viễn"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C 0B 42 80 0B 17 FB 22 77 AE 89 CC 6E 8C F5 64"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Systweak\ASO3]
"KeyExpired" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Licenses]
"{IF8356A249F37E323}" = "1B 00 00 00"

[HKLM\SOFTWARE\Systweak\ASO3]
"REGISTEREDVERFOUNINSTALL" = "1"
"G_SUPPORT_PHONE_NUM" = "(855) 716-7030"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKCU\Software\systweak\ASO3]
"CFUHWND"

The process schtasks.exe:1128 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B 20 2A F0 71 EC 0E BC C1 85 96 A5 88 8A 99 63"

The process schtasks.exe:1364 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 0D D1 45 03 54 CC 35 07 E7 BE 2E F4 A9 5C B6"

The process regedit.exe:264 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"jfThumbnail" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section1]
"ie8_AddBarHistory" = "1"

[HKCU\Software\systweak\ASO3\Advanced System Optimizer\OneClick]
"chkDiskDefrag" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section3]
"winsys_dnscache" = "0"

[HKCU\Software\systweak\ASO3\LANG]
"LangID" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_adobephotoshopcss" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"iMychavoihis" = "0"

[HKCU\Software\systweak\ASO3\Advanced System Optimizer]
"FirstRunASO" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"winsys_startmenushortcuts" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_winrar" = "1"
"app_prg_regedit" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"ie8_HistoryVS" = "1"
"app_prg_mssearch" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section3]
"winsys_windowslogfiles" = "1"
"winsys_desktopshortcuts" = "0"

[HKCU\Software\systweak\ASO3\ScanStatusForLauncher\SysFileBackup]
"ErrorCount" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"jfReportLogFile" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_windowsmediaplayer" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section2]
"jfdotnet" = "1"
"jfdownloadprgfile" = "0"

[HKCU\Software\systweak\ASO3\Advanced System Optimizer\OneClick]
"chkDriverupdater" = "1"

[HKCU\Software\systweak\ASO3]
"KeyExpired" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"jfbackupcopiewin" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section2]
"jfReportLogFile" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_skype" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section1]
"googlechrome_VisitedLinks" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"mso2013MS_Excel" = "1"

[HKCU\Software\systweak\ASO3]
"cname" = "systweak"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"winsys_otherexplorermrus" = "1"

[HKCU\Software\systweak\ASO3\Scheduler\OneClick]
"chkPrivacyProtector" = "1"

[HKCU\Software\systweak\ASO3]
"SecEncryptAppName" = "Mã hóa an toàn"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"ie8_TempIntFileFolder" = "1"

[HKCU\Software\systweak\ASO3\Scheduler\OneClick]
"chkJunkFileCleaner" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"jfTempFile" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section2]
"jfbackupcopiewin" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section3]
"winsys_startmenushortcuts" = "0"
"winsys_searchautocomplete" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_mssearch" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section1]
"ie8_TempIntFileFolder" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"jfoldprefach" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"iMychavoihis" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"mso2013MS_Excel" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"mso2013MS_RecentFolder" = "1"

[HKCU\Software\systweak\ASO3]
"ASO3AFFILIATE" = ""

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"ie8_AddBarHistory" = "1"

[HKCU\Software\systweak\ASO3\Scheduler\OneClick]
"chkRegClean" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"winsys_chkdskfilefragments" = "1"

[HKCU\Software\systweak\ASO3\Advanced System Optimizer\OneClick]
"chkAntispyware" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"winsys_winerrorreporting" = "0"
"winsys_desktopshortcuts" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section3]
"winsys_networkpasswords" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions]
"StartAppli_FirstTime" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_remotedesktop" = "1"

[HKCU\Software\systweak\ASO3\Scheduler\OneClick]
"chkDiskDefrag" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_msmanagementconsole" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section3]
"winsys_chkdskfilefragments" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"mso2013MS_PowerPoint" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section1]
"ie8_HistoryVS" = "1"

[HKCU\Software\systweak\ASO3]
"RegisteredUser" = ""

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_windowsdefender" = "1"

[HKCU\Software\systweak\ASO3]
"InstalledPath" = "%Program Files%\Advanced System Optimizer 3"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_remotedesktop" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_gameexplorer" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section1]
"ie8_Cookies" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_windowsmediacenter" = "1"
"googlechrome_VisitedLinks" = "1"
"jfdotnet" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 6B 0D AE FC F2 21 3A 3E FE 98 1D 54 A9 33 32"

[HKCU\Software\systweak\ASO3\Scheduler\OneClick]
"ASO-OneClickCare" = "Không có lịch trình"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_regedit" = "1"

[HKCU\Software\systweak\ASO3\Scheduler\OneClick]
"chkAntispyware" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section1]
"AdobeFlashPlayer" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section3]
"winsys_winerrorreporting" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_windowsdefender" = "1"
"winsys_clipboard" = "1"
"iMycache" = "0"

[HKCU\Software\systweak\ASO3\Scheduler\OneClick]
"chkDriverupdater" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_skype" = "1"
"winsys_memorydumps" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_adobeair" = "0"
"mso2013MS_Word" = "1"

[HKCU\Software\systweak\ASO3]
"ASO3CAM" = "website"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_adobephotoshopcss" = "0"
"app_prg_acrobatdistiller" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_msofficepicturemanager" = "1"

[HKCU\Software\systweak\ASO3\ScanStatusForLauncher\SysFileBackup]
"LastScanDateTime" = "10/21/2014 2:12:47 PM"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section2]
"jfoldprefach" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_utorrent" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"jflogfileactive" = "1"

[HKCU\Software\systweak\ASO3\OneClickCure\SysFileBackup]
"CLEANFINISHED" = "1"

[HKCU\Software\systweak\ASO3\OneclickLastScanDetailsPath]
"SystemCleaner.exe" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section3]
"winsys_taskbarjumplists" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_winrar" = "1"
"app_prg_utorrent" = "1"
"app_prg_gameexplorer" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section3]
"winsys_otherexplorermrus" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_windowsmediaplayer" = "1"

[HKCU\Software\systweak\ASO3\ScanStatusForLauncher\SysFileBackup]
"iconStatus" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"mso2013MS_Access" = "1"
"app_prg_msofficepicturemanager" = "1"

[HKCU\Software\systweak\ASO3\ScanStatusForLauncher\SysFileBackup]
"MSGOnHome" = ""

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"googlechrome_Cookies" = "1"
"jfrecentprgdocset" = "0"
"winsys_windowslogfiles" = "1"
"winsys_taskbarjumplists" = "1"

[HKCU\Software\systweak\ASO3\Advanced System Optimizer\OneClick]
"chkPrivacyProtector" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_microsoftsilverlight" = "1"
"app_prg_msmanagementconsole" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_adobeacrobat" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_acrobatdistiller" = "1"
"iMycache" = "0"

[HKCU\Software\systweak\ASO3\Advanced System Optimizer\OneClick]
"chkJunkFileCleaner" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section1]
"googlechrome_Cache" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"winsys_networkpasswords" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section2]
"jfrecentprgdocset" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section3]
"winsys_clipboard" = "1"

[HKCU\Software\systweak\ASO3]
"ASOBUILDFOR" = "systweak"

[HKCU\Software\systweak\ASO3\Advanced System Optimizer\OneClick]
"chkRegClean" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_adobeair" = "0"
"googlechrome_History" = "1"
"mso2013MS_RecentFolder" = "1"

[HKCU\Software\systweak\ASO3\Scheduler\OneClick]
"(Default)" = "Scan Not Scheduled"
"chkRegOptimizer" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"mso2013MS_PowerPoint" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_malwarebytesantimalware" = "0"
"jfdownloadprgfile" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section3]
"winsys_memorydumps" = "1"

[HKCU\Software\systweak\ASO3\LAST_CALL_TIME]
"LastGVTime" = "DF 07 01 00 06 00 0A 00 02 00 28 00 10 00 B2 02"

[HKCU\Software\systweak\ASO3\Advanced System Optimizer\OneClick]
"chkRegOptimizer" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section2]
"jfThumbnail" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"AdobeFlashPlayer" = "0"
"msofficeothertool_2013" = "1"
"gchromeoptdatabases" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section1]
"gchromeoptdatabases" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"app_prg_microsoftsilverlight" = "1"
"winsys_dnscache" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section2]
"jfTempFile" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section1]
"googlechrome_History" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section2]
"jfwpffont" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"googlechrome_Cache" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"app_prg_windowsmediacenter" = "1"

[HKCU\Software\systweak\ASO3]
"SecDelAppName" = "Xóa vĩnh viễn"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"winsys_searchautocomplete" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"mso2013MS_Access" = "1"
"app_prg_malwarebytesantimalware" = "0"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section2]
"jflogfileactive" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"jfwpffont" = "0"

[HKCU\Software\systweak\ASO3]
"RegisteredPass" = "00JJY7-WTAY0J-K146RX-84C8TJ"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section1]
"googlechrome_Cookies" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"ie8_Cookies" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\Section4]
"msofficeothertool_2013" = "1"
"app_prg_adobeacrobat" = "1"

[HKCU\Software\systweak\ASO3\System Cleaner\PPOptions\RegularSystemCleanerSPC]
"mso2013MS_Word" = "1"

[HKCU\Software\systweak\ASO3\ScanStatusForLauncher\SysFileBackup]
"msg" = "Last backup taken on:Tue. October 21, 2014. 02:12 PM"

The process %original file name%.exe:228 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""
"NetHood" = "%Documents and Settings%\%current user%\NetHood"
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Common Files\Advanced System Optimizer]
"ASO3portable.exe" = "ASO3portable"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Administrative Tools" = "%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Administrative Tools" = ""
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 D1 7F 0D 2B F9 9A 32 8D 1D 7F 86 D9 1E 2B CD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process ASO3portable.exe:644 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC 07 42 E9 1A B9 4F AF 06 7E F2 8C 52 46 BC E7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   ASO3.exe:340
   CheckUpdate.exe:516
   schtasks.exe:1128
   schtasks.exe:1364
   regedit.exe:264
   %original file name%.exe:228
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GDE3MT21\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CRMNWZYD\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GLSHOFWZ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6RMRY1S9\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Application Data\Systweak\ASO3\Checking for Updates\AppUpdates\LatestVersion.htm (832 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\SecureDelete.exe (10347 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\Report_header_leftText.jpg (14 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DiskOptimizer.exe (848 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Xceed.FileSystem.dll (584 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Microsoft.VC90.ATL.manifest (353 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\clamunpack\clamscan.exe (15 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\info.ico (1 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\RegClean.exe (11276 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\BackupManager.exe (18844 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\SystemProtector.XmlSerializers.dll (45 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\MFC90ENU.dll (754 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DiskExplorer.exe (9732 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\sqlite3.dll (6101 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\ASOHelper.dll (8600 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\GOHelper.exe (37 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\driveropt.ini (70 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Xceed.Zip.dll (1430 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\extract\copying.txt (26 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\HookDll64.dll (395 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\VolumeControl64.exe (515 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\regclean.ini (82 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\RegistryOptimizer.exe (3599 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\sysfilebackres.ini (23 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\regopt.ini (12 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\extract\7z.exe (267 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\vista\DriverRestore.manifest (682 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\amd64Helper\DriverUpdateHelper64.manifest (689 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\Report_header_top_middle.jpg (7 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\win7i386\DriverRestore.exe (84 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\startupman.ini (10 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\Portable1.reg (11 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\ScanDll.dll (64 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\amd64\DriverRestore.exe (1635 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\website.ico (1 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\secencrypt.ini (26 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\aso.ini (135 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\PTBWin7.exe (20 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\AsInvoker.exe (64 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\aspcomm.dll (2741 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\right_border.jpg (11 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\footer_middle.jpg (7 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\extract\readme.txt (1 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\asodemo.exe (6577 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\Delete1.reg (11 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\HookDll.dll (56 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Microsoft.VC90.MFCLOC.manifest (670 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\RequireAdministrator.exe (1846 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\BeforeUninstall.exe (13907 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\undelete.ini (28 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DriverUpdater.exe (8022 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\win7amd64\DriverRestore.manifest (682 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\aso3sys.dll (6771 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\Delete.reg (5 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\securedelete.ini (39 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\SevenZipSharp.dll (1223 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\clamunpack\readme.txt (535 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\ASEng.dll (1678 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\diskdoc.ini (32 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\atl90.dll (1395 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Advanced System Optimizer Help.url (432 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\SystemCleaner.exe (17655 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\PrivacyProtector.exe (12628 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\vista\DriverRestore.exe (722 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DiskDoctor.exe (3123 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\GameOptLauncher64.exe (2512 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\XceedZip.dll (1468 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\xmllite.dll (861 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\Report_header_left_image.jpg (11 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\launcher.exe (47 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\backupman.ini (78 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\memopt.ini (12 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\win7i386\DriverRestore.manifest (682 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\aspsys.dll (1708 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\MemoryOptimizer.exe (2376 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\difxapi64.dll (4584 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\mfc90u.dll (34642 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\DiskOpt.ini (19 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\UndeleteDLL.dll (1415 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\HighestAvailable.exe (753 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\SystemProtector.exe (38774 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\AppResource.dll (17986 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\VolumeControl.exe (49 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\ASO3portable.exe (697 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\asplangs\categories.ini (42 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\ASO3DefragSrv64.exe (2241 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\database.dat (32 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\ASO3DefragSrv.exe (3340 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\ASO3.exe (27333 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\sysadvisor.ini (104 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\GameOptLauncher.exe (1922 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\newscheduler.ini (8 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\extract\license.txt (2 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\msvcp90.dll (7063 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\checkupdate.ini (12 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Systweak Software Website.url (245 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\single_click_care.ico (15 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\gameopt.ini (8 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\clamunpack\libclamav.dll (5447 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Microsoft.VC90.MFC.manifest (349 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Undelete.exe (2603 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\NewScheduler.exe (7142 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Interop.IWshRuntimeLibrary.dll (49 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\KillASOProcesses.exe (227 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\diskexplorer.ini (21 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\client.ini (65 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DefragServiceManager.exe (71 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\amd64\DriverRestore.manifest (682 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\difxapi.dll (3413 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\PCFixer.exe (6753 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Microsoft.Win32.TaskScheduler.dll (1929 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\pcfixer.ini (24 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\asores.dll (65453 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\sysclean.ini (52 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\xp\DriverRestore.exe (62 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\win7amd64\DriverRestore.exe (917 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\msvcr90.dll (3847 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\asplangs\eng_asp_en.ini (101 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Xceed.Compression.dll (552 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\dupfileremover.ini (28 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\rw.dat (7386 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\GameOptimizer.exe (1948 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Downloader.dll (1425 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\SystemProtector.exe.config (4 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\System.Data.SQLite.dll (6225 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\SecureShell.dll (5525 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\extract\7z.dll (8067 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Network.dll (4748 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Buy Advanced System Optimizer.url (331 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\footer_right.jpg (11 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\categories.ini (42 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\line3px_Blue.jpg (11 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\CheckUpdate.exe (27994 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\Report_header_top_right.jpg (12 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\StartupManager.exe (1706 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\SysFileBakRes.exe (4335 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\UninstallManager.ini (5 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\unrar.dll (1349 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Help.ico (1 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\SecureEncryptor.exe (1854 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\extract\History.txt (29 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\System.Core.dll (8923 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\zlibwapi.dll (319 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\rw.ini (54 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Microsoft.VC90.CRT.manifest (391 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DuplicateFilesRemover.exe (460 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\updater\amd64Helper\DriverUpdateHelper64.exe (2221 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\asohtm.dll (3901 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Xceed.Compression.Formats.dll (1916 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\eng\privprotector.ini (44 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\footer_left.jpg (11 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\Portable.reg (14 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\DefragReport\left_border.jpg (11 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\UninstallManager.exe (692 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\Order.ico (1 bytes)
   %Program Files%\Common Files\Advanced System Optimizer\App\SystemAnalyzerAndAdvisor.exe (5321 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

Static Analysis

VersionInfo

Company Name: Vietnamese by ptk911
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3.9.1111.16526
File Description: Advanced System Optimizer
Comments:
Language: English (United States)

Company Name: Vietnamese by ptk911Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 3.9.1111.16526File Description: Advanced System Optimizer Comments: Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /asoupdates/update.aspx?productname=aso&currentapplicationid=3.9.1111.16526&currentdbversionid=0&regver=1&machineid=768429272046948335&key=00JJY7-WTAY0J-K146RX-84C8TJ&username=&daysleft=0&cname=&TELNO=(855) 716-7030&TELNOFR= HTTP/1.1

Accept: */*

Range: bytes=0-416

User-Agent: ISX Download DLL

Host: updates3.systweak.com

HTTP/1.1 206 Partial Content

Server: nginx/1.0.12

Date: Wed, 14 Jan 2015 14:10:53 GMT

Content-Type: application/octet-stream

Last-Modified: Tue, 16 Dec 2014 12:24:19 GMT

Accept-Ranges: bytes

X-Agile-Checksum: ee66ea91c242c9ae2edeb334317715c8dd73c3c69de8f10beba4e62dd4af1da0

Content-Range: bytes 0-415/416

Content-Length: 416

Connection: keep-alive

[Application]..PROGRAM_VERSION=3.9.1111.0..PROGRAM_URL=hXXp://cdn.systweak.com/asoupdates/updates/aso_updatestub.exe..PROGRAM_SIZE=627024..Open_Browser=0..Description=..Key=aso_updatestub.exe..Hash=757a290af9cd154fd5482a89fe8f3b3dde1ac726..IS_MANDATORY=0..TELNO=(855) 716-7030..TELNOFR=..[TELNOLIST]..1=(800) 871-7918:(855) 716-7030..2=(800) 983-7054:(855) 716-7030..3=(855) 765-6710:(855) 716-7030........HTTP/1.1 206 Partial Content..Server: nginx/1.0.12..Date: Wed, 14 Jan 2015 14:10:53 GMT..Content-Type: application/octet-stream..Last-Modified: Tue, 16 Dec 2014 12:24:19 GMT..Accept-Ranges: bytes..X-Agile-Checksum: ee66ea91c242c9ae2edeb334317715c8dd73c3c69de8f10beba4e62dd4af1da0..Content-Range: bytes 0-415/416..Content-Length: 416..Connection: keep-alive..[Application]..PROGRAM_VERSION=3.9.1111.0..PROGRAM_URL=hXXp://cdn.systweak.com/asoupdates/updates/aso_updatestub.exe..PROGRAM_SIZE=627024..Open_Browser=0..Description=..Key=aso_updatestub.exe..Hash=757a290af9cd154fd5482a89fe8f3b3dde1ac726..IS_MANDATORY=0..TELNO=(855) 716-7030..TELNOFR=..[TELNOLIST]..1=(800) 871-7918:(855) 716-7030..2=(800) 983-7054:(855) 716-7030..3=(855) 765-6710:(855) 716-7030..

<<< skipped >>>

HEAD /asoupdates/update.aspx?productname=aso&currentapplicationid=3.9.1111.16526&currentdbversionid=0&regver=1&machineid=768429272046948335&key=00JJY7-WTAY0J-K146RX-84C8TJ&username=&daysleft=0&cname=&TELNO=(855) 716-7030&TELNOFR= HTTP/1.1

Accept: */*

User-Agent: ISX Download DLL

Host: updates3.systweak.com

Content-Length: 0

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.12

Date: Wed, 14 Jan 2015 14:10:53 GMT

Content-Type: application/octet-stream

Last-Modified: Tue, 16 Dec 2014 12:24:19 GMT

Accept-Ranges: bytes

X-Agile-Checksum: ee66ea91c242c9ae2edeb334317715c8dd73c3c69de8f10beba4e62dd4af1da0

Content-Length: 416

Connection: keep-alive

HEAD /activationcheck/checkactivation.asp?ActivationKey=00JJY7-WTAY0J-K146RX-84C8TJ HTTP/1.1

Accept: */*

User-Agent: ISX Download DLL

Host: VVV.systweak.com

Content-Length: 0

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 0

Content-Type: text/html

Server: Microsoft-IIS/7.5

Set-Cookie: ASPSESSIONIDCSBDRBRA=PEAODGMCBPLNLIFMBBDOMMOB; path=/

X-Powered-By: ASP.NET

Date: Wed, 14 Jan 2015 14:10:32 GMT

....

GET /activationcheck/checkactivation.asp?ActivationKey=00JJY7-WTAY0J-K146RX-84C8TJ HTTP/1.1

Accept: */*

User-Agent: ISX Download DLL

Host: VVV.systweak.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDCSBDRBRA=PEAODGMCBPLNLIFMBBDOMMOB

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 0

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Wed, 14 Jan 2015 14:10:32 GMT

HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 0..Content-Type: text/html..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Wed, 14 Jan 2015 14:10:32 GMT..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_228:

!Require Windows

!Require Windows

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

PSSSSSSh

PSSSSSSh

ttNt_Nt.Nt

ttNt_Nt.Nt

:Language:%u

:Language:%u

Enter password:

Enter password:

0xx

0xx

"%s".

"%s".

Could not overwrite file "%s".

Could not overwrite file "%s".

Could not create file "%s".

Could not create file "%s".

0xX.

0xX.

7-Zip: Internal error, code 0xX.

7-Zip: Internal error, code 0xX.

7-Zip: Internal error, code %u.

7-Zip: Internal error, code %u.

The archive is corrupted, or invalid password was entered.

The archive is corrupted, or invalid password was entered.

7-Zip: Unsupported method.

7-Zip: Unsupported method.

Error during execution "%s".

Error during execution "%s".

"setup.exe"

"setup.exe"

Could not find "setup.exe".

Could not find "setup.exe".

Could not find command for "%s".

Could not find command for "%s".

Could not delete file or folder "%s".

Could not delete file or folder "%s".

Could not create folder "%s".

Could not create folder "%s".

Error in line %d of configuration data:

Error in line %d of configuration data:

Could not open archive file "%s".

Could not open archive file "%s".

1.6.0 develop [x86]

1.6.0 develop [x86]

2712 (30

2712 (30

1.6.0 develop [x86] build 2712 (December 30, 2012)

1.6.0 develop [x86] build 2712 (December 30, 2012)

Supported methods and filters, build options:

Supported methods and filters, build options:

Sorry, this program requires Microsoft Windows 2000 or later.

Sorry, this program requires Microsoft Windows 2000 or later.

COMCTL32.dll

COMCTL32.dll

ShellExecuteExW

ShellExecuteExW

ShellExecuteW

ShellExecuteW

SHELL32.dll

SHELL32.dll

GDI32.dll

GDI32.dll

ADVAPI32.dll

ADVAPI32.dll

GetKeyState

GetKeyState

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExW

USER32.dll

USER32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

CreateIoCompletionPort

CreateIoCompletionPort

KERNEL32.dll

KERNEL32.dll

MSVCRT.dll

MSVCRT.dll

_acmdln

_acmdln

1/*7;8**7

1/*7;8**7