Download TweakBit PCRepairKit

"1"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\SettingsApplication.AutoScan.Enabled = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\SettingsApplication.AutoScan.TimeStamp = "\x00\x00\xa2\xffn\xf9+@"It deletes the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings\General.DefWebBrowserDropping RoutineThis Potentially Unwanted Application drops the following files: %Program Files%\TweakBit\PCRepairKit\InternetOptimizer.exe%User Temp%\is-KAFEA.tmp\PCRepairKit.exe%Program Files%\TweakBit\PCRepairKit\RegistryDefrag.exe%User Temp%\is-KAFEA.tmp\$$$Cookies169353552%User Temp%\is-KAFEA.tmp\deu.lng%Program Files%\TweakBit\PCRepairKit\is-SQJ19.tmp%Program Files%\TweakBit\PCRepairKit\is-4UVUU.tmp%User Temp%\is-KAFEA.tmp\AxComponentsVCL.bpl%Program Files%\TweakBit\PCRepairKit\Data\database.dat%Program Files%\TweakBit\PCRepairKit\is-DAGIB.tmp%Program Files%\TweakBit\PCRepairKit\Data\is-DNQQP.tmp%Program Files%\TweakBit\PCRepairKit\SendDebugLog.exe%Program Files%\TweakBit\PCRepairKit\Data\is-4F9VH.tmp%Program Files%\TweakBit\PCRepairKit\is-S57JR.tmp%Program Files%\TweakBit\PCRepairKit\TaskSchedulerHelper.dll%Program Files%\TweakBit\PCRepairKit\is-6A7OL.tmp%Program Files%\TweakBit\PCRepairKit\ATPopupsHelper.dll%User Temp%\is-KAFEA.tmp\ita.lng%Program Files%\TweakBit\PCRepairKit\is-HG2SJ.tmp%Program Files%\TweakBit\PCRepairKit\vcl160.bpl%User Temp%\is-KAFEA.tmp\CommonForms.Site.dll%Program Files%\TweakBit\PCRepairKit\Data\main.ini%User Temp%\is-KAFEA.tmp\fra.lng%Program Files%\TweakBit\PCRepairKit\is-V89NK.tmp%Program Files%\TweakBit\PCRepairKit\is-I1I9I.tmp%Program Files%\TweakBit\PCRepairKit\Lang\is-615BK.tmp%Program Files%\TweakBit\PCRepairKit\Data\is-U61RF.tmp%Program Files%\TweakBit\PCRepairKit\is-62GNT.tmp%Program Files%\TweakBit\PCRepairKit\is-3QPCG.tmp%Program Files%\TweakBit\PCRepairKit\CommonForms.Routine.dll%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.lnk%Program Files%\TweakBit\PCRepairKit\is-NSNO8.tmp%Program Files%\TweakBit\PCRepairKit\unins000.exe%Program Files%\TweakBit\PCRepairKit\Data\is-C9B6U.tmp%Program Files%\TweakBit\PCRepairKit\is-587KA.tmp%User Temp%\is-KAFEA.tmp\$$$Cookies169340323%Program Files%\TweakBit\PCRepairKit\Data\hsysfiles.mdict%Program Files%\TweakBit\PCRepairKit\TweakManagerHelper.dll%Program Files%\TweakBit\PCRepairKit\Lang\esp.lng%Program Files%\TweakBit\PCRepairKit\is-IJ650.tmp%Program Files%\TweakBit\PCRepairKit\is-QK4PD.tmp%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite-wal%Program Files%\TweakBit\PCRepairKit\is-PAL83.tmp%Program Files%\TweakBit\PCRepairKit\rdboot64.exe%Program Files%\TweakBit\PCRepairKit\is-BNIFG.tmp%Program Files%\TweakBit\PCRepairKit\is-E4K46.tmp%Program Files%\TweakBit\PCRepairKit\ATUpdatersHelper.dll%Program Files%\TweakBit\PCRepairKit\is-CKABG.tmp%User Temp%\is-KAFEA.tmp\esp.lng%Program Files%\TweakBit\PCRepairKit\is-5EB6S.tmp%Program Files%\TweakBit\PCRepairKit\is-C1IM1.tmp%Program Files%\TweakBit\PCRepairKit\CommonForms.Site.dll%Program Files%\TweakBit\PCRepairKit\VolumesHelper.dll%Program Files%\TweakBit\PCRepairKit\MalwareDetectionHelper.dll%Program Files%\TweakBit\PCRepairKit\is-Q6MC5.tmp%Program Files%\TweakBit\PCRepairKit\Data\is-BBKRA.tmp%User Temp%\is-KAFEA.tmp\rtl160.bpl%Program Files%\TweakBit\PCRepairKit\is-KS4C1.tmp%Program Files%\TweakBit\PCRepairKit\is-C3O4Q.tmp%Program Files%\TweakBit\PCRepairKit\Lang\is-RMJDM.tmp%Program Files%\TweakBit\PCRepairKit\Lang\is-TPBCN.tmp%Program Files%\TweakBit\PCRepairKit\SpywareCheckerHelper.dll%Program Files%\TweakBit\PCRepairKit\Localizer.dll%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.lnk%Program Files%\TweakBit\PCRepairKit\is-9K2BD.tmp%Program Files%\TweakBit\PCRepairKit\DuplicateFileFinder.exe%Program Files%\TweakBit\PCRepairKit\ReportHelper.dll%Program Files%\TweakBit\PCRepairKit\is-55BJ7.tmp%Program Files%\TweakBit\PCRepairKit\sqlite3.dll%Program Files%\TweakBit\PCRepairKit\is-SNHO4.tmp%Program Files%\TweakBit\PCRepairKit\is-ENHPT.tmp%Program Files%\TweakBit\PCRepairKit\Data\security_db.dat%Program Files%\TweakBit\PCRepairKit\Data\hbwlists.mdict%Program Files%\TweakBit\PCRepairKit\is-4AKL1.tmp%Program Files%\TweakBit\PCRepairKit\Lang\ptb.lng%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite-shm%Program Files%\TweakBit\PCRepairKit\is-D1HPD.tmp%Program Files%\TweakBit\PCRepairKit\TweakManager.exe%Program Files%\TweakBit\PCRepairKit\DiskWipeHelper.dll%Program Files%\TweakBit\PCRepairKit\FileShredder.exe%Program Files%\TweakBit\PCRepairKit\Lang\deu.lng%Program Files%\TweakBit\PCRepairKit\is-2PN02.tmp%Program Files%\TweakBit\PCRepairKit\Downloader.exe%Program Files%\TweakBit\PCRepairKit\is-5RTNN.tmp%Program Files%\TweakBit\PCRepairKit\Data\hmthinfo.mdict%Program Files%\TweakBit\PCRepairKit\InternetOptimizerHelper.dll%Program Files%\TweakBit\PCRepairKit\is-QPBJ9.tmp%Program Files%\TweakBit\PCRepairKit\MalwareHeuristicHelper.dll%Program Files%\TweakBit\PCRepairKit\DiskCleanerHelper.dll%Program Files%\TweakBit\PCRepairKit\Lang\enu.lng%Program Files%\TweakBit\PCRepairKit\SystemInformationHelper.dll%Program Files%\TweakBit\PCRepairKit\unins000.dat%Program Files%\TweakBit\PCRepairKit\CommonForms.dll%Program Files%\TweakBit\PCRepairKit\DuplicateFileFinderHelper.dll%Program Files%\TweakBit\PCRepairKit\is-DNNN5.tmp%Program Files%\TweakBit\PCRepairKit\is-E397I.tmp%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.url%Program Files%\TweakBit\PCRepairKit\Data\hwscheme.mdict%Program Files%\TweakBit\PCRepairKit\RescueCenter.exe%Program Files%\TweakBit\PCRepairKit\Data\is-VJ20V.tmp%Program Files%\TweakBit\PCRepairKit\RescueCenterForm.dll%Program Files%\TweakBit\PCRepairKit\AxComponentsRTL.bpl%Program Files%\TweakBit\PCRepairKit\Lang\is-C4FLQ.tmp%Program Files%\TweakBit\PCRepairKit\Data\compromised_passwords.txt%Program Files%\TweakBit\PCRepairKit\Lang\ita.lng%User Temp%\is-KAFEA.tmp\CFAHelper.dll%Program Files%\TweakBit\PCRepairKit\is-2CQ9M.tmp%User Temp%\is-KAFEA.tmp\ptb.lng%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x64.dll%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x32.dll%Program Files%\TweakBit\PCRepairKit\RegistryDefragHelper.dll%Program Files%\TweakBit\PCRepairKit\is-II2VM.tmp%User Temp%\is-KAFEA.tmp\Localizer.dll%Program Files%\TweakBit\PCRepairKit\accessibility_sdk.dll%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite-shm%Program Files%\TweakBit\PCRepairKit\GoogleAnalyticsHelper.dll%Program Files%\TweakBit\PCRepairKit\is-MH7FC.tmp%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.dll%Program Files%\TweakBit\PCRepairKit\CFAHelper.dll%User Temp%\is-KAFEA.tmp\$$$Databases.db169353614%Program Files%\TweakBit\PCRepairKit\rtl160.bpl%Program Files%\TweakBit\PCRepairKit\is-MNBA4.tmp%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite-wal%User Temp%\is-KAFEA.tmp\vclimg160.bpl%Program Files%\TweakBit\PCRepairKit\is-0GNTA.tmp%Program Files%\TweakBit\PCRepairKit\DebugHelper.dll%Program Files%\TweakBit\PCRepairKit\rdboot32.exe%Program Files%\TweakBit\PCRepairKit\is-BIJH6.tmp%AppDataLocal%\GDIPFONTCACHEV1.DAT%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe%User Temp%\is-KAFEA.tmp\sqlite3.dll%Program Files%\TweakBit\PCRepairKit\is-DH0JH.tmp%User Temp%\is-KAFEA.tmp\$$$Databases.db169340510%User Temp%\is-KAFEA.tmp\main.ini%Program Files%\TweakBit\PCRepairKit\PCRepairKit.url%Program Files%\TweakBit\PCRepairKit\is-3F1B6.tmp%Program Files%\TweakBit\PCRepairKit\is-C9F4Q.tmp%Program Files%\TweakBit\PCRepairKit\RescueCenterHelper.dll%Program Files%\TweakBit\PCRepairKit\Data\is-M01L2.tmp%Program Files%\TweakBit\PCRepairKit\Lang\is-AT6QI.tmp%Program Files%\TweakBit\PCRepairKit\is-4Q8V1.tmp%Program Files%\TweakBit\PCRepairKit\is-AQMTM.tmp%User Temp%\is-KAFEA.tmp\downloader.exe%Program Files%\TweakBit\PCRepairKit\WizardHelper.dll%Program Files%\TweakBit\PCRepairKit\is-LOMPL.tmp%User Temp%\is-KAFEA.tmp\WizardHelper.dll%Program Files%\TweakBit\PCRepairKit\Data\cmpdw.dict%Program Files%\TweakBit\PCRepairKit\is-NBAK9.tmp%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\cookies.sqlite%User Temp%\is-KAFEA.tmp\GoogleAnalyticsHelper.dll%User Temp%\is-KAFEA.tmp\vcl160.bpl%User Temp%\is-KAFEA.tmp\reader.exe%Program Files%\TweakBit\PCRepairKit\is-VDIPD.tmp%Program Files%\TweakBit\PCRepairKit\Lang\is-K566G.tmp%Program Files%\TweakBit\PCRepairKit\Data\is-R3V7G.tmp%Program Files%\TweakBit\PCRepairKit\vclimg160.bpl%Program Files%\TweakBit\PCRepairKit\Lang\fra.lng%Program Files%\TweakBit\PCRepairKit\AxComponentsVCL.bpl%Program Files%\TweakBit\PCRepairKit\Data\cmpdw.dict-journal%Desktop%\TweakBit PCRepairKit.lnk%Program Files%\TweakBit\PCRepairKit\is-PMSN0.tmp%Program Files%\TweakBit\PCRepairKit\AxBrowsers.dll%Program Files%\TweakBit\PCRepairKit\unins000.msg%User Temp%\is-KAFEA.tmp\AxComponentsRTL.bpl%Program Files%\TweakBit\PCRepairKit\RegistryCleanerHelper.dll%Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\places.sqlite(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on

"1.0" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\TypeLib (Default) = "{F2C6F7D1-ED32-49E5-9919-C51E9E2FD453}" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D5D06322-F26B-6A95-7CD6-FE1685435892}\Version Assembly = "{random characters}" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings General.InstallDateTime = "\x84\xdf$!\xff\xe5@" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings (Default) = "1" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings App.Application.FileName = "%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings Application.SplitTest = "1" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings Application.AutoScan.Enabled = "1" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings Application.AutoScan.TimeStamp = "\x00\x00\xa2\xffn\xf9+@" Step 5Search and delete these folders [ Learn More ] Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result. %Program Files%\TweakBit%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit%All Users Profile%\TweakBit\PCRepairKit%All Users Profile%\TweakBit\PCRepairKit\1.x%All Users Profile%\TweakBit\PCRepairKit\1.x\Data%All Users Profile%\TweakBit%User Temp%\is-KAFEA.tmp\_isetup%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit%Program Files%\TweakBit\PCRepairKit\Data%User Temp%\PCRepairKit.madExcept%Program Files%\TweakBit\PCRepairKit%Program Files%\TweakBit\PCRepairKit\LangStep 6Scan your computer with your Trend Micro product to delete files detected as PUA.Win32.PCRepairKit.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:Home and Home Office SupportBusiness Support Step 7Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again. %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.lnk%Desktop%\TweakBit PCRepairKit.url%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.url%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.pif%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.url%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.pif%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.pif%User Temp%\PCRepairKit.madExcept%Desktop%\TweakBit PCRepairKit.pifStep 8Restore these deleted registry keys/values from backup *Note: Only Microsoft-related keys/values will be restored. If the malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer. In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings General.DefWebBrowser Did this description help? Tell us how we did.

10(64-bit).)Other System ModificationsThis Potentially Unwanted Application deletes the following files: %All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.lnk%Desktop%\TweakBit PCRepairKit.url%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.url%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit on the Web.pif%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.url%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\TweakBit PCRepairKit.pif%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit\Uninstall PCRepairKit.pif%User Temp%\PCRepairKit.madExcept%Desktop%\TweakBit PCRepairKit.pif(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)It adds the following registry entries: HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000Owner = "\xa4\x08\x00\x00\x91\xa93\xb5\xf8\x81\xd5\x01"HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000SessionHash = "{random characters}"HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000Sequence = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\SettingsGeneral.Language = "ENU"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\SettingsGeneral.URLSource = "pc-repair-kit"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\SettingsGeneral.Cookie = ""HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\SettingsGeneral.Cookie = "ui_lite"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\SettingsApp.Application.PurchaseUrlParam = ""HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\SettingsGeneral.DoNotAddUtmToUrls = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBitClientID = "{F7A8C30F-4519-4B87-A111-4F932E8D3BEE}"HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000RegFiles0000 = "\x00\x00\x00\x00:\xeb\x90\x80\x08\xe1\x80\x80t\xe4\x92\xad"HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000RegFilesHash = "{random characters}"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\SettingsShared.Blocking.PCRepairKit = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1Inno Setup: Setup Version = "5.5.9 (u)"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1Inno Setup: App Path = "%Program Files%\TweakBit\PCRepairKit"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1InstallLocation = "%Program Files%\TweakBit\PCRepairKit"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1Inno Setup: Icon Group = "TweakBit\PCRepairKit"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1Inno Setup: User = "{username}"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1Inno Setup: Language = "en"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1DisplayName = "TweakBit PCRepairKit"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1DisplayIcon = "%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1UninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1QuietUninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe /SILENT"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1DisplayVersion = "1.8.4.16"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1Publisher = "Tweakbit Pty Ltd"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1URLInfoAbout = " = " = " = "[email protected]"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1NoModify = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1NoRepair = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1InstallDate = "20191013"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1MajorVersion = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1MinorVersion = "8"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1VersionMajor = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1VersionMinor = "8"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1EstimatedSize = "58891"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1UninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe /compability"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}(Default) = "IBCAgent32"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\ProxyStubClsid32(Default) = "{00020424-0000-0000-C000-000000000046}"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\TypeLib(Default) = "{F2C6F7D1-ED32-49E5-9919-C51E9E2FD453}"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\TypeLibVersion = "1.0"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}AppID = "{93469602-4134-4012-A6BC-FD34B37A0C36}"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{93469602-4134-4012-A6BC-FD34B37A0C36}DllSurrogate = ""HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}(Default) = "TweakBit BCAgent32"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\InprocServer32(Default) = "%Program Files%\TweakBit\PCREPA~1\BROWSE~3.DLL"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\InprocServer32ThreadingModel = "Free"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BCAgentCOM32.BCAgent32(Default) = "TweakBit BCAgent32"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BCAgentCOM32.BCAgent32\Clsid(Default) = "{93469602-4134-4012-A6BC-FD34B37A0C36}"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\ProgID(Default) = "BCAgentCOM32.BCAgent32"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\Version(Default) = "1.0"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\TypeLib(Default) = "{F2C6F7D1-ED32-49E5-9919-C51E9E2FD453}"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D5D06322-F26B-6A95-7CD6-FE1685435892}\VersionAssembly = "{random characters}"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\SettingsGeneral.InstallDateTime = "\x84\xdf$!\xff\xe5@"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings(Default) = "1"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\SettingsApp.Application.FileName = "%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\SettingsApplication.SplitTest =

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival DetailsThis Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.InstallationThis Potentially Unwanted Application adds the following processes: %User Temp%\is-KAFEA.tmp\DefaultBrowserFinder.exe "TweakBit" "PCRepairKit" "pc-repair-kit" "1.x"%User Temp%\is-KAFEA.tmp\reader.exe "{malware file path and name}" "(x32)HKEY_LOCAL_MACHINE\Software\TweakBit\PCRepairKit\1.x\Settings""%System%\regsvr32.exe" /s "%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x64.dll""%System%\regsvr32.exe" /s "%Program Files%\TweakBit\PCRepairKit\BrowserCareHelper.Agent.x32.dll"%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe /Install /Language:"ENU" /AutoStart /SendInfo(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)It creates the following folders: %Program Files%\TweakBit%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit\PCRepairKit%All Users Profile%\TweakBit\PCRepairKit%All Users Profile%\TweakBit\PCRepairKit\1.x%All Users Profile%\TweakBit\PCRepairKit\1.x\Data%All Users Profile%\TweakBit%User Temp%\is-KAFEA.tmp\_isetup%All Users Profile%\Microsoft\Windows\Start Menu\Programs\TweakBit%Program Files%\TweakBit\PCRepairKit\Data%User Temp%\PCRepairKit.madExcept%Program Files%\TweakBit\PCRepairKit%Program Files%\TweakBit\PCRepairKit\Lang(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and

Registry. *Note: You need the value of the CLSID key from Step {step # here}. --> In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 Owner = "\xa4\x08\x00\x00\x91\xa93\xb5\xf8\x81\xd5\x01" In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 SessionHash = "{random characters}" In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 Sequence = "1" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings General.Language = "ENU" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings General.URLSource = "pc-repair-kit" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings General.Cookie = "" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings General.Cookie = "ui_lite" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings App.Application.PurchaseUrlParam = "" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\PCRepairKit\1.x\Settings General.DoNotAddUtmToUrls = "1" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit ClientID = "{F7A8C30F-4519-4B87-A111-4F932E8D3BEE}" In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 RegFiles0000 = "\x00\x00\x00\x00:\xeb\x90\x80\x08\xe1\x80\x80t\xe4\x92\xad" In HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 RegFilesHash = "{random characters}" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings Shared.Blocking.PCRepairKit = "1" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 Inno Setup: Setup Version = "5.5.9 (u)" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 Inno Setup: App Path = "%Program Files%\TweakBit\PCRepairKit" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 InstallLocation = "%Program Files%\TweakBit\PCRepairKit" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 Inno Setup: Icon Group = "TweakBit\PCRepairKit" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 Inno Setup: User = "{username}" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 Inno Setup: Language = "en" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 DisplayName = "TweakBit PCRepairKit" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 DisplayIcon = "%Program Files%\TweakBit\PCRepairKit\PCRepairKit.exe" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 UninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 QuietUninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe /SILENT" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 DisplayVersion = "1.8.4.16" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 Publisher = "Tweakbit Pty Ltd" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 URLInfoAbout = " In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 HelpLink = " In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 URLUpdateInfo = " In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 Contact = "[email protected]" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 NoModify = "1" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 NoRepair = "1" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 InstallDate = "20191013" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 MajorVersion = "1" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 MinorVersion = "8" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 VersionMajor = "1" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 VersionMinor = "8" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 EstimatedSize = "58891" In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5AEA8CFE-B238-4D0A-9362-D55F38ECB795}_is1 UninstallString = "%Program Files%\TweakBit\PCRepairKit\unins000.exe /compability" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB} (Default) = "IBCAgent32" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\ProxyStubClsid32 (Default) = "{00020424-0000-0000-C000-000000000046}" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\TypeLib (Default) = "{F2C6F7D1-ED32-49E5-9919-C51E9E2FD453}" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A3310BE-83DD-4E80-AC51-E8DCA30FFEDB}\TypeLib Version = "1.0" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36} AppID = "{93469602-4134-4012-A6BC-FD34B37A0C36}" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{93469602-4134-4012-A6BC-FD34B37A0C36} DllSurrogate = "" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36} (Default) = "TweakBit BCAgent32" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\InprocServer32 (Default) = "%Program Files%\TweakBit\PCREPA~1\BROWSE~3.DLL" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\InprocServer32 ThreadingModel = "Free" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BCAgentCOM32.BCAgent32 (Default) = "TweakBit BCAgent32" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BCAgentCOM32.BCAgent32\Clsid (Default) = "{93469602-4134-4012-A6BC-FD34B37A0C36}" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\ProgID (Default) = "BCAgentCOM32.BCAgent32" In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93469602-4134-4012-A6BC-FD34B37A0C36}\Version (Default) =