Adware.GenericKD.3645195_d43d633a14

by malwarelabrobot on November 8th, 2016 in Malware Descriptions.

Adware.GenericKD.3645195 (B) (Emsisoft), Adware.GenericKD.3645195 (AdAware), Trojan-Banker.Win32.Brasil.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericEmailWorm.YR (Lavasoft MAS)
Behaviour: Banker, Trojan, Worm, EmailWorm, VirTool, Adware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: d43d633a14e5d6d3708ef926d75f303c
SHA1: 9037d62a5419bbea427a1aaf40c2a68e281d47fb
SHA256: 50a5b133d0acd310a0359419f22ac299be63244183cfcf67eb80ae4a3b6ad238
SSDeep: 98304:VV4i3O3AumIGUU9P1VbngJxO2SMYvYeW hUgN8EZQlG:D4i3OQeU98qbMYnfhUgNwE
Size: 4059608 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphiv60v70_v2, UPolyXv05_v6, BorlandDelphi30, BorlandDelphiv30, ACProtect141
Company: Super PC Tools ltd
Created at: 2016-05-25 16:41:25
Analyzed on: Windows7 SP1 32-bit


Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

Behaviour Description
EmailWorm Worm can send e-mails.


Process activity

The Adware creates the following process(es):

SuperUpdater.exe:3584
supupdsetup.exe:452
%original file name%.exe:3308
SUStartScan.exe:3656
supupdsetup.tmp:1024

The Adware injects its code into the following process(es):

SuperUpdater.exe:1588
SUTray.exe:3172

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process SuperUpdater.exe:1588 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\current_7_32_zxw.7z (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\PCInfo.ini (151 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\program.log (1024 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\Scan.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\Drivers.db (2721 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\Drivers32.db (1848968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\Drivers32.db-journal (1090 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\Devices.ini (34 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SuperUpdater.madExcept (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\current_7_32_zxw.7z (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\Drivers32.db-journal (0 bytes)

The process SuperUpdater.exe:3584 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\program.log (126 bytes)
%Program Files%\Super Updater\sqlite3.dll (524 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SuperUpdater.madExcept (0 bytes)

The process supupdsetup.exe:452 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-U7PFR.tmp\supupdsetup.tmp (50 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-U7PFR.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-U7PFR.tmp\supupdsetup.tmp (0 bytes)

The process %original file name%.exe:3308 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\supupdsetup.exe (294 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\supupdsetup.exe (0 bytes)

The process supupdsetup.tmp:1024 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\Super Updater\unins000.dat (14237 bytes)
%Program Files%\Super Updater\is-TJ10L.tmp (40320 bytes)
C:\Users\"%CurrentUserName%"\Desktop\Super Updater.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\is-P8LHT.tmp (601 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Updater\Help.lnk (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Updater\Super Updater on the Web.lnk (1 bytes)
%Program Files%\Super Updater\is-J6FU9.tmp (3073 bytes)
%Program Files%\Super Updater\unins000.exe (48 bytes)
%Program Files%\Super Updater\is-F6KAP.tmp (6841 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Updater\Uninstall Super Updater.lnk (2 bytes)
%Program Files%\Super Updater\SUTray.exe (950 bytes)
%Program Files%\Super Updater\is-8MVTU.tmp (26096 bytes)
%Program Files%\Super Updater\unins000.msg (768 bytes)
%Program Files%\Super Updater\SuperUpdater.exe (291 bytes)
%Program Files%\Super Updater\is-9EQQC.tmp (7345 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-D4OAB.tmp\_isetup\_shfoldr.dll (47 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\is-PS5ET.tmp (4 bytes)
%Program Files%\Super Updater\is-G36EH.tmp (127 bytes)
%Program Files%\Super Updater\is-5342H.tmp (548 bytes)
%Program Files%\Super Updater\is-4KECD.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-D4OAB.tmp\cfg.exe (65 bytes)
%Program Files%\Super Updater\is-MJUQQ.tmp (7345 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Updater\Super Updater.lnk (1 bytes)
%Program Files%\Super Updater\SUStartScan.exe (958 bytes)
%Program Files%\Super Updater\is-I22KE.tmp (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-D4OAB.tmp\SupUpdHelper.dll (8330 bytes)
%Program Files%\Super Updater\is-UCJ2A.tmp (11 bytes)
%Program Files%\Super Updater\is-QS6UQ.tmp (8281 bytes)

The Adware deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-D4OAB.tmp\cfg.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-D4OAB.tmp\_isetup\_shfoldr.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-D4OAB.tmp\_isetup (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-D4OAB.tmp\SupUpdHelper.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-D4OAB.tmp (0 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Updater\Uninstall Super Updater.lnk (0 bytes)

Registry activity

The process SuperUpdater.exe:1588 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Super Updater]
"s_Enable" = "0"
"ForceUpdate" = "0"
"ShowSRPMessage" = "1"
"InstallStat" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SuperUpdater_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Super Updater]
"s_SmartExec" = "0"
"LastUpdate" = "8B B8 D8 8D 34 D7 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Super Updater]
"ShowRebootMessage" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\SuperUpdater_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Super Updater]
"ProxyPassword" = ""

[HKLM\SOFTWARE\Microsoft\Tracing\SuperUpdater_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Super Updater]
"ShowAlertMessages" = "1"
"OutdatedDrivers" = "2"
"ProxyPort" = ""
"TotalDrivers" = "80"

[HKLM\SOFTWARE\Microsoft\Tracing\SuperUpdater_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Super Updater]
"BackupPath" = "C:\Users\"%CurrentUserName%"\Documents\Super Updater\Backup\"
"s_Time" = "8B B8 D8 8D 34 D7 E4 40"
"DownloadPath" = "C:\Users\"%CurrentUserName%"\Documents\Super Updater\Drivers\"
"QuerryDate" = "59 47 A3 8F 34 D7 E4 40"
"AppStart" = "1"
"InstallationDate" = "11-07-2016"
"ProxyAddress" = ""

[HKLM\SOFTWARE\Microsoft\Tracing\SuperUpdater_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Super Updater]
"TrayNotification" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\SuperUpdater_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\SuperUpdater_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Super Updater]
"s_SmartMode" = "0"
"ScanExecuted" = "1"
"UseProxy" = "0"
"s_SmartScan" = "1"
"nDownloads" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3F 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Super Updater]
"LastDatabaseCheck" = "8B B8 D8 8D 34 D7 E4 40"

[HKLM\SOFTWARE\Microsoft\Tracing\SuperUpdater_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\SuperUpdater_RASMANCS]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"

[HKCU\Software\Super Updater]
"ShowUpdateWindow" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SuperUpdater_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Super Updater]
"DatabaseDate" = "8B B8 D8 8D 34 D7 E4 40"
"s_SmartDate" = "8B B8 D8 8D 14 D7 E4 40"

"ProxyLogin" = ""
"UpdateWindowShown" = "0"
"s_Mode" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SuperUpdater_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Super Updater]
"LastScan" = "CE ED 9A 8F 34 D7 E4 40"
"StartWithWindows" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process %original file name%.exe:3308 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Super Updater]
"setupname" = "c:\%original file name%.exe"

The process SUStartScan.exe:3656 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\SUStartScan_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Super Updater]
"UseAds" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Super Updater]
"DelayedStart" = "0"
"SupportURL" = "http://superpctools.com/support/"

[HKLM\SOFTWARE\Microsoft\Tracing\SUStartScan_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SUStartScan_RASMANCS]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\SUStartScan_RASAPI32]
"FileTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Super Updater]
"BuyNowURL" = "http://gen.securedshopgate.com/?t=01&b=22&tid=221002115-DE-092_1DA9F63F-48BA-E04E-0A6C-7E5368351C0D"
"homepageurl" = "http://superpctools.com"

"QuerryDate" = "B0 A1 9A 8D 34 D7 E4 40"
"AppStart" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SUStartScan_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Super Updater]
"Querry" = "http://bi.superpcdownload.net/t/i/su?sid=221002115-DE-092&dt=%dt%&gid=%GID%&tz=%tz%&ln=%ln%&lc=%lc%&bis=%bis%&bief=%bief%&biefx=%biefx%&bif=%bif%&os=%os%&f=2432891174"
"UninstallURL" = "https://safecart.com/superpctools/.spu-special/purchase?sid=221002115-DE-092"
"MachineGuid" = "1DA9F63F-48BA-E04E-0A6C-7E5368351C0D"
"InstallDate" = "4F 2A 91 8D 34 D7 E4 40"
"OS" = "106"

[HKLM\SOFTWARE\Microsoft\Tracing\SUStartScan_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\SUStartScan_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\SUStartScan_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\SUStartScan_RASMANCS]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SUTray.exe:3172 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Super Updater]
"s_Enable" = "0"
"TrayNotification" = "1"
"s_SmartDate" = "89 8D 78 8D 14 D7 E4 40"
"s_SmartMode" = "0"
"s_SmartScan" = "1"
"s_Mode" = "0"
"s_Exec" = "0"
"StartWithWindows" = "0"

The process supupdsetup.tmp:1024 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFilesHash" = "19 07 F4 69 47 B1 00 34 27 78 72 A9 B9 A8 91 62"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Updater_is1]
"URLInfoAbout" = "http://www.superpctools.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFiles0000" = "%Program Files%\Super Updater\SuperUpdater.chm, %Program Files%\Super Updater\SupUpdHelper.dll, %Program Files%\Super Updater\SuperUpdater.exe, %Program Files%\Super Updater\sqlite3.dll, %Program Files%\Super Updater\7z.dll, %Program Files%\Super Updater\SUTray.exe, %Program Files%\Super Updater\SUStartScan.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Updater_is1]
"InstallDate" = "20161107"
"EstimatedSize" = "9854"
"Inno Setup: App Path" = "%Program Files%\Super Updater"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Updater_is1]
"DisplayIcon" = "%Program Files%\Super Updater\SuperUpdater.exe"
"NoModify" = "1"

[HKCU\Software\Super Updater]
"CBM" = "1"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"SessionHash" = "82 01 84 12 A6 80 12 BC 64 72 DB A8 E3 C5 00 12"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Updater_is1]
"QuietUninstallString" = "%Program Files%\Super Updater\unins000.exe /SILENT"
"Inno Setup: Deselected Tasks" = ""
"UninstallString" = "%Program Files%\Super Updater\unins000.exe"

[HKCU\Software\Super Updater]
"BuyNowURL" = "http://gen.securedshopgate.com/?t=01&b=22&tid=221002115-DE-092_1DA9F63F-48BA-E04E-0A6C-7E5368351C0D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Updater_is1]
"Inno Setup: Language" = "en"
"Inno Setup: Selected Tasks" = "desktopicon"

[HKCU\Software\Super Updater]
"Language" = "1"
"Querry" = "http://bi.superpcdownload.net/t/i/su?sid=221002115-DE-092&dt=%dt%&gid=%GID%&tz=%tz%&ln=%ln%&lc=%lc%&bis=%bis%&bief=%bief%&biefx=%biefx%&bif=%bif%&os=%os%&f=2432891174"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Updater_is1]
"URLUpdateInfo" = "http://www.superpctools.com"
"HelpLink" = "http://www.superpctools.com"
"DisplayVersion" = "3.1"
"NoRepair" = "1"
"MinorVersion" = "1"
"InstallLocation" = "%Program Files%\Super Updater\"
"Inno Setup: User" = "%CurrentUserName%"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Sequence" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Updater_is1]
"Inno Setup: Setup Version" = "5.5.3 (u)"
"DisplayName" = "Super Updater v3.1"

[HKCU\Software\Super Updater]
"SessionID" = "D70960D3-911C-4889-97CC6519E1266656"
"setupname" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-D4OAB.tmp\cfg.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Updater_is1]
"Publisher" = "Super PC Tools Ltd"

[HKCU\Software\Super Updater]
"Ir" = "1"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Owner" = "00 04 00 00 CF 9F 43 50 FA 38 D2 01"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Updater_is1]
"MajorVersion" = "3"
"Inno Setup: Icon Group" = "Super Updater"

The Adware deletes the following registry key(s):

[HKCU\Software\Microsoft\RestartManager\Session0000]

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFilesHash"
"Sequence"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"SessionHash"

[HKCU\Software\Super Updater]
"Querry"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Owner"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFiles0000"

Dropped PE files

MD5 File path
04ad4b80880b32c94be8d0886482c774 c:\Program Files\Super Updater\7z.dll
47072881da010f47b8a9756f40f30557 c:\Program Files\Super Updater\SUStartScan.exe
fdcc3ceab98e184f22f622c801e5f4b3 c:\Program Files\Super Updater\SUTray.exe
dfd23a69f1a7f5385eafafde8f5582f4 c:\Program Files\Super Updater\SupUpdHelper.dll
11c945afa29c8ebf8c5a8374ae35f94a c:\Program Files\Super Updater\SuperUpdater.exe
0f66e8e2340569fb17e774dac2010e31 c:\Program Files\Super Updater\sqlite3.dll
0d69d26774df05dbe5a6cbfa7cf89d91 c:\Program Files\Super Updater\unins000.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Super PC Tools ltd
Product Name: Super Updater 3.1
Product Version: 3.1.0.0
Legal Copyright: Super PC Tools ltd
Legal Trademarks:
Original Filename:
Internal Name: Super Updater 3.1
File Version: 3.1.0.0
File Description: Keep your PC drivers up to date
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 241712 242176 4.48982 fd6f6962038702621df1967c9392ee52
.itext 249856 1892 2048 3.91702 a7ffcf7e48523c7d75b6708883f92c1f
.data 253952 4704 5120 2.22618 77d11468ef124427bf31a9dde8b8616f
.bss 262144 20376 0 0 d41d8cd98f00b204e9800998ecf8427e
.idata 282624 4006 4096 3.40588 8d254391d4e474827ae2358de031ef47
.tls 286720 16 0 0 d41d8cd98f00b204e9800998ecf8427e
.rdata 290816 24 512 0.143426 ecb4bd05a39bd2d0cb0eac9f0f871a53
.reloc 294912 22920 23040 4.59635 3c55d1176af26618f6da5f629882af8a
.rsrc 319488 3776000 3776000 5.38942 7000631b0f036ce9f9dbebe653c5cf91

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://isuperopt.com/inst?hid=e243879c1756999573da2194f5374d709eebe03b&sid=D70960D3-911C-4889-97CC6519E1266656&tr=221002115-DE-092&a=speejpSJlp6D1rabgYKego6ahIOF&adm=1&os=6.1&x64=0&sil=1&xtr=&xsid=&chid=&brid=&lpid=&ref=&st=201605241&e=200 104.28.19.88
hxxp://isuperopt.com/inst?sid=D70960D3-911C-4889-97CC6519E1266656&st=0&e=210 104.28.19.88
hxxp://bi.superpcdownload.net/t/i/su?sid=221002115-DE-092&dt=1478532293&gid=1DA9F63F-48BA-E04E-0A6C-7E5368351C0D&tz=2&ln=1&lc=0&bis=0&bief=0&biefx=0&bif=0&os=106&f=2432891174 107.6.170.117
hxxp://isuperopt.com/inst?sid=D70960D3-911C-4889-97CC6519E1266656&st=0&du=5569&e=400 104.28.19.88
hxxp://service.smartpcupdate.com/rpc/sendinstall?partner=SuperUpdater&build=3.2 176.9.2.105
hxxp://service.smartpcupdate.com/rpc/getdatabasezxw?arch=32&os=7 176.9.2.105
hxxp://d2.smartpcupdate.com/dbs/current_7_32_zxw.7z 173.192.91.180
dns.msftncsi.com 131.107.255.255


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /inst?hid=e243879c1756999573da2194f5374d709eebe03b&sid=D70960D3-911C-4889-97CC6519E1266656&tr=221002115-DE-092&a=speejpSJlp6D1rabgYKego6ahIOF&adm=1&os=6.1&x64=0&sil=1&xtr=&xsid=&chid=&brid=&lpid=&ref=&st=201605241&e=200 HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: isuperopt.com


HTTP/1.1 200 OK
Date: Mon, 07 Nov 2016 13:24:48 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: __cfduid=d98141dbe0c89f1efdea0caa780e8b6c31478525088; expires=Tue, 07-Nov-17 13:24:48 GMT; path=/; domain=.isuperopt.com; HttpOnly
Server: cloudflare-nginx
CF-RAY: 2fe11b8c713c4e60-DME
....



GET /inst?sid=D70960D3-911C-4889-97CC6519E1266656&st=0&e=210 HTTP/1.1

Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: isuperopt.com


HTTP/1.1 200 OK
Date: Mon, 07 Nov 2016 13:24:49 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: __cfduid=db8be0f3761c86f36de10eb953f8969f61478525089; expires=Tue, 07-Nov-17 13:24:49 GMT; path=/; domain=.isuperopt.com; HttpOnly
Server: cloudflare-nginx
CF-RAY: 2fe11b8e64374e60-DME
HTTP/1.1 200 OK..Date: Mon, 07 Nov 2016 13:24:49 GMT..Content-Type: te
xt/plain..Content-Length: 0..Connection: keep-alive..Set-Cookie: __cfd
uid=db8be0f3761c86f36de10eb953f8969f61478525089; expires=Tue, 07-Nov-1
7 13:24:49 GMT; path=/; domain=.isuperopt.com; HttpOnly..Server: cloud
flare-nginx..CF-RAY: 2fe11b8e64374e60-DME..
....



GET /inst?sid=D70960D3-911C-4889-97CC6519E1266656&st=0&du=5569&e=400 HTTP/1.1

Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: isuperopt.com


HTTP/1.1 200 OK
Date: Mon, 07 Nov 2016 13:24:54 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: __cfduid=df722402e37081102d82a34922443c3d21478525093; expires=Tue, 07-Nov-17 13:24:53 GMT; path=/; domain=.isuperopt.com; HttpOnly
Server: cloudflare-nginx
CF-RAY: 2fe11babe5e44e60-DME
HTTP/1.1 200 OK..Date: Mon, 07 Nov 2016 13:24:54 GMT..Content-Type: te
xt/plain..Content-Length: 0..Connection: keep-alive..Set-Cookie: __cfd
uid=df722402e37081102d82a34922443c3d21478525093; expires=Tue, 07-Nov-1
7 13:24:53 GMT; path=/; domain=.isuperopt.com; HttpOnly..Server: cloud
flare-nginx..CF-RAY: 2fe11babe5e44e60-DME..


HEAD /dbs/current_7_32_zxw.7z HTTP/1.1
Content-Type: text/html
Host: d2.smartpcupdate.com
Accept: text/html, */*
User-Agent: Mozilla/3.0 (compatible; Indy Library)


HTTP/1.1 200 OK
Server: nginx/1.10.1
Date: Mon, 07 Nov 2016 13:24:56 GMT
Content-Type: application/x-7z-compressed
Content-Length: 1091619
Last-Modified: Sun, 17 Jul 2016 17:42:36 GMT
Connection: keep-alive
ETag: "578bc38c-10a823"
Accept-Ranges: bytes
....



GET /dbs/current_7_32_zxw.7z HTTP/1.1

Content-Type: text/html
Host: d2.smartpcupdate.com
Accept: text/html, */*
User-Agent: Mozilla/3.0 (compatible; Indy Library)


HTTP/1.1 200 OK
Server: nginx/1.10.1
Date: Mon, 07 Nov 2016 13:24:56 GMT
Content-Type: application/x-7z-compressed
Content-Length: 1091619
Last-Modified: Sun, 17 Jul 2016 17:42:36 GMT
Connection: keep-alive
ETag: "578bc38c-10a823"
Accept-Ranges: bytes
7z..'...=...........Y.......5.R..).E.`...&d..&.1...!..m...H|..Z.=...t.
..{........=.lp.......O.X.....@&....$r~....G^..#E..#....d..L....S....9
.;}..k.........z.!.?c.#Lfke.z.Q.2...qw..b..H87,>W..T.z.....9....p.e
>.#H{.....Q>.../.$...96..us...x.U.!........1.....\......RW.b.t."
j.>Dpd.]..W.m@I..X.,CT.....Y....|2.f.>.a,.d4\......W....W......#
.N..A;..0..LW..8.....8... aL..,9..[cw0`..Ts..3J..8.y.|..l.zx..a.9....L
..3V....(.#..(.....'b.]..s/...]Fb.......v$...8...<......*'......go.
.S.o.;@ P.r..._....$x.......*..."........w....w....O. .@nIr...^3.R4..[
........\%. ..w......^..5...Z4)[.`>'...$.s.r=..;.W,.....b.S.`...g.&
gt;KN../...A.q.M..............[..8...C......793%X...=.T....,l4!,U.k.!.
~.-....[zqI...'..t..OW...bC6s.....#IS<.5V!Y|.....c5....Q.4 ..j...|.
E.........Q..F..bv".Z...g.vL.............$m2g.....w.....|=.2R.].i...Y@
.3...M...~qt...:.....~.,9a{..W.T[...o.}..........dp....=..............
...!^|._..H........|P.v...5.F....$@.....=..z...DQ...7...13.x<..J..~
..b.......UX...=......yW.*50.Kn..WT...pe..Qq.......wYo1bZ.!..s.QE...Z.
7CI.....V.S .@..9?.,'z....5&.1.3...k;.n.>..}........`...8X...\..1..
..G......i...9&..8.E2p'... .....D..G.6....S8..(1..L..(.[A.......j|]|..
...c..8...w..&.*|p..{P2.g..I...LT.....Gm...Q ......L....*.oT.`..N.5.qd
I@..ELBw>.<".....(. 9."Q..@py.D(....P..0..7...... uGP.......j=..
0|.... O........).U.....R=...v....;K.L[.....: ...>y..W2.}$.Lz.C n`?
.${..o?.i..a......%...Q.=....?..'L....*.f.q.$..%.f..nX*..E.A`/:Y..50.~
OI...Fy..$&b.!....S..\%..=....hc.5R"....T...\u...9v.1..N...|..E...

<<< skipped >>>

GET /rpc/sendinstall?partner=SuperUpdater&build=3.2 HTTP/1.1
Host: service.smartpcupdate.com
Accept: text/html, */*
User-Agent: Mozilla/3.0 (compatible; Indy Library)


HTTP/1.1 200 OK
Server: nginx/1.10.1
Date: Mon, 07 Nov 2016 13:25:58 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.0.9
12..{"ok":1,"error":0}..0..


GET /rpc/getdatabasezxw?arch=32&os=7 HTTP/1.1
Content-Type: text/html
Host: service.smartpcupdate.com
Accept: text/html, */*
User-Agent: Mozilla/3.0 (compatible; Indy Library)


HTTP/1.1 200 OK
Server: nginx/1.10.1
Date: Mon, 07 Nov 2016 13:25:59 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.0.9
81..{"ok":1,"error":0,"url":"http:\/\/d2.smartpcupdate.com\/dbs\/curre
nt_7_32_zxw.7z","file_hash":"3d69bbeec228d17e4199be3420e6360b"}..0..


GET /t/i/su?sid=221002115-DE-092&dt=1478532293&gid=1DA9F63F-48BA-E04E-0A6C-7E5368351C0D&tz=2&ln=1&lc=0&bis=0&bief=0&biefx=0&bif=0&os=106&f=2432891174 HTTP/1.1
Host: bi.superpcdownload.net
Accept: text/html, */*
User-Agent: Mozilla/3.0 (compatible; Indy Library)


HTTP/1.1 200 OK
Server: nginx/1.6.0
Date: Mon, 07 Nov 2016 13:24:52 GMT
Content-Type: application/octet-stream
Content-Length: 0
Connection: keep-alive
content-type: text/html


The Adware connects to the servers at the folowing location(s):

SUTray.exe_3172:

.idata
.rdata
P.reloc
P.rsrc
kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s_%d
EInvalidGraphicOperation
USER32.DLL
UhÛ
comctl32.dll
uxtheme.dll
OnKeyDown
OnKeyPress@
OnKeyUpd
Proportional
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeyword
crSQLWait
%s (%s)
imm32.dll
AutoHotkeys
Uh.ED
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreviewx
WindowState
tagMSG
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
OnActionExecute
1.2.3
Portable Network Graphics
hXXp://VVV.superpctools.com
pcspeedmaximizer.exe
PC Speed Maximizer\PCSpeedMaximizer.exe
PC Speed Maximizer Pro\PCSpeedMaximizerPro.exe
HomePageURL
AfterInstallURL
SupportURL
BuyNowURL
AdsDownloadURL
AdsBuyNowURL
AdsDownloadURL2
AdsBuyNowURL2
superoptimizer.exe
Super Optimizer\SuperOptimizer.exe
*.status
MAPI32.DLL
%s detected a new device attached to your PC.
English.ini
French.ini
German.ini
Spanish.ini
Italian.ini
Portuguese.ini
Danish.ini
Dutch.ini
Swedish.ini
Polish.ini
Russian.ini
Brazilian.ini
Finnish.ini
Norwegian.ini
Japanese.ini
Chinese.ini
Czech.ini
Arabic.ini
StartWithWindows
s_Exec
Backup\*.*
Drivers\*.*
\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
UninstallURL
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
RegFlushKey
RegCreateKeyExA
GetCPInfo
version.dll
gdi32.dll
SetViewportOrgEx
UnhookWindowsHookEx
SetWindowsHookExA
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
shell32.dll
ShellExecuteA
shfolder.dll
0 0$0(0,000
?"?&?*?.?2?6?:?>?
?"?,?4?@?
:3: ;.<=<
5-6165696@6
0$1(1,101
? ?$?(?,?
9 989@9\9
9-95999L9u9}9
7‰8d8
? ?$?(?,?2?
8 8$8(8,80868
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
;|||'{{{
&|||!{{{
 |||#{{{
Paint.NET v3.5.100
paint.net 4.0;
KWindows
UrlMon
%sTray
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
(%s found NN outdated drivers on your PC.
-%s detected a new device attached to your PC.
<assemblyIdentity version="1.0.0.0"
name="SmartDriverUpdater.exe"
<requestedExecutionLevel
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.7The png image could not be loaded from the resource ID.oSome operation could not be performed because the system is out of resources. Close some windows and try again.OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.
No help keyword specified.jThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.
Description: BThe "Portable Network Graphics" image contains an invalid palette.
The file being readed is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corruped, try obtaining it again.nThis "Portable Network Graphics" image is not supported or it might be invalid.
This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Property %s does not exist
Unsupported clipboard format
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Unable to write to %s
Invalid stream format$''%s'' is not a valid component name
Operation not supported
External exception %x
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d
3.1.0.5

SuperUpdater.exe_1588:

.idata
.edata
P.tls
.rdata
P.reloc
P.rsrc
kernel32.dll
Windows
HKEY
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
.Owner
EInvalidGraphicOperation
comctl32.dll
USER32.DLL
uxtheme.dll
PasswordChar
OnKeyDownh
OnKeyPress
OnKeyUp@
ssHorizontal
OnKeyUp
Proportional
%s%s%s%s%s%s%s%s%s%s
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeywordP
crSQLWait
%s (%s)
imm32.dll
OnExecute
HelpKeywordl
AutoHotkeys
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState
tagMSG
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
1.2.3
Portable Network Graphics
Uh.QH
Uh%sH
MAPI32.DLL
vsReport
TComboBoxExEnumerator
ole32.dll
OnActionExecute
%s, ClassID: %s
%s, ProgID: "%s"
WNNC_NET_FTP_NFS
olepro32.dll
shell32.dll
\\.\vwin32
shlwapi.dll
Mpr.dll
Uh.LJ
D:\SmartPC\Components\EasyListview\Common Library\Source\MPShellUtilities.pas
To show a Context Menu using TNamespace you must pass a valid Owner TWinControl
THKeyArray
TCommonShellExecuteThreadU
D:\SmartPC\Components\EasyListview\Common Library\Source\MPThreadManager.pas
TCommonKeyState
cksShift
TCommonKeyStates
D:\SmartPC\Components\EasyListview\Common Library\Source\MPCommonUtilities.pas
user32.dll
gdi32.dll
advapi32.dll
Userenv.dll
ShellExecuteExW
ShellExecuteW
GetWindowsDirectoryW
RegOpenKeyW
RegOpenKeyExW
SHFileOperationW
D:\SmartPC\Components\EasyListview\Source\EasyListviewAccessible.pas
TEasyAccessibleManager.Create not a TCustomEasyListview type
TEasyGroupAccessibleManager.Create not a TEasyGroup type
TEasyItemAccessibleManager.Create not a TEasyItem type
TEasyColumnAccessibleManager.Create not a TEasyColumn type
TEasyHeaderAccessibleManager.Create not a TEasyHeader type
elsReport
elsReportThumb
TAutoGroupGetKeyEvent
TColumnGetImageIndexEvent
TColumnSetImageIndexEvent
KeyState
KeyStates
TGroupGetImageIndexEvent
TGroupSetImageIndexEvent
HintWindowShown
TItemGetGroupKeyEvent
GroupKey
TItemGetImageIndexEvent
TItemSetGroupKeyEvent
TItemSetImageIndexEvent
MouseMsg
TEasyKeyActionEvent
EscapeKeyPressed
TEasyViewReportItem
TEasyViewReportThumbItem
TEasyGridReportGroup
TEasyGridReportThumbGroup
TEasyCellSizeReport
TEasyCellSizeReportt
TEasyCellSizeReportThumb
ReportThumb|
Report
AlwaysShow
OnAutoGroupGetKey|
OnItemGetGroupKey
OnItemSetGroupKeyD)L
OnKeyAction
D:\SmartPC\Smart Driver Updater\Version 3_1\EasyListview.pas
Can not find TEasyGroups.AdjacentItem of an Invisible Item
EasyListview.Header
TNT Internal Error: TWideComponentHelper.Create should never be encountered.
D:\SmartPC\Components\Delphi Unicode Controls\Source\TntClasses.pas
!"#$%&*;<=>@[]^_`{|}
D:\SmartPC\Components\Delphi Unicode Controls\Source\TntControls.pas
Internal Error: SubClassUnicodeControl.Control is not Unicode.
.UnicodeClass
TntUnicodeVcl.DestroyWindow
D:\SmartPC\Components\Delphi Unicode Controls\Source\TntActnList.pas
D:\SmartPC\Components\Delphi Unicode Controls\Source\TntStdCtrls.pas
D:\SmartPC\Components\Delphi Unicode Controls\Source\TntForms.pas
D:\SmartPC\Components\Delphi Unicode Controls\Source\TntMenus.pas
Internal Error: SyncHotKeyPosition Failed ("%s" <> "%s").
ESQLiteException
TSQLiteDatabase
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
"%s" : %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
select [sql] from sqlite_master where [type] = 'table' and lower(name) = '
SQLite is Busy
<%s> invalid zipfile
Shell.Application
<%s> invalid source
<%s> invalid target folder
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
127.0.0.1
TIdSocketListWindows
TIdStackWindowsU
IdStackWindows
%s, %.2d %s %.4d %s %s
%s, %d %s %d %s %s
.aiff=audio/x-aiff
.au=audio/basic
.mid=midi/mid
.mp3=audio/x-mpg
.m3u=audio/x-mpegurl
.qcp=audio/vnd.qcelp
.ra=audio/x-realaudio
.wav=audio/x-wav
.gsm=audio/x-gsm
.wax=audio/x-ms-wax
.wma=audio/x-ms-wma
.ram=audio/x-pn-realaudio
.mjf=audio/x-vnd.AudioExplosion.MjuiceMediaFile
.bmp=image/bmp
.gif=image/gif
.jpg=image/jpeg
.jpeg=image/jpeg
.jpe=image/jpeg
.pict=image/x-pict
.png=image/x-png
.svg=image/svg-xml
.tif=image/x-tiff
.rf=image/vnd.rn-realflash
.rp=image/vnd.rn-realpix
.ico=image/x-icon
.art=image/x-jg
.pntg=image/x-macpaint
.qtif=image/x-quicktime
.sgi=image/x-sgi
.targa=image/x-targa
.xbm=image/xbm
.psd=image/x-psd
.pnm=image/x-portable-anymap
.pbm=image/x-portable-bitmap
.pgm=image/x-portable-graymap
.ppm=image/x-portable-pixmap
.rgb=image/x-rgb
.xbm=image/x-xbitmap
.xpm=image/x-xpixmap
.xwd=image/x-xwindowdump
.xml=text/xml
.uls=text/iuls
.txt=text/plain
.rtx=text/richtext
.wsc=text/scriptlet
.rt=text/vnd.rn-realtext
.htt=text/webviewhtml
.htc=text/x-component
.vcf=text/x-vcard
.avi=video/x-msvideo
.flc=video/flc
.mpeg=video/x-mpeg2a
.mov=video/quicktime
.rv=video/vnd.rn-realvideo
.ivf=video/x-ivf
.wm=video/x-ms-wm
.wmp=video/x-ms-wmp
.wmv=video/x-ms-wmv
.wmx=video/x-ms-wmx
.wvx=video/x-ms-wvx
.rms=video/vnd.rn-realvideo-secure
.asx=video/x-ms-asf-plugin
.movie=video/x-sgi-movie
.wmd=application/x-ms-wmd
.wms=application/x-ms-wms
.wmz=application/x-ms-wmz
.p7b=application/x-pkcs7-certificates
.p7r=application/x-pkcs7-certreqresp
.qtl=application/x-quicktimeplayer
.rtsp=application/x-rtsp
.swf=application/x-shockwave-flash
.sit=application/x-stuffit
.tar=application/x-tar
.man=application/x-troff-man
.urls=application/x-url-list
.zip=application/x-zip-compressed
.cdf=application/x-cdf
.fml=application/x-file-mirror-list
.fif=application/fractals
.spl=application/futuresplash
.hta=application/hta
.hqx=application/mac-binhex40
.doc=application/msword
.pdf=application/pdf
.cer=application/x-x509-ca-cert
.crl=application/pkix-crl
.ps=application/postscript
.sdp=application/x-sdp
.setpay=application/set-payment-initiation
.setreg=application/set-registration-initiation
.smil=application/smil
.ssm=application/streamingmedia
.xfdf=application/vnd.adobe.xfdf
.fdf=application/vnd.fdf
.xls=application/x-msexcel
.sst=application/vnd.ms-pki.certstore
.pko=application/vnd.ms-pki.pko
.cat=application/vnd.ms-pki.seccat
.stl=application/vnd.ms-pki.stl
.rmf=application/vnd.rmf
.rm=application/vnd.rn-realmedia
.rnx=application/vnd.rn-realplayer
.rjs=application/vnd.rn-realsystem-rjs
.rmx=application/vnd.rn-realsystem-rmx
.rmp=application/vnd.rn-rn_music_package
.rsml=application/vnd.rn-rsml
.vsl=application/x-cnet-vsl
.tgz=application/x-compressed
.dir=application/x-director
.gz=application/x-gzip
.uin=application/x-icq
.hpf=application/x-icq-hpf
.pnq=application/x-icq-pnq
.scm=application/x-icq-scm
.ins=application/x-internet-signup
.iii=application/x-iphone
.latex=application/x-latex
.nix=application/x-mix-transfer
.wbmp=image/vnd.wap.wbmp
.wml=text/vnd.wap.wml
.wmlc=application/vnd.wap.wmlc
.wmls=text/vnd.wap.wmlscript
.wmlsc=application/vnd.wap.wmlscriptc
.css=text/css
.htm=text/html
.html=text/html
.shtml=server-parsed-html
.sgm=text/sgml
.sgml=text/sgml
ftpTransfer
ftpReady
ftpAborted
ClientPortMinl
ClientPortMax
Port
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
saUsernamePassword
Passwordl
Uh%FR
0.0.0.1
TIdTCPStream
End of stream: %s at %d
TIdTCPConnection
TIdTCPConnection<[R
IdTCPConnection
EIdTCPConnectionError
EIdObjectTypeNotSupported
password
Password
IdHTTPHeaderInfo
ProxyPasswordl
ProxyPort
Mozilla/3.0 (compatible; Indy Library)
libeay32.dll
ssleay32.dll
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_get_peer_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
X509_STORE_CTX_get_current_cert
des_set_key
sslvrfFailIfNoPeerCert
TPasswordEvent
Certificate
RootCertFile
CertFile
KeyFile
OnGetPassword
EIdOSSLLoadingRootCertErrorP
EIdOSSLLoadingCertError
EIdOSSLLoadingKeyError
TIdTCPClient
TIdTCPClient$
IdTCPClient
BoundPort
PortU
CommentURL
UhH%S
Unsupported operation.
Content-Disposition: form-data; name="%s"; filename="%s"
Content-Type: %s
Content-Disposition: form-data; name="%s"
TIdHTTPMethod
IdHTTP
TIdHTTPOption
TIdHTTPOptions
TIdHTTPProtocolVersion
TIdHTTPOnHeadersAvailable
TIdHTTPOnRedirectEvent
TIdHTTPResponse
TIdHTTPResponseH1S
TIdHTTPRequest
TIdHTTPProtocol
TIdCustomHTTP
TIdHTTP
TIdHTTPD4S
HTTPOptions
Port4
EIdHTTPProtocolException
HTTPS
https
This request method is supported in HTTP 1.1
HTTP/1.0 200 OK
HTTP/
TMonochromeLookup
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
cfgmgr32.dll
CM_Delete_Class_Key
CM_Delete_Class_Key_Ex
CM_Delete_DevNode_Key
CM_Delete_DevNode_Key_Ex
CM_Get_Class_Key_NameA
CM_Get_Class_Key_NameW
CM_Get_Class_Key_Name_ExA
CM_Get_Class_Key_Name_ExW
CM_Open_Class_KeyA
CM_Open_Class_KeyW
CM_Open_Class_Key_ExA
CM_Open_Class_Key_ExW
CM_Open_DevNode_Key
CM_Open_DevNode_Key_Ex
7z.dll
Error loading library %s
%s is not a 7z library
%s is not a Format library
PSAPI.dll
Common.LoggerWindow
_prev.log
DriverUpdater.dpr
Common.Logger
c:\debug.log.pc
ERROR (%s): %s
MESS: %s
PARAMS: %s
LAST_ERR (%d -> %s): %s
LAST_ERR (%d, %s): %s
%s%s%s%s
%s: %s
%s: %s PARAMS: %s
program.log
program_error.log
Multiple errors: %s Count: %d
Multiple logs: %s Count: %d
%s %s
XLog.Execute
XSettings.GetDebugPrivilege
XProcess.IsWow64Process
XFile.LogicalDriveStringsInit
XFile.ExpandRawPath
Psapi.dll
XProcess.GetProcessStartTime
XFile.DeleteFolder
SHFileOperation fail:
c:\debug.pc
CERTANCE
%d.%d.%d.%d
Setupapi.dll
CM_PROB_DRIVER_SERVICE_KEY_INVALID
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
FILE_CHARACTERISTIC_WEBDAV_DEVICE
DNF_INDEXED_DRIVER
SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSettings\
DriverKey=
OpenKey fail
Snapshot.ini
d2.smartpcupdate.com
hXXp://d2.smartpcupdate.com/rpc/sendsnapshot
*.status
Scan.ini
DevicesPlus.ini
.status
5.2.3790.
5.1.2600.
6.0.6000.
6.0.6001.
6.0.6002.
6.1.6002.
6.1.7100.
6.1.7600.
6.1.7601.
6.2.8400.
6.2.9200.
6.3.9600.
6.3.9431.
EnumKey=
SetupDiEnumDriverInfoW fail, EnumKey=
SELECT * FROM hardids JOIN drivers ON hardids.id = drivers.hardid_full_index JOIN files ON files.id = drivers.file_id JOIN vendors ON vendors.id = drivers.vendor_id JOIN versions ON versions.id = drivers.version_id LEFT JOIN installers ON installers.id = drivers.installer_id JOIN devices_descriptions ON devices_descriptions.id = drivers.device_id WHERE hardids.hardid = "%s"
SELECT * FROM hardids JOIN drivers ON hardids.id = drivers.hardid_index JOIN files ON files.id = drivers.file_id JOIN vendors ON vendors.id = drivers.vendor_id JOIN versions ON versions.id = drivers.version_id LEFT JOIN installers ON installers.id = drivers.installer_id JOIN devices_descriptions ON devices_descriptions.id = drivers.device_id WHERE hardids.hardid = "%s"
AND os=%s
Drivers64.db
Drivers32.db
Devices.ini
Cannot delete and rename DevicesPlus.ini file
Cannot delete and rename Scan.ini file
EnumKey
0.0.0.0
ClassKey
SOFTWARE\Microsoft\Windows\CurrentVersion
DevWebSite
OpenKeyReadOnly 3 fail
OpenKeyReadOnly 3 fail
OpenKeyReadOnly 2 fail
OpenKeyReadOnly 2 fail
{8ECC055D-047F-11D1-A537-0000F8753ED1}
D:\SmartPC\#Core\WbemScripting_TLB.pas
DefaultInterface is NULL. Component is not connected to Server. You must call 'Connect' or 'ConnectTo' before this operation
Common.RestorePoint
TSWbemLocator.Create fail
EOleException %s %x
wmiLocator.ConnectServer fail
wmiLocator.ConnectServer 2 fail
%s%s%s%s%s%s
%s%s%s
%s%s%s%s%s%s%s%s
TSchedulerStartupRegularItem.ItemRead
SrClient.dll
service.smartpcupdate.com
hXXp://service.smartpcupdate.com/rpc/senddriverstats
TUploadThread.Execute
*.dul
DriverKey empty
GetCurrentSnapshot.OnFail
EnumKey empty
GetCurrentSnapshot.FindDevice fail:
Temp.ini
GetCurrentSnapshot.GetDriverParameters fail:
Device.Scan empty
SaveInstallLogs.AddSetupAPIlogs
Windows=
Devices.Count = 0
setupapi.log
Inf\setupapi.app.log
Inf\setupapi.dev.log
C:\Intel\Logs\IntelChipset.log
explorer.exe
firefox.exe
chrome.exe
iexplore.exe
opera.exe
msiexec.exe
drvinst.exe
rundll32.exe
setup.exe
IsThereVisibleWindows.EnumWindowsProc
IsThereVisibleWindows
No visible windows for 30 seconds
No visible windows
There are visible windows:
ShellExecuteAndWait: begin: Path=
ShellExecuteAndWait: GetProcessId fail:
ShellExecuteAndWait: lpExecInfo.hProcess = 0:
ShellExecuteAndWait: ShellExecuteEx fail:
readme.txt
installmanagerapp.exe
InstallExeOrMsiDriver: begin: FName=
InstallExeOrMsiDriver: File not found:
InstallExeOrMsiDriver: Install disabled:
autorun.exe
InstallExeOrMsiDriver: CreateProcessAndWait failed
InstallExeOrMsiDriver: ShellExecuteAndWait failed
stub64.exe
newdev.dll
advpack.dll
IncompatibleWindowsLogoError
NonSupportedMethod
advpack.dll,LaunchINFSectionEx "
InstallInfDriver: Direct install advpack.dll,LaunchINFSectionEx success, for
InstallInfDriver: Direct install advpack.dll,LaunchINFSectionEx success but nothing changed, for
InfDefaultInstall.exe
CoreInstall.UnzipCallback
isInstalling exe/msi from zip: Cancelled
isInstalling exe/msi: Cancelled
empty EnumKey field
.restart
Restart of Windows detected
*.pre
CreateBaseIndexes
PCInfo.ini
program_prev.log
program_error_prev.log
TGenerateThread.Execute
TInstallThread.Execute
hXXp://VVV.superpctools.com
pcspeedmaximizer.exe
PC Speed Maximizer\PCSpeedMaximizer.exe
PC Speed Maximizer Pro\PCSpeedMaximizerPro.exe
HomePageURL
AfterInstallURL
SupportURL
BuyNowURL
AdsDownloadURL
AdsBuyNowURL
AdsDownloadURL2
AdsBuyNowURL2
superoptimizer.exe
Super Optimizer\SuperOptimizer.exe
EInvalidGridOperation
goAlwaysShowEditor
doKeyColFixed
TKeyOption
keyEdit
keyAdd
keyDelete
keyUnique
TKeyOptions
KeyName
KeyValue
KeyOptions
KeyDesc\
%s=%s
;!199{199
;0!8&2{199
"<;=!!%{199
Windows 95
Windows 95 OSR-2
Windows 98
Windows 98 SE
Windows ME
Windows 9x New
Windows NT 3
Windows NT 4
Windows 2000
Windows XP
Windows 2003
Windows Vista
Windows 2008
Windows 7
Windows 2008 R2
Windows 8
Windows Server 8
Windows NT New
user.exe
TMsgHandlers
madToolsMsgHandlerWindow
>0';0974&0{199
msvcrt.dll
VVV.madshi.net
dbghelp.dll
Uh.kZ
4.0.10
ntdll.dll
The import table is invalid.
WindowsLogo
ReportLeaks
UploadViaHttp
HttpServer
HttpSsl
HttpPort
HttpAccount
HttpPassword
BugTrPassword
MailAsSmtpServer
MailAsSmtpClient
SmtpServer
SmtpSsl
SmtpTls
SmtpPort
SmtpAccount
SmtpPassword
bugreport.mbr
screenshot.png
ExceptMsg
FrozenMsg
BitFaultMsg
send bug report
save bug report
print bug report
show bug report
%appname%, %exceptMsg%
bug report
please find the bug report attached
Sending bug report...
PrepAttMsg
MxLookMsg
ConnMsg
SendMailMsg
FieldMsg
SendAttMsg
SendFinalMsg
SendFailMsg
Sorry, sending the bug report didn't work.
TDABugReportCallback
TDABugReportCallbackOO
madExceptIde_.bpl
wininet.dll
VVV.google.com
SMTP:
mapi32.dll
IpHlpApi.dll
A.ROOT-SERVERS.NET
K.ROOT-SERVERS.NET
VVV.madshi.net_multipart_boundary
TSmtpU
LOGIN
AUTH LOGIN
security.dll
secur32.dll
TWinHttp
winhttp.dll
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpSetOption
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryAuthSchemes
WinHttpSetCredentials
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCloseHandle
/api.xml
<url>
?cmd=
/xmlrpc.cgi
Bugzilla.version
Product.get_enterable_products
Product.get
Bug.fields
Bugzilla_login
Bugzilla_password
Bug.create
Bug.add_attachment
/api/soap/mantisconnect.php
<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="hXXp://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><ns1:
</username><password xsi:type="xsd:string">
</password>
*.txt
TSendBugReportExRec
wtsapi32.dll
idapi32.dll
kernelbase.dll
madExcept32.dll
c:\sources\madshi\madExcept32.dll
ReportLeaksNow
GetLeakReport
ShowLeakReport
madExcept32.dll has the wrong version.
coreide70.bpl
ReportFault
FaultRep.dll
internal error. please notify bug@madshi.net
@System@@StartExe$qqrp23System@PackageInfoTablep17System@TLibModule
%Program Files% (x86)\Mozilla Firefox\firefox.exe
%Program Files%\Mozilla Firefox\firefox.exe
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
PathToExe
%Program Files% (x86)\Google\Chrome\Application\chrome.exe
%Program Files%\Google\Chrome\Application\chrome.exe
C:\Users\
\AppData\Local\Google\Chrome\Application\chrome.exe
Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
%Program Files% (x86)\Internet Explorer\iexplore.exe
%Program Files%\Internet Explorer\iexplore.exe
Software\Opera Software
\opera.exe
\launcher.exe
%Program Files% (x86)\Opera\Opera.exe
%Program Files%\Opera\Opera.exe
%Program Files% (x86)\Opera\launcher.exe
%Program Files%\Opera\launcher.exe
BrowserExe
%Program Files% (x86)\Safari\Safari.exe
%Program Files%\Safari\Safari.exe
http\shell\open\command
SOFTWARE\Microsoft\Windows\CurrentVersion\Settings\Super Updater
Tray.exe
\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
FormKeyDown
SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation
\oeminfo.ini
Check the email you received after you purchased the product for the correct license key.
Your license key will look like this:
hXXp://service.smartpcupdate.com/rpc/sendspmpurchase
hXXp://service.smartpcupdate.com/rpc/sendpurchase
&key=
hXXp://service.smartpcupdate.com/rpc/sendspminstall
hXXp://service.smartpcupdate.com/rpc/sendspmuninstall
hXXp://service.smartpcupdate.com/rpc/sendinstall
hXXp://service.smartpcupdate.com/rpc/senduninstall
%s is a separate product and requires a different license key.
to purchase %s.
IdHTTP10
Enter License Key
Please enter your %s license key below.
Do you have a License Key?
If you already have a License Key, please enter it in the form below and click "Activate Now".
License key
Do you need a License Key?
We recommend that you upgrade to the full version of %s
To purchase %s and obtain a license key click
The license key you entered is for %s.
Licensing key has reached its usage limit!
LicenseKey
Thank you for registering %s!
Register %s now to download and install new drivers.
Would you like to register %s?
Current Windows version
Backuped driver Windows version
We NOT reccomend your use this driver for current Windows version.
5 (Windows XP)
6 (Windows Vista)
7 (Windows 7)
8 (Windows 8)
IdHTTP18
HTTPWorkBegin
HTTPWork
HTTPWorkEnd
CreateBaseIndexesOld
ProxyLogin
ProxyPassword
hXXp://service.smartpcupdate.com/rpc/getdatabasecxw?arch=%d&os=%d
hXXp://service.smartpcupdate.com/rpc/getdatabasezxw?arch=%d&os=%d
hXXp://service.smartpcupdate.com/rpc/getdatabasex%d_wd
IdHTTP1.Get 1 fail
IdHTTP1.Head fail
IdHTTP1.Get 2 fail
Drivers32prev.db
Drivers64prev.db
Drivers.db
CreateBaseIndexes success
SetupFiles.txt
%s <%s>
=?WINDOWS
atLogin
IdSMTP
TIdSMTP
LOGIN
IdSMTP1<
Report a problem with a new driver!
mail.smartpctools.com
apps@smartpctools.com
support@smartpctools.com
support@pcutilitiespro.com
report.zip
IdHTTP1
Thank you for trying %s!
Your feedback is very valuable and will help us create better products. Please let us know why you did not register %s:
%s did not find the driver I was looking for
hXXp://service.smartpcupdate.com/rpc/feedback?reason=
Keyboard
Ports
MultiPortSerial
IdHTTP0
IdHTTP11
HTTP0Work
HTTP0Work2
HTTP1Start
HTTP2Start
HTTP3Start
HTTP4Start
HTTP5Start
HTTP1Work
HTTP2Work
HTTP3Work
HTTP4Work
HTTP5Work
InstallExeDriver
actDebugExecute
Windows 8.1
update1.smartpcupdate.com
hXXp://service.smartpcupdate.com/rpc/candownloadfiles?partner=
English.ini
French.ini
German.ini
Spanish.ini
Italian.ini
Portuguese.ini
Danish.ini
Dutch.ini
Swedish.ini
Polish.ini
Russian.ini
Brazilian.ini
Finnish.ini
Norwegian.ini
Japanese.ini
Chinese.ini
Czech.ini
Arabic.ini
UninstallURL
Welcome to %s
%s found
Login
Product information and support link
Support
InstallLog.ini
UpdateWindowShown
StartWithWindows
s_SmartExec
Software\Microsoft\Windows\CurrentVersion\Settings\
UserKey
TForm1a.WMQueryEndSession
Vendors.txt
ScanExecuted
hXXp://
Scan.gif
TForm1a.Callback: incorrect Status
drivers.db
Exclusions.txt
1.0.0.0
%d new drivers in %d driver packages found for your computer
hXXp://update1.smartpcupdate.com/rpc/getlastupdate
hXXp://service.smartpcupdate.com/rpc/getstatus?exedate=
hXXp://update1.smartpcupdate.com/rpc/sendinstall?partner=
hXXp://update1.smartpcupdate.com/rpc/sendreport?filename=
hXXp://update1.smartpcupdate.com/rpc/sendstats?partner=
This version is no longer supported!
UpdateList.txt
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
hXXp://VVV.google.com/search?hl=en&q=
.SYS.DLL.INF.CAT.NFO.EXE.REG.AX.DRV.CPL
RUNDLL32.EXE
LAYOUT.INF
regedit.exe
Backups.ini
\Enum.reg" "HKEY_LOCAL_MACHINE\
\Classes.reg" "HKEY_LOCAL_MACHINE\
\*.inf
\Log.txt
backups.ini
/s zipfldr.dll
regsvr32.exe
\.zip\CompressedFolder\ShellNew
\Classes.reg
\Classes.reg"
\Enum.reg
\Enum.reg"
*.exe
AUTORUN.EXE
32.EXE
64.EXE
*.inf
01-01-2012
TForm1a.InstallCallback
RunExe
TForm1a.HTTP1Start
hXXp://service.smartpcupdate.com/downloads/
Form1a.HTTP1Start
TForm1a.HTTP2Start
Form1a.HTTP2Start
TForm1a.HTTP3Start
Form1a.HTTP3Start
TForm1a.HTTP4Start
Form1a.HTTP4Start
TForm1a.HTTP5Start
Form1a.HTTP5Start
TForm1a.HTTP1Work
TForm1a.HTTP2Work
TForm1a.HTTP3Work
TForm1a.HTTP4Work
TForm1a.HTTP5Work
s_Exec
Register %s
hXXp://service.smartpcupdate.com/rpc/senduninstall?partner=
Backup\*.*
Drivers\*.*
\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CreateBaseIndexes fail
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
6666666666666666
#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%<!"%$%&%(%*% %-%/%1%3%5%7%9%;$=%?%A%D%F%H%J%K%L%M%N%O%R%U%X%[%^%_%`%a%b%d%f%h%i%j%k%l%m%o%s% !,!
P%S%V%Y%\%
?456789:;<=
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123456789:;<=>?
&'()* ,-./0123456789:;<=>?
GetKeyboardType
RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyA
RegFlushKey
RegEnumKeyExA
RegCreateKeyExW
RegCreateKeyExA
GetWindowsDirectoryA
GetCPInfo
CreatePipe
version.dll
SetViewportOrgEx
SetViewportExtEx
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExA
SetKeyboardState
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetKeyNameTextA
GetAsyncKeyState
ExitWindowsEx
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
ShellExecuteExA
ShellExecuteA
SHFileOperationA
comdlg32.dll
oleacc.dll
sqlite3.dll
sqlite3_finalize
sqlite3_column_type
sqlite3_column_text
sqlite3_column_int
sqlite3_column_double
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_step
sqlite3_column_decltype
sqlite3_column_name
sqlite3_column_count
sqlite3_prepare
sqlite3_free
sqlite3_errcode
sqlite3_errmsg
sqlite3_close
sqlite3_open
shfolder.dll
winmm.dll
wsock32.dll
MainProgram.exe
6#6'6 6/63676;6?6
4%7`7~8"9
3 4$4(4,404
3(4,44484
6573849
1S1a1y1
7"7&7*7.72767
< <$<(<@<_<
> >$>(>,>
2"2&2*2.22282
6#6'6/646
=%>)>->4>
>$?(?,?0?4?
5*6/63676<6
<#<'< <0<
5#5'5 5/545
5.62666:6@6
6/73777;7@7
2034383<3
: :$:(:,:0:4:8:\:
>">9>[>}>
?#?'? ?/?
?(?,?0?4?8?<?@?
1"2&2*2.22262:2>2
9 9$9(9,9
> >$>(>,>0>4>8><>`>
5!5*535<5
> >^>'?`?}?
;,<0<4<8<<<@<
: :$:(:,:4:
6|7H7f7
;!<&< <=<
4&4 4=4}5
353:3?3\3
8(9,9094989
1$1,181@1
< <$<(<,<0<4<
? ?%?@?`?
0#0(0-0?0
5!6-64696e6q6x6}6
7"7)7.7=7
=!=&=/=6=;=
9™9F9L9|9
:$:):2:9:>:[:
6o6m6
;&;/;6;;;
<&</<6<;<
1-1A1U1i1}1Z2
= =$=(=,=0=
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
;|||'{{{
&|||!{{{
 |||#{{{
paint.net 4.0;
[PsQL
'-C7}
SS`-0%c
^.Cco
*Q.wI
.HT,-
S%Fxb
]}k.CU
=f!E%fPm
$4.CZ
_|sG.jn
(qa$%c&
R%XQX
G%%C|
211y%3S3
v^QH.hBU7P
]YY-g.TT
s_.ZwLVh<E
]p.lIV
.FRr2=^
n)=3GJ%8X
.MB(A
.lT^n
#IdSMTP
KWindows
IdTCPStream
UrlMon
Driver.CoreInstall
}Common.Params
eCommon.LoggerWindow
CCommon.Utils
oDriver.Utils
Driver.Core
Driver.CoreResult
bDriver.CoreSnapshot
]Driver.CoreDevices
Driver.CoreDevicesHelpers
SQLiteTable3
SQLite3
0IdHTTPHeaderInfo
 IdTCPServer
TntWindows
K.fqq
K%SE}
NõnY
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
All windows
%Select name, location and backup type
Items.Strings
%Select the drivers you wish to backup
EditManager.Font.Charset
EditManager.Font.Color
EditManager.Font.Height
EditManager.Font.Name
EditManager.Font.Style
GroupFont.Charset
GroupFont.Color
GroupFont.Height
GroupFont.Name
GroupFont.Style
Header.Columns.Items
Header.Font.Charset
Header.Font.Color
Header.Font.Height
Header.Font.Name
Header.Font.Style
Header.Height
ImageList1)PaintInfoGroup.MarginBottom.CaptionIndent
Selection.FullRowSelect
Groups.Items
%Driver backup successfully completed!
$Product information and support link
Support:
Version: %s
Header.ShowInAllViews
Header.Visible
PaintInfoGroup.Expandable
)PaintInfoGroup.MarginBottom.CaptionIndent
%Save downloded drivers to this folder
Picture.Data
Webcam drivers
Windows system drivers
Keyboard drivers
ProxyParams.BasicAuthentication
ProxyParams.ProxyPort
Request.ContentLength
Request.ContentRangeEnd
Request.ContentRangeStart
Request.ContentType
Request.Accept
Request.BasicAuthentication
Request.UserAgent
&Mozilla/3.0 (compatible; Indy Library)
OnKeyDown
.NN outdated drivers have been found on your PC
"Would you like to register %s now?
FTo immediately download and fix these drivers you need to register %s.
]If you already have a License Key, please enter it in the form below and click "Activate Now"
.To purchase %s and obtain a license key click
YCheck the email you received after you purchased the product for the correct license key.
&Your license key will look like this:
'The license key you entered is for %s.
>%s is a separate product and requires a different license key.
BWe NOT reccomend your use this driver for current Windows version.
Current Windows version:
Backuped driver Windows version:
"Report a problem with a new driver
IdSMTP1
xYour feedback is very valuable and will help us create better products. Please let us know why you did not register %s:
,%s did not find the driver I was looking for
<assemblyIdentity version="1.0.0.0"
name="program.exe"
<requestedExecutionLevel
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
PIDLs to operate on are not siblings of the Namespace doing the operation.
Unable to find RegSvr32.exe executable.
RegSvr32.exe
Unspecified error (%d) from %s.
miranda32.exe
.jdbg
madExcept.HandleContactForm
madExcept.HandleScreenshotForm
.madExcept
%exceptMsg%
%bugReport%
Úte%
Útetime%
%computerName%
Þsktop%
%userappdata%
%commonappdata%
screenShot.bmp
Tcpip\Parameters
VxD\MSTCP
.jpeg
hXXps://
%userappdata%\
BugReport
screenShot.png
operating system
<tr><td><button onClick="history.back();" style="height:19.5pt;"> 
<button onClick="document.getElementById('bugReport').style.visibility='visible';this.style.visibility='hidden';" style="height:19.5pt;"> 
<textarea id="bugReport" readonly cols="80" rows="20" style="width:100%;height:100%;
Software\Microsoft\Windows
GetThreadReport
GetCpuRegisters
\madExcept\Dlls\madExcept32.dll
66006666
AInternal error: Extension Instance does not match Extension Label,Unsupported Application Extension block size
Unknown GIF block type'Object type not supported for operation
Unsupported PixelFormat
Invalid stream operation
Unsupported GIF version7Invalid number of colors specified in Screen Descriptor6Invalid number of colors specified in Image Descriptor
Invalid extension introducerúiled to allocate memory for GIF DIB
Command not supported.
Address type not supported.$Error accepting connection with SSL.
Error creating SSL context. Could not load root certificate.
Could not load certificate.#Could not load key, check password.
SSL status: "%s"
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
Chunk StartedDThis authentication method is already registered with class name %s.
%s is not a valid service.
Socket Error # %d
%s is not a valid IP address.
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
@ Outside address*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
PLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.
File "%s" not found1Only one TIdAntiFreeze can exist per application."%d: Circular links are not allowed
Object type not supported.
Date is less than minimum of %s4You must be in ShowCheckbox mode to set to this date#Failed to set calendar date or timeúiled to set maximum selection range$Failed to set calendar min/max rangeúiled to set calendar selected range
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalid
This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.
There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.7The png image could not be loaded from the resource ID.oSome operation could not be performed because the system is out of resources. Close some windows and try again.OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.
RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL
Date exceeds maximum of %s
No help keyword specified.jThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.
Description: BThe "Portable Network Graphics" image contains an invalid palette.
The file being readed is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corruped, try obtaining it again.nThis "Portable Network Graphics" image is not supported or it might be invalid.
%goColMoving is not a supported option%Key may not contain equals sign ("=")
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count#No OnGetItem event handler assigned"Unable to find a Table of Contents
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Value must be between %d and %d
Invalid clipboard format Clipboard does not support Icons
Text exceeds memo capacity/Menu '%s' is already being used by another form
Value*A key with the name of "%s" already exists
Key "%s" not found
Invalid input value7Invalid input value. Use escape key to abandon changes
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
Failed to get data for '%s'
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list Too many rows or columns deleted$%s not in a class registration group
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
?#''%s'' is not a valid date and time
Cannot open file "%s". %s
Grid too large for operation
Unable to write to %s
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s1Fixed column count must be less than column count
Operation not supported
External exception %x
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
'%s' is not a valid GUID value
I/O error %d
3.1.0.5


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    SuperUpdater.exe:3584
    supupdsetup.exe:452
    %original file name%.exe:3308
    SUStartScan.exe:3656
    supupdsetup.tmp:1024

  2. Delete the original Adware file.
  3. Delete or disinfect the following files created/modified by the Adware:

    C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\current_7_32_zxw.7z (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\PCInfo.ini (151 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\program.log (1024 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\Scan.ini (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\Drivers.db (2721 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\Drivers32.db (1848968 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\Drivers32.db-journal (1090 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\Devices.ini (34 bytes)
    %Program Files%\Super Updater\sqlite3.dll (524 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-U7PFR.tmp\supupdsetup.tmp (50 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\supupdsetup.exe (294 bytes)
    %Program Files%\Super Updater\unins000.dat (14237 bytes)
    %Program Files%\Super Updater\is-TJ10L.tmp (40320 bytes)
    C:\Users\"%CurrentUserName%"\Desktop\Super Updater.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\is-P8LHT.tmp (601 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Updater\Help.lnk (1 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Updater\Super Updater on the Web.lnk (1 bytes)
    %Program Files%\Super Updater\is-J6FU9.tmp (3073 bytes)
    %Program Files%\Super Updater\unins000.exe (48 bytes)
    %Program Files%\Super Updater\is-F6KAP.tmp (6841 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Updater\Uninstall Super Updater.lnk (2 bytes)
    %Program Files%\Super Updater\SUTray.exe (950 bytes)
    %Program Files%\Super Updater\is-8MVTU.tmp (26096 bytes)
    %Program Files%\Super Updater\unins000.msg (768 bytes)
    %Program Files%\Super Updater\SuperUpdater.exe (291 bytes)
    %Program Files%\Super Updater\is-9EQQC.tmp (7345 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-D4OAB.tmp\_isetup\_shfoldr.dll (47 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Super Updater\is-PS5ET.tmp (4 bytes)
    %Program Files%\Super Updater\is-G36EH.tmp (127 bytes)
    %Program Files%\Super Updater\is-5342H.tmp (548 bytes)
    %Program Files%\Super Updater\is-4KECD.tmp (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-D4OAB.tmp\cfg.exe (65 bytes)
    %Program Files%\Super Updater\is-MJUQQ.tmp (7345 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Updater\Super Updater.lnk (1 bytes)
    %Program Files%\Super Updater\SUStartScan.exe (958 bytes)
    %Program Files%\Super Updater\is-I22KE.tmp (17 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-D4OAB.tmp\SupUpdHelper.dll (8330 bytes)
    %Program Files%\Super Updater\is-UCJ2A.tmp (11 bytes)
    %Program Files%\Super Updater\is-QS6UQ.tmp (8281 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet

x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now