Analysis by: Johnlery Triunfante
ALIASES:

RiskTool.Win32.Tuneup.b (Kaspersky); RiskTool.Tuneup (QuickHeal)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Potentially Unwanted Application

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Canal de infección Dropped by other malware

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

  TECHNICAL DETAILS

Tamaño del archivo 3,456,928 bytes
Tipo de archivo EXE
Fecha de recepción de las muestras iniciales 30 Oct 2014
Carga útil Drops files

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Installation

This Potentially Unwanted Application drops the following files:

  • %Application Data%\ASP\aspsetup.exe
  • %Application Data%\Systweak\Advanced System Protector\ASPLog.txt
  • %Application Data%\Systweak\Advanced System Protector\QDetail.db
  • %Application Data%\Systweak\Advanced System Protector\QDetail.db-journal
  • %Application Data%\Systweak\Advanced System Protector\Settings.db
  • %Application Data%\Systweak\Advanced System Protector\Settings.db-journal
  • %Application Data%\Systweak\Advanced System Protector\Update.ini
  • %Application Data%\Systweak\Advanced System Protector\Utility_kit.ini
  • %Application Data%\Tuneup Pro\ExcludeList.rcp
  • %Application Data%\Tuneup Pro\TempHLList.rcp
  • %Application Data%\Tuneup Pro\backup3.bin
  • %Application Data%\Tuneup Pro\backup6.bin
  • %Application Data%\Tuneup Pro\eng_rcp.dat
  • %Application Data%\Tuneup Pro\log_06-21-2018.log
  • %Application Data%\Tuneup Pro\results.rcp
  • %Desktop%\Advanced System Protector.lnk
  • %Desktop%\Tuneup Pro.lnk
  • %Program Files%\Advanced System Protector\unins000.dat
  • %Program Files%\Advanced System Protector\unins000.msg
  • %Program Files%\Tuneup Pro\unins000.dat
  • %Program Files%\Tuneup Pro\unins000.msg
  • %ProgramData%\Microsoft\Windows\Start Menu\Programs\Advanced System Protector\Advanced System Protector.lnk
  • %ProgramData%\Microsoft\Windows\Start Menu\Programs\Advanced System Protector\Register Advanced System Protector.lnk
  • %ProgramData%\Microsoft\Windows\Start Menu\Programs\Advanced System Protector\Uninstall Advanced System Protector.lnk
  • %ProgramData%\Microsoft\Windows\Start Menu\Programs\Tuneup Pro\Register Tuneup Pro.lnk
  • %ProgramData%\Microsoft\Windows\Start Menu\Programs\Tuneup Pro\Tuneup Pro.lnk
  • %ProgramData%\Microsoft\Windows\Start Menu\Programs\Tuneup Pro\Uninstall Tuneup Pro.lnk
  • %System%\roboot.exe
  • %System%\sasnative32.exe
  • %User Temp%\is-{random characters}.tmp\_isetup\_iscrypt.dll
  • %User Temp%\is-{random characters}.tmp\_isetup\_shfoldr.dll
  • %User Temp%\is-{random characters}.tmp\aspsetup.tmp
  • %User Temp%\is-{random characters}.tmp\isxdl.dll
  • %User Temp%\is-{random characters}.tmp\roboot.exe
  • %User Temp%\is-{random characters}.tmp\sasnative32.exe
  • %Windows%\Tasks\Tuneup Pro_DEFAULT.job
  • %Windows%\Tasks\Tuneup Pro_UPDATES.job

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Other System Modifications

This Potentially Unwanted Application adds the following registry keys:

HKEY_CURRENT_USER\Software
Systweak =

HKEY_CURRENT_USER\Software\Systweak
Advanced System Protector =

HKEY_CURRENT_USER\Software\Systweak
params =

HKEY_CURRENT_USER\Software
Tune =

HKEY_CURRENT_USER\Software\Tune
up =

HKEY_CURRENT_USER\Software\Tune\
up
pro =

HKEY_CURRENT_USER\Software\Tune\
up\pro
key =

HKEY_CURRENT_USER\Software\Tune\
up\pro\key
6 =

HKEY_CURRENT_USER\Software
Tuneup Pro =

HKEY_CURRENT_USER\Software\Tuneup Pro
Pro\LANG =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall
Tuneup Pro_is1 =

HKEY_LOCAL_MACHINE\SOFTWARE
Systweak =

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak
Advanced System Protector =

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
LANG =

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak
Params =

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak
aso3 =

HKEY_LOCAL_MACHINE\SOFTWARE
Tuneup Pro =

HKEY_LOCAL_MACHINE\SOFTWARE\Tuneup Pro
LANG =

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
2.3.1000.24108 =

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
LANG =

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
Expired = 0

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
InstalledPath = %Program Files%\Advanced System Protector

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
IsFreeCleanDone = 0

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
Key = ""

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
MaxFixLimit = 0

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
REGVER = 0

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
REGVER-UNINSTALL = 0

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
TELNO = (855) 716-7026

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
TELNOFR = ""

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
affiliateid = 9407

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
utm_campaign = default

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
utm_days = ""

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
utm_medium = newbuild

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
utm_source = systweak

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector
x-at = ""

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector\LANG
LangCode = en

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector\LANG
LangID = 0

HKEY_CURRENT_USER\Software\Systweak\
Advanced System Protector\LANG
LangId = 0

HKEY_CURRENT_USER\Software\Systweak\
params
ASPInstalledPath = %Program Files%\Advanced System Protector

HKEY_CURRENT_USER\Software\Tune\
up\pro\key\
6
(Default) = {hex values}

HKEY_CURRENT_USER\Software\Tuneup Pro
AutoRepair = 0

HKEY_CURRENT_USER\Software\Tuneup Pro
ConfirmBkUps = 1

HKEY_CURRENT_USER\Software\Tuneup Pro
CurrentScanTime = {hex values}

HKEY_CURRENT_USER\Software\Tuneup Pro
ErrorCount = 0

HKEY_CURRENT_USER\Software\Tuneup Pro
ErrorCount = 219

HKEY_CURRENT_USER\Software\Tuneup Pro
FirstRun = 1

HKEY_CURRENT_USER\Software\Tuneup Pro
GoToSystemTrayOnClose = 0

HKEY_CURRENT_USER\Software\Tuneup Pro
ImprovementProgram = 1

HKEY_CURRENT_USER\Software\Tuneup Pro
NumTimesRCPRunned = 1

HKEY_CURRENT_USER\Software\Tuneup Pro
RegErrFoundTillDate = 0

HKEY_CURRENT_USER\Software\Tuneup Pro
RegErrFoundTillDate = 219

HKEY_CURRENT_USER\Software\Tuneup Pro
RegErrsFixedLast = 0

HKEY_CURRENT_USER\Software\Tuneup Pro
RegErrsFixedTillDate = 0

HKEY_CURRENT_USER\Software\Tuneup Pro
ScheduledTime = ""

HKEY_CURRENT_USER\Software\Tuneup Pro
SetChkDontShowRedTrayPopup = 0

HKEY_CURRENT_USER\Software\Tuneup Pro
SetChkREmovableMedia = 1

HKEY_CURRENT_USER\Software\Tuneup Pro
SetChkSkipEmptyKeys = 1

HKEY_CURRENT_USER\Software\Tuneup Pro
SetEnableSound = 1

HKEY_CURRENT_USER\Software\Tuneup Pro
StartAutoScanOnLaunch = 0

HKEY_CURRENT_USER\Software\Tuneup Pro
StartAutoScanPMUI = 0

HKEY_CURRENT_USER\Software\Tuneup Pro
StartAutoScanPMUI = 1

HKEY_CURRENT_USER\Software\Tuneup Pro
StartAutoTutorial = 1

HKEY_CURRENT_USER\Software\Tuneup Pro
StartMinimized = 0

HKEY_CURRENT_USER\Software\Tuneup Pro
StartScan = 0

HKEY_CURRENT_USER\Software\Tuneup Pro
StartWhenWinBoots = 1

HKEY_CURRENT_USER\Software\Tuneup Pro
StrLastOptimizeTime = ""

HKEY_CURRENT_USER\Software\Tuneup Pro
StrLastScan = ""

HKEY_CURRENT_USER\Software\Tuneup Pro
StrLastScan = {date}

HKEY_CURRENT_USER\Software\Tuneup Pro
StrLastScanResults = 0

HKEY_CURRENT_USER\Software\Tuneup Pro
StrLastScanResults = 219

HKEY_CURRENT_USER\Software\Tuneup Pro
StrLastStartupOpt = ""

HKEY_CURRENT_USER\Software\Tuneup Pro
StrLatestRegDefrag = ""

HKEY_CURRENT_USER\Software\Tuneup Pro
StrLatestRestorePoint = ""

HKEY_CURRENT_USER\Software\Tuneup Pro
TrialType = 0

HKEY_CURRENT_USER\Software\Tuneup Pro\
LANG
LangCode = en

HKEY_CURRENT_USER\Software\Tuneup Pro\
LANG
LangID = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
DisplayIcon = %Program Files%\Tuneup Pro\TuneupPro.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
DisplayName = Tuneup Pro

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
DisplayVersion = 1.08

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
EstimatedSize = 12162

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
HelpLink = http://www.tuneuppro.com/

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
Inno Setup: App Path = %Program Files%\Tuneup Pro

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
Inno Setup: Icon Group = Tuneup Pro

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
Inno Setup: Language = en

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
Inno Setup: Setup Version = 5.5.1 (u)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
Inno Setup: User = {user name}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
InstallDate = {install date}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
InstallLocation = %Program Files%\Tuneup Pro\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
MajorVersion = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
MinorVersion = 8

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
NoModify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
NoRepair = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
Publisher = tuneuppro.com

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
QuietUninstallString = "%Program Files%\Tuneup Pro\unins000.exe" /SILENT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
URLInfoAbout = http://www.tuneuppro.com/

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
UninstallString = "%Program Files%\Tuneup Pro\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tuneup Pro_is1
UninstallString = "%Program Files%\Tuneup Pro\unins000.exe" /silent

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
BuyNowURL = http://www.systweak.com/antispyware/iprice.asp?

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
BuyNowURLADU = http://powerbundle.systweak.com/pb/price/?pname=adu&

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
BuyNowURLASP = http://powerbundle.systweak.com/pb/price/?pname=asp&

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
BuyNowURLPB = http://powerbundle.systweak.com/PB/purchase/?pname=asp&

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
BuyNowURLRCP = http://powerbundle.systweak.com/pb/price/?pname=rcp&

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
Expired = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
InstalledPath = %Program Files%\Advanced System Protector

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
IsScanOptional = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
Key = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
MaxFixLimit = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
NoLPHIconNeeded = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
REGVER = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
REGVER-UNINSTALL = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
RenewNowURL = http://www.systweak.com/antispyware/renewal.asp?

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
RenewNowURLADU = http://powerbundle.systweak.com/pb/renewal/?pname=adu&

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
RenewNowURLASP = http://powerbundle.systweak.com/pb/renewal/?pname=asp&

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
RenewNowURLPB = http://powerbundle.systweak.com/PB/pbrenewal/?pname=asp&

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
RenewNowURLRCP = http://powerbundle.systweak.com/pb/renewal/?pname=rcp&

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
TELNO = (855) 716-7026

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
TELNOFR = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
affiliateid = 9407

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
afterInstallUrl = http://powerbundle.systweak.com/ASP/firstinstall/?newasp=1&utm_content=AfterInstall&utm_term=Setup&page=install&

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
isphone = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
issilent = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
showbc = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
showfth = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
showfthsetting = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
showpb = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
showsadtab = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
showsm = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
showutk = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
support_email = support@systweak.com

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
utm_campaign = default

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
utm_medium = newbuild

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
utm_source = systweak

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector
x-at = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector\LANG
LangCode = en

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector\LANG
LangID = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Advanced System Protector\LANG
LangId = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Params
ASPInstalledPath = %Program Files%\Advanced System Protector

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Params
TELNO = (855) 716-7026

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Params
affiliateid = 9407

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Params
utm_campaign = default

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Params
utm_medium = newbuild

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Params
utm_source = systweak

HKEY_LOCAL_MACHINE\SOFTWARE\Systweak\
Params
x-at = ""

HKEY_LOCAL_MACHINE\SOFTWARE\Tune\
up\pro\key\
6
(Default) = {hex values}

HKEY_LOCAL_MACHINE\SOFTWARE\Tuneup Pro
Expired = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Tuneup Pro
FirstTimeASPFired = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Tuneup Pro
InstallASP = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Tuneup Pro
LaunchASP = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Tuneup Pro
MaxFixLimit = 15

HKEY_LOCAL_MACHINE\SOFTWARE\Tuneup Pro
ShowExitPage = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Tuneup Pro
TELNO = (855) 973-2093

HKEY_LOCAL_MACHINE\SOFTWARE\Tuneup Pro
affiliateid = 9407

HKEY_LOCAL_MACHINE\SOFTWARE\Tuneup Pro\
LANG
LangID = 0