It is a trojan. At least, half of it is π
- The "destructive" version will pretend to be a windows PC cleaning utility, scanning for unneeded files, and then prompting the user to delete them. This will result in the user will unwittingly deleting their system32 folder, as an internet meme xD.
- The "clean" version will actually help one delete unneeded files from their computer, such as cache of the three major browsers, log and error reporting files Windows makes, etc. For a full list, please see the source code. However, it will still do a fake scan(tree command) to make it look more official Β―\_(γ)_/Β―.
This program uses MS-DOS batch programming, along with Visual Basic. On a said computer, the Windows Command Prompt(cmd.exe) must be present, along with wscript.exe or cscript.exe to run the Visual Basic. which is literally every default windows installation xD shush.
The repository has two folders:
-
The "'Source' code" folder which contains the source code of the project. This includes the two batch files which are the "cleaning" utilities, and the "Assets" folder, which contain the preliminary warning that will open before running the destructive version, and the two icons which will be injected in the "compiled" batch executables.
-
The "Compiled Project" folder which contains the compiled project. The two batch files have been "converted"(more like wrapped tbh) into executables. In the "Assets" folder, the warning which will pop up before running the destructive version of PC Optimizer Pro has been encoded into a .vbe file. The icons are still provided in the "Assets" folder.
The uncompiled "destructive" batch file references to "Warning.vbs" in the code. The compiled "destructive" executable must reference to the encrypted warning "Warning.vbe" for the warning to correctly work. To solve this, one must change the warning local file link to the correct name before compiling, and then placing the correct compiled .vbe file in the correct directory(Assets). Although I have done such in the compiled folder, please note this when compiling this yourself(for whatever reason lol). I don't know what happen after run this. It's Modified Script by Unknown.
For any kind of help, support, payment, donate, suggestion and request ask me on Gmail / Telegram: