{
  "family": "systweak",
  "sample_count": 23,
  "category": "pua",
  "description": "Systweak (commonly identified across antimalware engines under designations including PUA:Win32/Systweak, Rogue:Win32/Systweak, Adware:Win32/Systweak, and PUP.Optional.Systweak) represents an extensive family of potentially unwanted applications (PUAs) and rogue PC optimization scareware products. Marketed under trade names such as Advanced System Protector, RegClean Pro, and Advanced Driver Updater, Systweak software infiltrates Windows endpoints predominantly through deceptive third-party software installers and pay-per-install (PPI) software bundlers. Once installed, the software executes automated system diagnostics designed to flag benign temporary files, obsolete registry entries, and standard system logs as critical system corruption and high-risk security threats. It bombards users with persistent pop-up alerts and alarming warning dialogues, coercively demanding the purchase of a paid software subscription to remediate the purported issues. In addition, Systweak programs establish persistent scheduled tasks and registry run keys, consume system memory and CPU cycles, and may bundle supplementary browser toolbars.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/Systweak",
    "Rogue:Win32/Systweak",
    "Adware:Win32/Systweak",
    "PUP.Optional.Systweak",
    "Program:Win32/Systweak"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/Systweak?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Systweak is a family of potentially unwanted programs and rogue PC optimization utilities that fabricate severe system errors to coerce users into buying licenses."
      }
    },
    {
      "@type": "Question",
      "name": "How does Systweak convince users to pay for license keys?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes rigged system scans that intentionally exaggerate harmless registry keys and temporary files as critical threats."
      }
    },
    {
      "@type": "Question",
      "name": "How does Systweak enter user systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is typically bundled with freeware downloads, fake software updates, or drive-by Pay-Per-Install marketing campaigns."
      }
    },
    {
      "@type": "Question",
      "name": "What system resources does Systweak consume?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It runs multiple background scan services and scheduled tasks that degrade system responsiveness, CPU performance, and memory availability."
      }
    },
    {
      "@type": "Question",
      "name": "How can Systweak applications be safely uninstalled?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall via Windows Settings/Control Panel, remove associated scheduled tasks and registry keys, and run an anti-malware scan to remove leftover components."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1491.001",
    "T1547.001",
    "T1053.005",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Rogue:Win32/Systweak",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Rogue:Win32/Systweak"
    },
    {
      "name": "Malwarebytes Labs - PUP.Optional.Systweak Removal Guide",
      "url": "https://www.malwarebytes.com/blog/detections/pup-optional-systweak"
    },
    {
      "name": "Sophos Threat Center - Systweak Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Advise the end user not to purchase licenses or provide credit card information to the software prompts.",
    "Terminate active Systweak processes via Task Manager or administrative command line.",
    "Uninstall Systweak programs via Windows Add or Remove Programs.",
    "Remove residual scheduled tasks registered under the Systweak vendor name using schtasks or Task Scheduler.",
    "Clean residual registry keys under HKLM\\Software and HKCU\\Software.",
    "Deploy an enterprise endpoint scanner to purge leftover adware components and reset modified browser preferences."
  ],
  "what_to_avoid": [
    "Do not enter financial or payment details into the software purchase portal.",
    "Do not allow unverified third-party freeware bundlers to install recommended companion programs."
  ],
  "target_industries": [
    "Consumer Endpoints",
    "Small and Medium Businesses",
    "Enterprise Workstations"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Commercial Software Bundlers & Scareware Affiliates"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Fraud & Deceptive Commercial Monetization",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}