System Healer
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 5,407 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 44,034 |
| First Seen: | August 4, 2015 |
| Last Seen: | January 17, 2026 |
| OS(es) Affected: | Windows |
The System Healer software by System Healer Tech Sp. Zo.o. is promoted as the best PC cleaner that users could want and can be purchased for $29.95 on its official site, Systemhealer.com. Except for its site, the System Healer optimization solution may be deployed freeware bundles as a trial version that would help users perform free diagnostics of their PCs. However, you might want to know that System Healer is accompanied by riskware such as MagnetDownloader and OneClick that may show pop-up windows in your browser. You should always prefer the 'Custom; or 'Advanced' option of software installers to be aware of what is being introduced into your computer.
Computer experts agree that the System Healer optimization tool offers limited functionality that may allow users to clean up temporary files, recycle bin and Internet cache as well as detect broken shortcuts. Moreover, the System Healer application may detect an absurd number of system errors that do not mirror the actual state of your OS with the aim of encouraging users to buy the full version of System Healer. Several security scanners detect System Healer as a re-branded version of the Optimizer Elite Max riskware that is prone to use security notifications to inform users of fake infections on their PCs. Gamers that installed the System Healer app should take into consideration that System Healer may perform system scans at different times of the day and prevent them from enjoying their video games. The main goal of the System Healer application is to incite users to purchase its full version, and its positive effect on your oS may be little to none. You might want to use a credible anti-malware utility to find and remove binary of the System Healer securely.
Table of Contents
SpyHunter Detects & Remove System Healer
File System Details
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | 69D5DBDE-E807-97DC-BEF3-1A91BFCF78F8 | dfda1c3a9ef6864adcd0fbad67a2310f | 75 |
| 2. | 37361.ftf | 1acc37b400fd64ab6bd3bf510551645c | 74 |
| 3. | trzF454.tmp | bd24fc9459440f92fe541849af2a578a | 35 |
| 4. | SystemHealer.exe.vir | 6102120681700d55c34e575886a10582 | 12 |
| 5. | ED8EEA84-DCCB-4249-302B-833231BF46C1 | 864a84d2d576a38190c54256fb449992 | 3 |
| 6. | setup.exe | fa90717bb176a42edd11e38411309dfc | 3 |
| 7. | 75E034A7-DD69-4794-FE42-961E672AD329_1d2547759e7002c | 91b8b84452162fd8332c30689dd74022 | 2 |
| 8. | SystemHealer.exe | 2dfc4b182546068ace3d13dbb533c6af | 1 |
| 9. | C:\Program Files\systemhealer\SystemHealer.exe | ed948ed67e3b0d1b27f2abe2842c9451 | |
| 10. | C:\Program Files\SystemHealer\Uninstaller.exe | ||
| 11. | HealerConsole.exe | ||
| 12. | HealerCheckout.exe | ||
| 13. | SHShellExtension.dll | ||
| 14. | file.exe | 863711c57d9e173fb98467a97680ce90 | 0 |
Registry Details
Directories
System Healer may create the following directory or directories:
| %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\System Healer |
| %APPDATA%\System Healer |
| %APPDATA%\SystemHealer |
| %LOCALAPPDATA%\SystemHealer |
| %PROGRAMFILES%\SystemHealer |
| %PROGRAMFILES(x86)%\SystemHealer |
URLs
System Healer may call the following URLs:
| www.supercleansystem.com |
Analysis Report
General information
| Family Name: | PUP.System Healer |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
4af918270a8c2d8555ff4a3b86b9258c
SHA1:
ed4841ff51d3775330062fc86f76598c348c9afb
SHA256:
E1F31B62D3BB36CEFBD5C7A1D6E240D9F2A847E3BE90B991BA16627DEF4DA747
File Size:
4.50 MB, 4500904 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments | This installation was built with Inno Setup. |
File Traits
- HighEntropy
- No Version Info
- x86
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\is-3nufb.tmp\_isetup\_iscrypt.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-3nufb.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-3nufb.tmp\mjlu.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-6qsa4.tmp\ed4841ff51d3775330062fc86f76598c348c9afb_0004500904.tmp | Generic Write,Read Attributes |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Shell Execute |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Cbdnhgkr\AppData\Local\Temp\is-6QSA4.tmp\ed4841ff51d3775330062fc86f76598c348c9afb_0004500904.tmp" /SL5="$1023E,3985321,257024,c:\users\user\downloads\ed4841ff51d3775330062fc86f76598c348c9afb_0004500904"
|
