TwinHeadedEagle Posted January 22, 2015 ID:931893 Share Posted January 22, 2015 Registry Keys: 4Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AUpdate.exe, Quarantined, [331e09ee5c2deb4bf1dc23169470e51b], Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CCleaner.exe, Quarantined, [da77fdfad5b48babf7ba98a2c044d52b], Security.Hijack, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AUpdate.exe, Quarantined, [73dea750bacfc274547992a7659f1ce4], Security.Hijack, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CCleaner.exe, Quarantined, [bb960becef9a57df5a570c2e49bb7090], Is this FP? https://forums.malwarebytes.org/index.php?/topic/163819-malware-pups-keep-reappearing/ Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 23, 2015 Root Admin ID:931984 Share Posted January 23, 2015 You can have the user start an elevated admin command prompt and run the following and the post back the logs. It should create 2 text files on the desktop.REG EXPORT "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" "%USERPROFILE%\Desktop\HKLM_IFEO_SETTINGS.TXTREG EXPORT "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" "%USERPROFILE%\Desktop\HKLM_Wow6432Node_IFEO_SETTINGS.TXTIf there is no entry or no redirect to run something else then possible is FP - if it has an entry for something to run the no it's not an FP Post back the results please. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 23, 2015 Author ID:932172 Share Posted January 23, 2015 Reports attached. Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 23, 2015 Staff ID:932189 Share Posted January 23, 2015 nothing attached. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 23, 2015 Author ID:932190 Share Posted January 23, 2015 Sorry, I thought user attached requested reports https://forums.malwarebytes.org/index.php?/topic/163819-malware-pups-keep-reappearing/#entry932167 Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 23, 2015 Staff ID:932213 Share Posted January 23, 2015 This is because of Advanced system care 8 being installed. User can scan again and add to the ignore list. Malware is more common to use the debugger entries here so we really can't delist it. Thanks for reporting!. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 23, 2015 Root Admin ID:932324 Share Posted January 23, 2015 It's because iObit is a piece of junk. The company behind this product was found to be stealing our database. Personally I would not trust installing any software from a company that resorts to stealing someone's technology to sell their product. Please see the following links and make up your own mind if you want to keep this on your system. If needed I can help you remove it. IOBit Steals Malwarebytes' Intellectual PropertyIOBit's Denial of Theft UnconvincingIOBit Theft ConclusionIObit: Trusting Your Antivirus VendorMalwarebytes: IObit Stole Our Signatures DatabaseIObit accused of stealing from MalwarebytesIOBit sucks at ethicsBeware: IObit Malware Fighter Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now