Junkware Removal Tool v7.6.4 incorrectly removed valid folders.

[jgt1942]

Junkware Removal Tool v7.6.4 incorrectly removed valid folders.

The following are things I know to be vaild.

[Task] C:\WINDOWS\system32\tasks\Wise Care 365
[Task] C:\WINDOWS\system32\tasks\Wise Turbo Checker
[Task] C:\WINDOWS\Tasks\Wise Care 365.job
[Task] C:\WINDOWS\Tasks\Wise Turbo Checker.job

I don't know if the other deletes are valid or not.

Following is the log.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Windows 8.1 Pro x64
Ran by John on Fri 10/16/2015 at 16:41:41.63
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

Successfully deleted: [Task] C:\WINDOWS\system32\tasks\Wise Care 365
Successfully deleted: [Task] C:\WINDOWS\system32\tasks\Wise Turbo Checker
Successfully deleted: [Task] C:\WINDOWS\Tasks\Wise Care 365.job
Successfully deleted: [Task] C:\WINDOWS\Tasks\Wise Turbo Checker.job

~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_DC7C249942899F83C1747FF3FB5BD5F3
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant

~~~ Registry Keys

~~~ Files

Successfully deleted: [File] C:\Users\John\Appdata\Local\google\chrome\user data\default\local storage\chrome-extension_ajpgkpeckebdhofmmjfgcjjiiejpodla_0.localstorage
Successfully deleted: [File] C:\Users\John\Appdata\Local\google\chrome\user data\default\local storage\chrome-extension_ajpgkpeckebdhofmmjfgcjjiiejpodla_0.localstorage-journal
Successfully deleted: [File] C:\Users\John\Appdata\Local\google\chrome\user data\default\local storage\chrome-extension_aoiidodopnnhiflaflbfeblnojefhigh_0.localstorage
Successfully deleted: [File] C:\Users\John\Appdata\Local\google\chrome\user data\default\local storage\chrome-extension_fanogbnclpilemkifpjeglokomebpnef_0.localstorage
Successfully deleted: [File] C:\Users\John\Appdata\Local\google\chrome\user data\default\local storage\chrome-extension_hjebfgojnlefhdgmomncgjglmdckngij_0.localstorage

~~~ Folders

Successfully deleted: [Folder] C:\Users\John\Documents\add-in express

~~~ Chrome

Successfully deleted: [Folder] C:\Users\John\Appdata\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla
Successfully deleted: [Folder] C:\Users\John\Appdata\Local\Google\Chrome\User Data\Default\Extensions\aoiidodopnnhiflaflbfeblnojefhigh
Successfully deleted: [Folder] C:\Users\John\Appdata\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil
Successfully deleted: [Folder] C:\Users\John\Appdata\Local\Google\Chrome\User Data\Default\Extensions\fanogbnclpilemkifpjeglokomebpnef
Successfully deleted: [Folder] C:\Users\John\Appdata\Local\Google\Chrome\User Data\Default\Extensions\hjebfgojnlefhdgmomncgjglmdckngij
Successfully deleted: [Folder] C:\Users\John\Appdata\Local\Google\Chrome\User Data\Default\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam

[C:\Users\John\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\John\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
ajpgkpeckebdhofmmjfgcjjiiejpodla
aoiidodopnnhiflaflbfeblnojefhigh
elicpjhcidhpjomhibiffojpinpmmpil
fanogbnclpilemkifpjeglokomebpnef
hjebfgojnlefhdgmomncgjglmdckngij
pbjikboenpfhbbejgkoklgkhjpfogcam

[C:\Users\John\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\John\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[
  ajpgkpeckebdhofmmjfgcjjiiejpodla,
  aoiidodopnnhiflaflbfeblnojefhigh,
  elicpjhcidhpjomhibiffojpinpmmpil,
  fanogbnclpilemkifpjeglokomebpnef,
  hjebfgojnlefhdgmomncgjglmdckngij,
  pbjikboenpfhbbejgkoklgkhjpfogcam
]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 10/16/2015 at 16:46:39.83
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[AdvancedSetup]

According to the log it only removed TASKS not files or folders associated to the program. Though Wise Care is probably not well regarded by too many security experts so that's probably why it was targeted. I'll wait for the programmer to reply here to you though and he can assist you in restoring it if that's what you really want to do.

 

Thanks

[thisisu]

Thanks for the report. Yes JRT purposely targets those tasks by Wise Care, but since Malwarebytes doesn't; I'll delist them in the next update. 

[thisisu]

They are delisted now. New version will available for public download soon