AdwCleaner debug log

[PeterJ]

AdwCleaner v6.0.44 keeps finding some registry keys but fails to delete them.
The debug.log shows following:

2017-03-25 21:35:55 :     <INFO>    [clean] - Progress: 55%
2017-03-25 21:35:55 :     <INFO>    [clean.registry] - Starting registry clean
2017-03-25 21:35:55 :     <INFO>    [clean.registry] - Cleaning registry
2017-03-25 21:35:55 :     <WARN>    [quarantine] - Can't read key, attempting to delete key on reboot [HKLM\SOFTWARE\Classes\Installer\Features\0C776EBEBCBCFBE408892EE7B12517FC]
2017-03-25 21:35:56 :     <INFO>    [quarantine] - Added registry element to quarantine database [HKLM\SOFTWARE\Classes\Installer\Features\0C776EBEBCBCFBE408892EE7B12517FC]
2017-03-25 21:35:56 :     <WARN>    [quarantine] - Can't read key, attempting to delete key on reboot [HKLM\SOFTWARE\Classes\Installer\Products\0C776EBEBCBCFBE408892EE7B12517FC]
2017-03-25 21:35:56 :     <INFO>    [quarantine] - Added registry element to quarantine database [HKLM\SOFTWARE\Classes\Installer\Products\0C776EBEBCBCFBE408892EE7B12517FC]
2017-03-25 21:35:56 :     <WARN>    [quarantine] - Can't read key, attempting to delete key on reboot [HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0C776EBEBCBCFBE408892EE7B12517FC]
2017-03-25 21:35:56 :     <INFO>    [quarantine] - Added registry element to quarantine database [HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0C776EBEBCBCFBE408892EE7B12517FC]
2017-03-25 21:35:56 :     <WARN>    [quarantine] - Can't read key, attempting to delete key on reboot [HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0C776EBEBCBCFBE408892EE7B12517FC]
2017-03-25 21:35:56 :     <INFO>    [quarantine] - Added registry element to quarantine database [HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0C776EBEBCBCFBE408892EE7B12517FC]
2017-03-25 21:35:56 :     <WARN>    [quarantine] - Can't read key, attempting to delete key on reboot [HKLM64\SOFTWARE\Classes\Installer\Features\0C776EBEBCBCFBE408892EE7B12517FC]
2017-03-25 21:35:56 :     <INFO>    [quarantine] - Added registry element to quarantine database [HKLM64\SOFTWARE\Classes\Installer\Features\0C776EBEBCBCFBE408892EE7B12517FC]
2017-03-25 21:35:56 :     <WARN>    [quarantine] - Can't read key, attempting to delete key on reboot [HKLM64\SOFTWARE\Classes\Installer\Products\0C776EBEBCBCFBE408892EE7B12517FC]
2017-03-25 21:35:57 :     <INFO>    [quarantine] - Added registry element to quarantine database [HKLM64\SOFTWARE\Classes\Installer\Products\0C776EBEBCBCFBE408892EE7B12517FC]
2017-03-25 21:35:57 :     <INFO>    [clean.registry] - Registry cleaned
2017-03-25 21:35:57 :     <INFO>    [clean.registry] - Stopping registry clean

 

SystemLook.exe can't find the mentioned registry keys.
Any help on this issue please.

 

[jboursier]

Hello,

Can you share the whole logfile please?

Thanks,

[PeterJ]

Attached the logfile.

 

AdwCleaner_Debug.log

Edited March 26, 2017 by PeterJ

[jboursier]

Hello,

Thank you.

Can you retry now? It should be ok.

[scuzzyfuzzy]

Hi,

I have a similar problem - AdwCleaner (latest version) finds 6 registry keys, but fails to delete them.

After reboot, there pops up a cmd line window for a second, and the only words I could read are "...can't delete..." or "..can't find...", or something like that, and after a new scan it finds the same thing.

Btw, in the last 2 weeks I tried 8-9 different anti-virus, anti-malware etc. applications, but the problem (malware) is still here...

Thanks

AdwCleaner[S7].txt

[jboursier]

Hello,

@scuzzyfuzzy

Can you share MB3 logfile if you tried it?

Thanks,

[scuzzyfuzzy]

Hi,

tnx for answering.

Please find attached a collection of MB3 logs, incl. one of the logs where it shows that it is blocking some outgoing traffic.

All other logs I have (dating back to the beginning of the month) are clean.

Pls. let me know if you need any other logs.

tnx

MB3_logs.zip

[jboursier]

Hello,

Thanks. Can you use the latest MB3.1 and re-do a scan with it?

Thanks,

[scuzzyfuzzy]

Hi,

so I did a scan with the newest MB and also ran AdwCleaner again, unfortunately to the same result.

Pls find attached the corresponding logs.

This is what I did:

1. DL & Install MB 3.1

2. Restart

3. Scan with MB3.1 (clean log)

4. Scan with AdwCleaner (same 6 reg keys found, chose to fix)

5. Restart

6. New scan with AdwCleaner (same result, no fix, no restart)

 

Pls let me know if this is perhaps a false alarm (though the fact that MB & eset keep telling me they stop some unusual outgoing traffic makes me believe that there still might be some malware that can't be easily removed)

Tnx

MB_ADW_logs.zip

[jboursier]

Hello,

Thanks.

 

• Download FRST

• Download fixlist.txt file and save it to the Desktop (with the name "fixlist.txt")

  NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

  NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system.

• Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Thanks,

[scuzzyfuzzy]

Hi,

everything went as stated, pls find the log attached.

 

Tnx

Fixlog.txt

[jboursier]

Hello,

Sorry, it's my fault - Can you do the same procedure than my previous message, but using this fixlist.txt file?

Thanks,

[scuzzyfuzzy]

Hi,

no problem, did it again here's the log.

Didn't run any MB, AV or other scans afterwards.

P.S. BTW, MB is still blocking some weird outgoing traffic and says that it's mscie.exe that's doing it...

Tnx

 

Fixlog.txt

MB_log.txt

[jboursier]

Hello,

Ok, it's better but not sufficient, so we'll begin by the basics:

• Relaunch frst
• Right-click on the file -> "Execute as Administrator"
• Click on the "Scan" button
• The logfile is saved as FRST.txt , and additional informations are in Addition.txt.
• Please host them on Up2Share and share the generated link

Thanks,

[scuzzyfuzzy]

Hi,

did what you asked (I was a little confused, I presume you wanted me to run FRST as Administrator, right?)

Here's the link to the logs:

https://up2sha.re/file?f=Y4BP5ofY

Tnx

 

[jboursier]

Hello,

Thanks. Just let me some time to review them and I'll answer by Tuesday night (sorry in advance for the delay).

[jboursier]

Hello,

- Do you use MIO GPS?

- Once again:

• Download fixlist.txt file and save it to the Desktop (with the name "fixlist.txt")

  NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

  NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system.

• Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Thanks,

[scuzzyfuzzy]

Hi,

no problem for the delay

No, I actually do not use MIO GPS.

Here's the log you requested https://up2sha.re/file?f=BpdKbPsF

Tnx

 

[jboursier]

Hello,

Thanks.

Can you remove this folder then:

C:\Program Files (x86)\MIO

It should be sufficient with a right-click -> delete.

Thanks,

[scuzzyfuzzy]

Hi,

folder removed (though I think it might be just one of those fake folders I've killed by the dozens in the past month since this problem started...)

Also ran MWB, AdwCleaner, etc., logs here -> https://up2sha.re/file?f=ruittwIZ (if it's any help to you)

And yes, those pesky little buggers are still there in the registry... (maybe flying close to the sun would do the trick...?) 

Tnx

 

[scuzzyfuzzy]

Hi,

haven't heard from you in a while, do you have any news perhaps?

Tnx

[jboursier]

Hello,

Sorry for the delay, it's fixed. This entry requires more work on my side and since it's not so harmful I've disabled it for now.