prallo Posted July 8, 2017 ID:1141297 Share Posted July 8, 2017 Used Adwcleaner latest version to check and it seems that it detects Windows Update as malicious. Windows 10 latest See the attachment AdwCleaner[S87].txt Link to post Share on other sites More sharing options...
Staff jboursier Posted July 8, 2017 Staff ID:1141299 Share Posted July 8, 2017 Hello, Can you search for `cmd.exe` from the windows menu, right click on it > Execute as Administrator. Then, write the following in the black window and press enter: regedit /e c:\prallo.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\Update service" Then, please attach the file C:\prallo.reg in your next answer. Thanks! Link to post Share on other sites More sharing options...
prallo Posted July 8, 2017 Author ID:1141324 Share Posted July 8, 2017 Ok, here it is: prallo.zip Link to post Share on other sites More sharing options...
Staff jboursier Posted July 8, 2017 Staff ID:1141417 Share Posted July 8, 2017 Hello, Thanks! Do you have or have you already had Popcorn Time installed? The detection above is related to this software. Link to post Share on other sites More sharing options...
prallo Posted July 8, 2017 Author ID:1141419 Share Posted July 8, 2017 Yes, I had Popcorn Time installed. Just deinstalled it now. But when I check with AdwCleaner again the entry in the registry is still there, only the entry in the service is gone. AdwCleaner[S88].txt prallo.zip Link to post Share on other sites More sharing options...
Staff jboursier Posted July 9, 2017 Staff ID:1141427 Share Posted July 9, 2017 Hello, You mean that even after cleaning with AdwCleaner, this entry is still present? Link to post Share on other sites More sharing options...
prallo Posted July 9, 2017 Author ID:1141436 Share Posted July 9, 2017 Yes, still there. I didn´t let AdwCleaner clean it because this is in the Microsoft folder. Link to post Share on other sites More sharing options...
prallo Posted July 9, 2017 Author ID:1141447 Share Posted July 9, 2017 Now I let AdwCleaner clean that entry and after a reboot the screen freezes after about 1 minute for about half a minute, then unfreezes and freezes again for about half a minute and so on. Did a backup with Clonezilla before I let AdwCleaner clean the entry, so I will go back to that backup. How do I get rid of that thing without freezing the screen again and again ? Link to post Share on other sites More sharing options...
prallo Posted July 9, 2017 Author ID:1141461 Share Posted July 9, 2017 Looks like this: Link to post Share on other sites More sharing options...
prallo Posted July 9, 2017 Author ID:1141462 Share Posted July 9, 2017 (edited) After letting AdwCleaner clean the entry it looks like this: Note that the Update service folder is gone, deleted by AdwCleaner ! And then of course the freezes as described above appear again. Edited July 9, 2017 by prallo Link to post Share on other sites More sharing options...
Staff jboursier Posted July 11, 2017 Staff ID:1141802 Share Posted July 11, 2017 Thanks. Please note that even if the icons say so, it's not a folder as we usually mean by folder here. Now, if you do a scan with AdwCleaner, what is the result? (please provide the generated logfile) Thanks, Link to post Share on other sites More sharing options...
prallo Posted July 11, 2017 Author ID:1141805 Share Posted July 11, 2017 AdwCleaner[S90].txt prallo.zip Link to post Share on other sites More sharing options...
prallo Posted July 12, 2017 Author ID:1142070 Share Posted July 12, 2017 No answer ? Link to post Share on other sites More sharing options...
prallo Posted July 12, 2017 Author ID:1142166 Share Posted July 12, 2017 (edited) Here is the log after I cleaned the above 2 entries with AdwCleaner: regedit /e c:\prallo.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\Update service" produced nothing because the update service "folder" is no longer there ! Can it be that these entries are not malicious ? Oh, and after deleting these 2 entries the computer freezes every minute again ! AdwCleaner[S97].txt Edited July 12, 2017 by prallo Link to post Share on other sites More sharing options...
Staff jboursier Posted July 12, 2017 Staff ID:1142187 Share Posted July 12, 2017 1 hour ago, prallo said: produced nothing because the update service "folder" is no longer there ! Can it be that these entries are not malicious ? It doesn't show any longer because it's simply not here anymore. 1 hour ago, prallo said: Oh, and after deleting these 2 entries the computer freezes every minute again ! Those freezes do not occur before the deletion of the Task "System\SystemCheck"? Do they persist after a reboot? Link to post Share on other sites More sharing options...
prallo Posted July 12, 2017 Author ID:1142251 Share Posted July 12, 2017 Yes, they persist after a reboot ! Link to post Share on other sites More sharing options...
Staff jboursier Posted July 12, 2017 Staff ID:1142254 Share Posted July 12, 2017 And do you confirm the following or not? 6 hours ago, fr33tux said: Those freezes do not occur before the deletion of the Task "System\SystemCheck"? Link to post Share on other sites More sharing options...
prallo Posted July 13, 2017 Author ID:1142262 Share Posted July 13, 2017 That is right ! By the way, there are 2 entries deleted, not only System/SystemCheck ! Link to post Share on other sites More sharing options...
prallo Posted July 13, 2017 Author ID:1142263 Share Posted July 13, 2017 I just had an idea: I downloaded the Windows 10 Home Iso from Microsoft, put it into the drive while in Windows and clicked setup. Did a installation but kept the personal files and settings. After I opened AdwCleaner and deleted these 2 entries. After the reboot the computer didn´t freeze anymore !!! Problem is solved but I don´t know why exactly it is O.K. now. And as you can see in the attachment the Windows Update "folder" is not there but the computer is running fine. Thanks for your help ! Link to post Share on other sites More sharing options...
prallo Posted July 13, 2017 Author ID:1142279 Share Posted July 13, 2017 Oops, forgot the attachment: Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now