Slimware Utilities - need fixlist for FRST please

[Richard_Nourse]

Ran Adwcleaner several times as Admin, it keeps reporting the same 2 PUPs from Slimware Utilities

rebooted in safe mode and re-ran Adwcleaner - same result

ran FRST and created log files, and now need fixlist to remove these 2 PUPs please

Hopefully all log files attached - many thanks - richard

AdwCleaner[S10].txt Addition.txt FRST.txt

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

ATTENTION: System Restore is disabled
Turn System Restore ON for Drives in Windows 10 - Immediately.
https://www.tenforums.com/tutorials/4533-system-protection-turn-off-drives-windows-10-a.html
===

Remove this program in bold via the Control Panel > Programs > Programs and Features.
CPUID CPU-Z 1.76 (HKLM\...\CPUID CPU-Z_is1) (Version:  - ) <==== ATTENTION
Your copy is not signed and could be compromised.
If you need it please download the latest version from this site.
https://www.cpuid.com/
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and let me know what problem persists.

fixlist.txt

[Richard_Nourse]

Many thanks Nasdaq - comprehensive and much appreciated instructions!!!

malware must have turned off system restore - which came as a nasty surprise.

followed your instructions carefully, but still seem to have the same 2 PUPs - screenshot attached along with fixlist log and adwcleaner log (after fixlist was run)

Humbly await further instruction from Forum Deity!

Fixlog.txt AdwCleaner[S12].txt

[Richard_Nourse]

PS - re-ran Adwcleaner but same 2 PUPs persist!

[nasdaq]

Hi,

 

If the problem persists in IE and you are using the Sync with other devices, disable the Sync.
https://www.thewindowsclub.com/sync-internet-explorer-settings-windows-8-1-devices

close IE.

Restart the computer and re-sync you devices if you need them.
<<<>>>

[Richard_Nourse]

nope - I do not use sync at all - not in IE, not in firefox, not in chrome - and I don't use Edge at all

I'm a dinosaur (still write HTML code using notepad) and prefer to have my devices running independently

any other tests I can run please?

sample website - www.grumpyoldgits.org

[Richard_Nourse]

thought I'd try things the "old-fashioned" way..... expanded Adwcleaner results panel to view locations of these last 2 indestructible PUPs..

went to appropriate file location and deleted that driver file...

fired up regedit and went to that HKLM location, found "System Utilities Inc" folder which seemed to be empty apart fro another sub-folder named "Avast Update Checker"

deleted the "System Utilities Inc" folder and rebooted....

rats - ran Adwcleaner which showed both PUPs still there - now that's enough to confuse an old git like me!

any ideas please? screenshot attached

[Richard_Nourse]

HOORAY - finally managed to delete that driver file, by going into Safe Mode first!

registry key still there, but I will keep slugging away at it with regedit - if anybody has advice along those lines, or some other fix, I'd be really grateful!

many thanks for your kind assistance!

[nasdaq]

Glad we could help.

[Richard_Nourse]

Please can someone with more brain power than me confirm that I may safely use regedit to remove any and all "Slimware" folders and entries?

TIA - richard

[nasdaq]

Hi,

Lets see what we can find in the Registry.

Run the Farbar program .exe as an Administrator.

In the Search text area, copy and paste the following:
Slimware
Once done, click on the Search Registry button and wait for FRST to finish the search
On completion, a log will open in Notepad. Copy and paste its content in your next reply
====

[Richard_Nourse]

Many thanks Nasdaq! ran scan as instructed - nothing found in registry, but when I ran Adwcleaner just now, it showed 2 files again - will go into Safe Mode and see if I can delete them

[Richard_Nourse]

Phew - looks OK now now - managed to delete that file, has to change folder properties before I could delete that - interestingly, that folder had a sub-folder called "Installers" which contained what I assume is a spurious "log file" - hopefully attached herewith - many thanks for your patient and comprehensive help!

US-131970635698776689.log

[nasdaq]

Good work.

Stay safe

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks