AdwCleaner won't run

[laflaone]

running windows 7 home premium, 64bit.  Downloaded adwcleaner a number of times, and it will not run.  Have tried regular .exe, then as administrator, then tried in safe mode.  Tried with norton antivirus disabled,  Still no luck.   I have about run out of ideas.   Any suggiestions?

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the AdwCleaner Help forum.

Someone will reply shortly, but in the meantime here are a few resources which may help resolve your issue:

• AdwCleaner user guide
• A malicious element isn't being detected? Submit the sample here!
• Need help with another Malwarebytes product or malware removal?
  • Click here for home support
  • Click here for business support
  • Click here for malware removal help

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

Have you tried Malwarebytes 3 to see if it is able to run?  If not, please do so that way we might determine if the issue is something blocking ADWCleaner such as an infection or if it is some other cause.  You can download the latest version of Malwarebytes here.

Please let us know how it goes.

Thanks

[laflaone]

1 hour ago, exile360 said:

Greetings,

Have you tried Malwarebytes 3 to see if it is able to run?  If not, please do so that way we might determine if the issue is something blocking ADWCleaner such as an infection or if it is some other cause.  You can download the latest version of Malwarebytes here.

Please let us know how it goes.

Thanks

I have version 3.7.1.2839, premium.  Is this the version you are referring to?  It did a scan several hours ago, and nothing detected.

[exile360]

Yes, that's what I was referring to, thanks

I guess the issue with ADWCleaner is being caused by something else then; most likely some setting or third party software or driver.  I'll leave it to the ADWCleaner experts to assist you, I just wanted to make certain that your system wasn't infected as there are a lot of threats out there these days that will specifically target/block ADWCleaner and Malwarebytes to keep them from running but since you are able to run Malwarebytes that obviously isn't the problem.

[laflaone]

2 hours ago, exile360 said:

Yes, that's what I was referring to, thanks

I guess the issue with ADWCleaner is being caused by something else then; most likely some setting or third party software or driver.  I'll leave it to the ADWCleaner experts to assist you, I just wanted to make certain that your system wasn't infected as there are a lot of threats out there these days that will specifically target/block ADWCleaner and Malwarebytes to keep them from running but since you are able to run Malwarebytes that obviously isn't the problem.

Thanks for your interest and reply.  I guess I will turn it over to the "experts".😏

[LiquidTension]

Hi @laflaone,

Is AdwCleaner the only executable file you're having issues running?
Does a folder named AdwCleaner exist in your root system drive folder (e.g. C:\)?

Please could you run the Malwarebytes Support Tool and provide the generated file so we can take a closer look at your system.

Malwarebytes Support Tool (MBST)

• Please download MBST using the link below:
  → http://downloads.malwarebytes.com/file/mbst
• Once the file is downloaded, open your Downloads folder or the location of the downloaded file.
• Double-click mb-support-#.#.#.###.exe to run the program.
• If prompted, place a checkmark next to Accept License Agreement and click Next.
• Click the Advanced menu on the left. Please do not click Start Repair.
• Click Gather Logs.
• Upon completion, click OK.
• A file named mbst-grab-results.zip will be saved to your Desktop.
• Please attach the file in your next email reply.

Edited June 3, 2019 by LiquidTension

[laflaone]

9 hours ago, LiquidTension said:

Hi @laflaone,

Is AdwCleaner the only executable file you're having issues running?
Does a folder named AdwCleaner exist in your root system drive folder (e.g. C:\)?

Please could you run the Malwarebytes Support Tool and provide the generated file so we can take a closer look at your system.

Malwarebytes Support Tool (MBST)

• Please download MBST using the link below:
  → http://downloads.malwarebytes.com/file/mbst
• Once the file is downloaded, open your Downloads folder or the location of the downloaded file.
• Double-click mb-support-#.#.#.###.exe to run the program.
• If prompted, place a checkmark next to Accept License Agreement and click Next.
• Click the Advanced menu on the left. Please do not click Start Repair.
• Click Gather Logs.
• Upon completion, click OK.
• A file named mbst-grab-results.zip will be saved to your Desktop.
• Please attach the file in your next email reply.

 I have had issues open a few other .exe files, but the always run if I right click and Run As Administrator.  That doesn't work with adwcleaner.  As to your second question, yes, there is a C:/adwcleaner file, width 24 sub files in it.  Attached is the mbst zip file.

mbst-grab-results.zip

[LiquidTension]

Thanks for the file. Nothing specifically related to the issue you're having with AdwCleaner is standing out.

There's a bunch of leftovers from various security products. Let's get this cleared up. WinPatrol is most likely responsible for the leftovers, so please disable or temporarily uninstall this first before proceeding with the steps below. Keep WinPatrol disabled/uninstalled for the duration of troubleshooting.

Farbar Recovery Scan Tool (FRST) Script

• Please download the attached Fixlist.txt file from this email.
• Ensure the file is saved to your Downloads folder.
• Open your Downloads folder. Inside you should see a file named FRSTEnglish.exe along with Fixlist.txt.
• Right-click FRSTEnglish.exe and select Run as administrator to run the program.
• Click the Fix button (not the Scan button). Please be patient.
• If you are prompted to reboot upon completion, please consent.
• A log named Fixlog.txt will be saved in your Downloads folder.
• Please attach the log in your next reply.

-----

I know you mentioned trying with Norton Security disabled. Just to rule this out entirely, could you temporarily uninstall Norton Security, reboot the machine and try to run AdwCleaner once more by double-clicking the file.

Failing that, we can take a closer look at exactly what events are taking place when you run AdwCleaner by using a tool such as Process Monitor.
 

Fixlist.txt

[laflaone]

On 6/4/2019 at 5:29 AM, LiquidTension said:

Thanks for the file. Nothing specifically related to the issue you're having with AdwCleaner is standing out.

There's a bunch of leftovers from various security products. Let's get this cleared up. WinPatrol is most likely responsible for the leftovers, so please disable or temporarily uninstall this first before proceeding with the steps below. Keep WinPatrol disabled/uninstalled for the duration of troubleshooting.

Farbar Recovery Scan Tool (FRST) Script

• Please download the attached Fixlist.txt file from this email.
• Ensure the file is saved to your Downloads folder.
• Open your Downloads folder. Inside you should see a file named FRSTEnglish.exe along with Fixlist.txt.
• Right-click FRSTEnglish.exe and select Run as administrator to run the program.
• Click the Fix button (not the Scan button). Please be patient.
• If you are prompted to reboot upon completion, please consent.
• A log named Fixlog.txt will be saved in your Downloads folder.
• Please attach the log in your next reply.

-----

I know you mentioned trying with Norton Security disabled. Just to rule this out entirely, could you temporarily uninstall Norton Security, reboot the machine and try to run AdwCleaner once more by double-clicking the file.

Failing that, we can take a closer look at exactly what events are taking place when you run AdwCleaner by using a tool such as Process Monitor.
 

Fixlist.txt 3.09 kB · 2 downloads

followed your instructions.  I removed Norton Security and Winpatrol, then ran the FRST as administrator.  Redownloaded AdwCleaner.  It still will not open.  You mentioned Process Monitor.  Should this be the next step?  BTW, I m reinstalling Norton, as I am uncomfortable with no internet protection.  I have attached the fixlog.txt log.

Fixlog.txt

[laflaone]

Dear LiquidTension, it's been two days since my last return post to you, and no response.  Have you given up on me?

[LiquidTension]

Apologies, I missed your post. Let's move onto Process Monitor and see if this provides further insight into the issue you're having.

Run Process Monitor

• Please download run_procmon.bat using the link below.
  → https://malwarebytes.box.com/s/he92cwwd71sa0w7waiub8wx69ymb5d4i
• Open your Downloads folder.
• Double-click run_procmon.bat. Click Yes if prompted by User Account Control.
• Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
• A blue window will appear.
• When prompted to carry out the tasks, please do the following:
  • Try to run AdwCleaner. Wait at least 20 seconds after double-clicking the file.
• Once done, click inside the Command Prompt window and press Y on your keyboard followed by Enter.
• Upon completion, a file named procmon-log.zip will be saved to your Desktop. Please attach the file in your next reply.
• Note: If the file is too large, you will be provided instructions to upload the file to a file hosting website (wetransfer.com).

[laflaone]

13 hours ago, LiquidTension said:

Apologies, I missed your post. Let's move onto Process Monitor and see if this provides further insight into the issue you're having.

Run Process Monitor

• Please download run_procmon.bat using the link below.
  → https://malwarebytes.box.com/s/he92cwwd71sa0w7waiub8wx69ymb5d4i
• Open your Downloads folder.
• Double-click run_procmon.bat. Click Yes if prompted by User Account Control.
• Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
• A blue window will appear.
• When prompted to carry out the tasks, please do the following:
  • Try to run AdwCleaner. Wait at least 20 seconds after double-clicking the file.
• Once done, click inside the Command Prompt window and press Y on your keyboard followed by Enter.
• Upon completion, a file named procmon-log.zip will be saved to your Desktop. Please attach the file in your next reply.
• Note: If the file is too large, you will be provided instructions to upload the file to a file hosting website (wetransfer.com).

When I clicked on the highlighted download area, it did not go to my downloads folder.  Instead it opened up a weird  looking page that is very lengthy.  It did have run_procmon.bat at the top left corner, but it is not clickable.

[exile360]

Simply click on the Download button in the upper right corner of the page and it should download the file to your Downloads folder.  Then you may proceed with the rest of the instructions.  I've posted an image of the button you should see in the upper right and I circled/highlighted it for you:

[laflaone]

On 6/7/2019 at 10:48 AM, exile360 said:

Simply click on the Download button in the upper right corner of the page and it should download the file to your Downloads folder.  Then you may proceed with the rest of the instructions.  I've posted an image of the button you should see in the upper right and I circled/highlighted it for you:

Thanks!  It worked.

[laflaone]

On 6/6/2019 at 8:17 PM, LiquidTension said:

Apologies, I missed your post. Let's move onto Process Monitor and see if this provides further insight into the issue you're having.

Run Process Monitor

• Please download run_procmon.bat using the link below.
  → https://malwarebytes.box.com/s/he92cwwd71sa0w7waiub8wx69ymb5d4i
• Open your Downloads folder.
• Double-click run_procmon.bat. Click Yes if prompted by User Account Control.
• Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
• A blue window will appear.
• When prompted to carry out the tasks, please do the following:
  • Try to run AdwCleaner. Wait at least 20 seconds after double-clicking the file.
• Once done, click inside the Command Prompt window and press Y on your keyboard followed by Enter.
• Upon completion, a file named procmon-log.zip will be saved to your Desktop. Please attach the file in your next reply.
• Note: If the file is too large, you will be provided instructions to upload the file to a file hosting website (wetransfer.com).

Attached is the file.  While it was running in the command prompt window, it stopped and said an error had occured.

procmon-log.txt

[LiquidTension]

Thanks. There was an issue with downloading the Process Monitor executable.

It will need to be manually downloaded using the following link: https://live.sysinternals.com/Procmon.exe

• After downloading the file, run it and wait for the main window to populate.
• Try to run AdwCleaner. Wait at least 20 seconds after double-clicking the file.
• Return to the Process Monitor window.
• Click File -> Capture Events.
• Click File -> Save.
• Ensure "All events" is selected, make a note of the path that the file is being saved to and click OK.
• Navigate to the location of the saved PML file. Right-click the file and click Send to followed by Compressed (Zipped) file.
• Upload the file to WeTransfer.com and provide the download link in a new post.
  • Open the WeTransfer.come website.
  • Click Add your files, navigate to the location of the Zip file and double-click it.
  • Click (...) and select the link radio button under Send as.
  • Click Transfer.
  • Copy the download link and paste it in a new forum post.

[laflaone]

1 hour ago, LiquidTension said:

Thanks. There was an issue with downloading the Process Monitor executable.

It will need to be manually downloaded using the following link: https://live.sysinternals.com/Procmon.exe

• After downloading the file, run it and wait for the main window to populate.
• Try to run AdwCleaner. Wait at least 20 seconds after double-clicking the file.
• Return to the Process Monitor window.
• Click File -> Capture Events.
• Click File -> Save.
• Ensure "All events" is selected, make a note of the path that the file is being saved to and click OK.
• Navigate to the location of the saved PML file. Right-click the file and click Send to followed by Compressed (Zipped) file.
• Upload the file to WeTransfer.com and provide the download link in a new post.
  • Open the WeTransfer.come website.
  • Click Add your files, navigate to the location of the Zip file and double-click it.
  • Click (...) and select the link radio button under Send as.
  • Click Transfer.
  • Copy the download link and paste it in a new forum post.

Unable to get it to copy and paste, so here is the web link.  https://we.tl/t-SawGpOr1BQ         I tried unsuccessfully again to run AdwCleaner.  If it will help you locate it is right around the 10:33 time on the file that I tried to run it.

[LiquidTension]

Thanks for the file.

The log confirms AdwCleaner isn't crashing. Around the time AdwCleaner is launched up until the process exits, there's activity from the following programs:

• Ashampoo UnInstaller
• Malwarebytes for Windows
• Norton Security
• Acronis True Image
• Active Desktop Calendar

Unfortunately, the issue wasn't reproducible after setting up a Windows 7 machine and testing various scenarios with the above software installed.

We can see that immediately before AdwCleaner exits unexpectedly, Norton Security has opened up the AdwCleaner exe file for reading.


Do you have Norton Security configured with non-default settings?

I know you mentioned that you've already tried with Norton Security disabled. However, just disabling is sometimes not sufficient. Would you be willing to temporarily uninstall Norton Security, reboot and then try running AdwCleaner once more? At the very least, this will help rule out Norton Security for definite.

Also, I don't see consent.exe being launched at any point. Just to confirm, when you run AdwCleaner, the User Account Control (UAC) box doesn't appear prompting you to "allow changes"?