AdwCleaner finds Trojan.Agent; Malwarebytes finds nothing

[seagreen]

I'm here after a lengthy thread in the AdwareCleaner forum.  
Adware finds 4 items in the registry that it has termed trojan.agent.   

These are the 4 items:
v2.28|Action=Allow|Active=TRUE|Dir=Out|App=c:\program files (x86)\common files\java\java update\jusched.exe|Name={Glasswire.app.out_85}|Desc=GlassWire|EmbedCtxt=GlassWire
v2.28|Action=Allow|Active=TRUE|Dir=In|App=c:\program files (x86)\common files\java\java update\jusched.exe|Name={Glasswire.app.in_192}|Desc=GlassWire|EmbedCtxt=GlassWire|
v2.28|Action=Allow|Active=TRUE|Dir=Out|App=c:\program files (x86)\common files\java\java update\jusched.exe|Name={Glasswire.app.out_192}|Desc=GlassWire|EmbedCtxt=GlassWire|
v2.28|Action=Allow|Active=TRUE|Dir=In|App=c:\program files (x86)\common files\java\java update\jusched.exe|Name={Glasswire.app.in_85}|Desc=GlassWire|EmbedCtxt=GlassWire|

They are all firewall rules that allow Java to communicate.

 Long story short - no matter what I've done including AdwareCleaner quarantine/removal,  Uninstalling Java and manually editing both the registry, glasswire and windows firewalls to remove ALL references to Java, those entries return after each reboot (with different number strings).

Malwarebytes Premium threat scan shows nothing.  [Log attached].

Farbar Recovery Scan Tool won't download and fails with the following message: "Failed - Virus detected"  - so I can't run that. 

Malwarebytes.txt

[seagreen]

Got FRST from another location and got it to download.  These are the log files

FRST.txt Addition.txt

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and let me know what problem persists.

fixlist.txt

[seagreen]

Thank you. 

Before I do anything else,  I'm getting multiple trojan warnings from Windows Defender about FRST.exe.  [Reported as  Trojan:Win32/Wacatac.B!ml] 
Malwarebytes shows nothing.

Are you all sure that that .exe file is OK?

[seagreen]

These are the reports from Windows Defender Firewall
 

-file: C:\Users\Martha\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0016ed

-file: C:\$Recycle.Bin\S-1-5-21-2486084818-4069358932-3362996075-1003\$RE7OHKH.crdownload
webfile: E:\Downloads\FRST.exe|
https://download.bleepingcomputer.com/dl/668c4593ed6df08a95380276b700406c/5d46193d/windows/security/security-utilities/f/farbar-recovery-scan-tool/FRST.exe|pid:8760,ProcessStart:132093485805631550

-file: E:\Downloads\35994407-c4ff-4e52-8499-2bd3e2b9c300.tmp

-file: C:\Users\Martha\Desktop\Unconfirmed 235135.crdownload

[seagreen]

8 hours ago, nasdaq said:

 

AdWare Cleaner says those 4 trojan.agents still exist after fixing and a reboot.  

Fixlog.txt

[nasdaq]

Hi,

The Farbar program is safe if downloaded from the Link I provided.

The program uses tools that could be harmful if used in other contexts.
This is not the case.

Clean your Recycle Bin to remove what was  deleted by Windows Defender.

You can add an exclusion to Windows Defender so as not to scan your Recycle bin.
How to:
https://support.microsoft.com/en-ca/help/4028485/windows-10-add-an-exclusion-to-windows-security
===

Please post the AdwCleaner log so that I can investigate further.

[seagreen]

AdwCleaner[S18].txt

[nasdaq]

Hi,

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and let me know what problem persists.

fixlist.txt

[seagreen]

Done and once again those registry entries return after the reboot.  

Fixlog.txt AdwCleaner[S19].txt

[seagreen]

I've "kinda" fixed the issue by temporarily uninstalling Glasswire.  
AdwareCleaner scans have turned up clean through several reboots.  It appears that Glasswire was putting those registry  back after each cleaning probably from it's database.
I *think* a clean reinstall should solve the issue.  The problem that remains is Adware Cleaner flagging those registry items as coming from a trojan.  
There are legitimate programs that require Java to be installed and if I re-install it I expect those entries will return.   
 

[nasdaq]

Hi,

The registry items removed from the Firewall settings are randomized. Nothing is found on the web.

It might just be that GlassWire's Firewall is creating these random entries. 

If you reinstall the application and some other random entries are detected and not removed by AdwCleaner you can report the false positive at:

https://support.malwarebytes.com/docs/DOC-1160/

Any remaining issues?

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks