Jump to content
seagreen

AdwCleaner finds Trojan.Agent; Malwarebytes finds nothing

Recommended Posts

I'm here after a lengthy thread in the AdwareCleaner forum.  
Adware finds 4 items in the registry that it has termed trojan.agent.   

These are the 4 items:
v2.28|Action=Allow|Active=TRUE|Dir=Out|App=c:\program files (x86)\common files\java\java update\jusched.exe|Name={Glasswire.app.out_85}|Desc=GlassWire|EmbedCtxt=GlassWire
v2.28|Action=Allow|Active=TRUE|Dir=In|App=c:\program files (x86)\common files\java\java update\jusched.exe|Name={Glasswire.app.in_192}|Desc=GlassWire|EmbedCtxt=GlassWire|
v2.28|Action=Allow|Active=TRUE|Dir=Out|App=c:\program files (x86)\common files\java\java update\jusched.exe|Name={Glasswire.app.out_192}|Desc=GlassWire|EmbedCtxt=GlassWire|
v2.28|Action=Allow|Active=TRUE|Dir=In|App=c:\program files (x86)\common files\java\java update\jusched.exe|Name={Glasswire.app.in_85}|Desc=GlassWire|EmbedCtxt=GlassWire|

They are all firewall rules that allow Java to communicate.

 Long story short - no matter what I've done including AdwareCleaner quarantine/removal,  Uninstalling Java and manually editing both the registry, glasswire and windows firewalls to remove ALL references to Java, those entries return after each reboot (with different number strings).

Malwarebytes Premium threat scan shows nothing.  [Log attached].

Farbar Recovery Scan Tool won't download and fails with the following message: "Failed - Virus detected"  - so I can't run that. 

Malwarebytes.txt

Share this post


Link to post
Share on other sites

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and let me know what problem persists.

fixlist.txt

Share this post


Link to post
Share on other sites

Thank you. 

Before I do anything else,  I'm getting multiple trojan warnings from Windows Defender about FRST.exe.  [Reported as  Trojan:Win32/Wacatac.B!ml] 
Malwarebytes shows nothing.

Are you all sure that that .exe file is OK?

Share this post


Link to post
Share on other sites

These are the reports from Windows Defender Firewall
 

-file: C:\Users\Martha\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0016ed

-file: C:\$Recycle.Bin\S-1-5-21-2486084818-4069358932-3362996075-1003\$RE7OHKH.crdownload
webfile: E:\Downloads\FRST.exe|
https://download.bleepingcomputer.com/dl/668c4593ed6df08a95380276b700406c/5d46193d/windows/security/security-utilities/f/farbar-recovery-scan-tool/FRST.exe|pid:8760,ProcessStart:132093485805631550

-file: E:\Downloads\35994407-c4ff-4e52-8499-2bd3e2b9c300.tmp

-file: C:\Users\Martha\Desktop\Unconfirmed 235135.crdownload

Share this post


Link to post
Share on other sites
8 hours ago, nasdaq said:

 

AdWare Cleaner says those 4 trojan.agents still exist after fixing and a reboot.  

Capture.JPG

Fixlog.txt

Share this post


Link to post
Share on other sites

Hi,

The Farbar program is safe if downloaded from the Link I provided.

The program uses tools that could be harmful if used in other contexts.
This is not the case.

Clean your Recycle Bin to remove what was  deleted by Windows Defender.

You can add an exclusion to Windows Defender so as not to scan your Recycle bin.
How to:
https://support.microsoft.com/en-ca/help/4028485/windows-10-add-an-exclusion-to-windows-security
===

Please post the AdwCleaner log so that I can investigate further.

Share this post


Link to post
Share on other sites

Hi,

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and let me know what problem persists.

fixlist.txt

Share this post


Link to post
Share on other sites

I've "kinda" fixed the issue by temporarily uninstalling Glasswire.  
AdwareCleaner scans have turned up clean through several reboots.  It appears that Glasswire was putting those registry  back after each cleaning probably from it's database.
I *think* a clean reinstall should solve the issue.  The problem that remains is Adware Cleaner flagging those registry items as coming from a trojan.  
There are legitimate programs that require Java to be installed and if I re-install it I expect those entries will return.   
 

Share this post


Link to post
Share on other sites

Hi,

The registry items removed from the Firewall settings are randomized. Nothing is found on the web.

It might just be that GlassWire's Firewall is creating these random entries. 

If you reinstall the application and some other random entries are detected and not removed by AdwCleaner you can report the false positive at:

https://support.malwarebytes.com/docs/DOC-1160/

Any remaining issues?

Share this post


Link to post
Share on other sites

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.