Why when I turn on my laptop a cmd window opens that says adwcleaner?

[IanHawk]

That's weird!

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the AdwCleaner Help forum.
In order to help us assist you to resolve your issue, please post or attach your latest AdwCleaner log files with your post. https://support.malwarebytes.com/hc/en-us/articles/360039021593

Someone will reply shortly, but in the meantime here are a few resources which may help resolve your issue:

• Malwarebytes AdwCleaner guide
• A malicious element isn't being detected? Submit the sample here!
• Need help with another Malwarebytes product or malware removal?
  • Click here for home support
  • Click here for business support
  • Click here for malware removal help

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

 

 

 

[Maurice Naggar]

Hello.   Make very sure that your pc has the very latest Version 8.0.7

AdwCleaner is available for download: https://malwarebytes.com/adwcleaner

[Maurice Naggar]

PS.  If what you describe is showing at every Windows startup, then there would seem to be some sort of leftover task or something similar.

If so, you are urged to run the Malwarebytes Support tool >>  Gather logs  as outlined in the first reply at the top.

Sincerely.

[IanHawk]

[Maurice Naggar]

Hello.

As I noted above, a report ( from the Support tool) would be good.

The latest version of Adwcleaner is 8.0.7   It is newer that what your pc has.

Find the adwcleaner.exe currently on your system.  Delete that.

Then go into Windows'  Task Scheduler.   Look for a task mentioning adwcleaner.  Delete that task.  ( note the title bar showing "taskeng.exe".   That is from the task scheduler of Windows.  Some thing was set in the scheduler to use Adwcleaner thru a command line.

Download and save the latest version of Adwcleaner.     https://malwarebytes.com/adwcleaner

[IanHawk]

I understand that adwcleaner is a disposable program. I don't know why this program keeps doing things on my computer. 

Or maybe this has to do with MalwareBytes installed on my pc.

[exile360]

ADWCleaner doesn't interact with Malwarebytes directly.  I believe ADWCleaner uses DOR (Delete on Reboot) technology to remove detected adware, similar to how the scan engine in Malwarebytes does.  This means that it performs a cleanup routine after items have been detected on the following system reboot, however that DOR startup entry is supposed to delete itself once its task has been performed.  It is possible that the one-time startup for the cleanup process failed to delete itself for some reason and that would explain why it is launching every startup.  If this occurs, deleting the main program will get rid of it, however so would deleting the startup entry (the scheduled task mentioned above).

Edited July 26, 2020 by exile360

[IanHawk]

Ok, I recently did a scan with adwcleaner on my other computer. Some things were detected, but I preferred not to do anything with them due to the problem I had with my laptop.

The same problem will happen to my other computer?

 

[exile360]

No, it shouldn't, however please let us know if it does.  This definitely isn't a common issue, so I am hoping it was just a fluke.

[IanHawk]

After using adwcleaner with my other computer, I restored the system to yesterday.

I hope nothing happens.

[exile360]

No worries, even if it exhibits the same behavior on your other system, it's quite harmless, and if you require assistance in removing the startup entry we can easily guide you in locating and removing it (I personally use a utility from Microsoft Sysinternals called Autoruns, however there are multiple tools that can do the job without requiring you to dig into Windows if you don't want to or aren't comfortable doing so).

[jboursier]

Hello,

@IanHawk This was a known issue with AdwCleaner 8.0.6, fully resolved in 8.0.7.

Please update and let me know if you still face any issue,

[IanHawk]

Then do I have to update to fix the problem? only that?

[IanHawk]

@exile360 Could you explain how? that option seems better to me

[exile360]

34 minutes ago, IanHawk said:

Then do I have to update to fix the problem? only that?

To prevent it from happening in the future you will need to use the latest version.

31 minutes ago, IanHawk said:

@exile360 Could you explain how? that option seems better to me

If you see the problem occur, let us know and we will guide you in locating the startup entry and removing it safely.  Once it is removed, you will restart your system and it should not return as long as you do not run the older version of ADWCleaner on the system any more.

[IanHawk]

I already updated it, I don't know why it still happens

[exile360]

If the entry is left behind, it will continue to occur until it has been deleted, so lets proceed with that now (I'm sorry, I thought you had already done so using the info Maurice provided in his post earlier).

To begin, please do the following:

Create an Autoruns Log:

Please download Sysinternals Autoruns from here and save it to your desktop.

Note: If using Windows Vista, Windows 7, Windows 8/8.1 or Windows 10 then you also need to do the following:

Right-click on Autoruns.exe and select Properties
Click on the Compatibility tab
Under Privilege Level check the box next to Run this program as an administrator
Click on Apply then click OK

• Double-click Autoruns.exe to run it.
• Once it starts, please press the Esc key on your keyboard.
• Now that scanning is stopped, click on the Options button at the top of the program and verify that the following are checked, if they are unchecked, check them:

Hide empty locations
Hide Windows entries

• Click on the Options button at the top of the program and select Scan Options... then in the Autoruns Scan Options dialog enable/check the following two options:

Verify code signatures
Check VirusTotal.com

• Once that's done click the Rescan button at the bottom of the Autoruns Scan Options dialog and this will start the scan again, this time let it finish.
• When it's finished and says Ready. on the lower left of the program window, please click on the File button at the top of the program and select Save and save the file to your desktop and close Autoruns.
• Right click on the file on your desktop that you just saved and hover your mouse over Send To and select Compressed (zipped) Folder
• Attach the ZIP folder you just created to your next reply

[IanHawk]

Thanks, I have solved it!

After a while I used autoruns to see something else and accidentally unchecked something, but I didn't click "save"

I closed the program so that what I did was not saved.

If I unchecked something and closed the program without saving it, will everything be as if nothing had ever been done?

[exile360]

No, there is no 'apply' or 'save' option, so the changes you make in Autoruns take effect immediately.  That's OK though, because when you uncheck something it is disabled so that it doesn't run at startup any more, but it is not deleted so that you can run Autoruns at a later time if need be, re-check the previously unchecked box (which will still show as unchecked the next time you run Autoruns), and the item will be re-enabled.  This is because when you uncheck something rather than using the delete option in Autoruns, Autoruns creates a backup of the startup item in a location that doesn't allow it to launch on startup, but still stores it so that it can be put back in the correct location so that it does run at startup if you re-check the box.

There is no need to actually delete the backup of the startup item if you don't want to as keeping that backup (the unchecked box) does no harm at all, and if you have any trouble down the road, you can re-enable the item if you need to for any reason.

[IanHawk]

Where can I see what I unchecked?

[exile360]

It will be the same item in the same location in Autoruns that it was when you unchecked it, and you will notice that the checkbox to the left of it is already unchecked, indicating that it is disabled.

[IanHawk]

Well I have done a test with my laptop. I created a restore point.

Then I deactivated some boxes, restore the system and they were activated as before. I had a restore point created before

 

Thank you!

 

 

 

 

 

 

 

 

 

 

[exile360]

Yep, that's because a restore point restores the registry, which is where most of those startup items (and the backups that Autoruns creates when you uncheck them) are stored  

Autoruns is a very handy tool, just be careful not to uncheck anything unless you are certain that it is not required for your system to boot, as disabling the wrong thing (such as any critical Windows system service or critical driver) can cause the system to fail to boot or even crash on startup.

[IanHawk]

Does it work like this on all computers?