Jump to content

Adwcleaner detect registry key but it keep coming back


Go to solution Solved by Maurice Naggar,

Recommended Posts

Good day

Malwarebytes detect PUP.Optional.Ludashi, PUP.Optional.BundleInstaller and PUP.Optional.ChinAd. 

i had deleted the Quarantined file, then i run Adwcleaner, and did the same.

But, i rescan with Adwcleaner, there one registry key keep coming back, HKLM\Software\Wow6432Node\\Microsoft\Windows NT\CurrentVersion\Svchost|netsvcs - "HpSvc"

also, when looking at the window registry editor , i found the following item but Malwarebytes and Adwcleaner did not detect it.

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\360Safe

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\LiveUpdate360

i thinks its from 360 total security but i don't even remember install it in pc.

Please and advise regarding this matter

Cheers

AdwCleaner[C01].txt malwarebytes.txt AdwCleaner[C00].txt

Link to post
Share on other sites

Hello :welcome: 

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

  • Removing malware can be unpredictable
  • Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Only run the tools I guide you to.
  • Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
  • The removal of malware isn't instantaneous, please be patient.
  • Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • Please stick with me until I give you the "all clear".
  • If your system is running Discord, please be sure to Exit out of it while this case is on-going.

I would like a report set for review. This is a report only.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then Gather Logs

Have patience till the run has finished.
Attach the mbst-grab-results.zip from the Desktop to your reply..

Link to post
Share on other sites

  • Solution

Thanks. Please set File Explorer to SHOW ALL folders, all files, including Hidden ones. Use OPTION ONE or TWO of this article
Please use this Guide

( 3 )

Please run the following custom script. Read all of this before you start. Please Close all open work.

Once the script-run has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program :  is FRSTENGLISH.exe which is already on Downloads

Please download the attached fixlist.txt file and save it to C:\Users\admin\Downloads

Fixlist.txt < - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Use File Explorer to go to the Downloads folder

RIGHT-Click on   FRSTENGLISH and select

RUN as Administrator

and reply YES to allow it to go forward to start.

That is important so that this run has Elevated Administrator rights !!

NEXT press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will reset the Winsock. It will attempt to clear all Cache and history on web browsers. Depending on the speed of your computer this fix may take 45-50 minutes or more. The main goal is an attempt to clear the issue of the odd "Hpsvc" & the 2 remainders of "360".

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

Link to post
Share on other sites

Thanks for the Fixlog report. Note: Windows Resource Protection found corrupt files and successfully repaired them.
What is being flagged by Adwcleaner is a potentially unwamted setting ....a P U P

 Detections categorized as PUPs are not considered as malicious as other forms of malware, and may even be regarded by some as useful. Malwarebytes detects potentially unwanted programs for several reasons, including:
	They may have been installed without the user’s consent. They may be supported by aggressive advertisements. They may be bundlers or part of a bundle. They may be misleading or offer a false sense of security.


https://www.malwarebytes.com/blog/detections/pup

 Malwarebytes protects users from PUP. and PUP.Optional detections by using real-time protection.

It is not any ransomware. Here are the next steps I would suggest that you run.
( 1 )
Disable ( turn OFF ) Fast Startup

https://www.windowscentral.com/how-disable-windows-10-fast-startup

Then restart the computer

( 2 )
NOTE: We do not recommend using CCleaner to ao anything on the system registry. ! Please refrain from doing that.

Do a custom scan with Microsoft Defender Antivirus 

Just want to do a visual check in Windows Security to see (visually) that Microsoft Defender is on , and to do a Custom scan.

From the Windows Start menu, select Settings, then select Update and Security.

Next, look at the left-side menu & select Windows Security

Next, In Windows Security section: Click on the grey button Open Windows Security

Now, click on the shield Virus and threat protection

Look to see that Microsoft Defender is shown & available for use.

On the next display, look at all the options.  Look down the list and see "Check for Updates" .

You should click on that to have the system check for updates for Windows Defender.  Watch & wait for that to complete.

Please also note that the Scan options (all) can be displayed by clicking on Scan options.   Click that & select CUSTOM scan & then pick the C drive  & have it go forward.

Once it has started the scan phase, you can go take a long break.   Let me know the results.

Edited by Maurice Naggar
Link to post
Share on other sites

The Microsoft Defender antivirus scan result is perfect. No threats, no virus, no trojan, no malware.
And just by the way, because the run does check with the Microsoft cloud, yes being connected & online is the thing to be.
This run gives a clean bill.
How is the situation at this point ?

Link to post
Share on other sites

You are very welcome. I am glad to have worked with you.

We can proceed with cleanup of tools we used.

To remove the FRSTENGLISH tool & its work files, do this. Go to your Downloads folder. Do a RIGHT-click on FRSTENGLISH.exe & select

RENAME

& then change it to

UNINSTALL.exe

.
Then run that ( double click on it) to begin the cleanup process.

Delete mb-support-1.8.7.918.exe
Delete mbst-grab-results.zip on the Desktop.

Adwcleaner you may keep and use as needed.
Any other download file I had you download, you may delete.
Consider using PatchMyPC, keep all your software up-to-date - https://patchmypc.com/home-updater#download

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

I am marking this case for closure.
I wish you all the best. Stay safe.
Sincerely.

Maurice

Link to post
Share on other sites

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.