AdwCleaner - Reg Issue

[makinero]

What's the key.
Important keys, or can remove it?

Code: [Select]

Klucz znaleziono : HKLM\SOFTWARE\Classes\CLSID\{059EACC2-1ABE-49E8-928D-DC8BD355B7A9}
Klucz znaleziono : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Klucz znaleziono : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Klucz znaleziono : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Klucz znaleziono : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}

[Samson]

Why not try the AdwCleaner forum, it may be a false positive?

https://toolslib.net/forum/viewcategory/1-adwcleaner/

[makinero]

Why not try the AdwCleaner forum, it may be a false positive?

https://toolslib.net/forum/viewcategory/1-adwcleaner/

A)
I do not have an account on the forum

B)
I'm looking for a similar program, which will also show additional names.
JRT shows the name but the script removes everything!
After removing all the log shows with names.

[Samson]

A)
I do not have an account on the forum

Probably takes less time to register an account than it did to write this post   

[makinero]

Probably takes less time to register an account than it did to write this post   

LOL  I will not create accounts for only one question!

[Julian]

I did on tweaking.com now look at where in at  lol

[Boggin]

I've found AdwCleaner to be trustworthy when it comes to deleting keys it has found, but create a restore point before deleting them.

Right click on each in your post and drag the cursor over to highlight then right click on them and select Search with Bing/Google and a link may come up which will tell you what they relate to.

Did you run AdwCleaner just out of curiosity or because of a particular problem ?

[makinero]

Remove entries and later restored?
It does not make sense.
How do I know exactly what I remove?
Why waste time on searching on google each individual entry?


SpyHunter is probably the best, a lot of detailed information on the detected files, and even provides a page, A more in depth scans system registry, application, browser, etc.
but it is paid software!

[Boggin]

AdwCleaner does a pretty decent job considering it's free, but if you aren't happy with it then buy Spyhunter.

Those keys are probably orphans from removed PuPs, but the free version of MBAM also removes PuPs when you go into Settings/Detection and Protection and use the dropdown to treat PuPs and PuMs as malware, although having just reinstalled that on a laptop I've factory reset, they are already set at that now.

The suggestion to create a restore point prior to having it delete anything was just as a belt and braces for you as you were unsure of letting it delete those files.

[makinero]

Can delete files, but from time to time come back

Code: [Select]

Ochrona systemu plików w czasie rzeczywistym plik C:\Users\..\AppData\Local\Temp\tmp000002eb\tmp000000b9 odmiana zagrożenia Win32/Injector.ANCS koń trojański wyleczony przez usunięcie Zdarzenie wystąpiło podczas tworzenia nowego pliku przez aplikację: C:\EEK\bin64\a2emergencykit.exe (E3E6270C3484EE13E8623492E3F8294065203636). 562F5E0643D67C8143C450910A462C120CB43B37


Ochrona systemu plików w czasie rzeczywistym plik C:\Users\..\AppData\Local\Temp\tmp000002eb\tmp00000080 odmiana zagrożenia Win32/Plambot.G koń trojański wyleczony przez usunięcie Zdarzenie wystąpiło podczas tworzenia nowego pliku przez aplikację: C:\EEK\bin64\a2emergencykit.exe (E3E6270C3484EE13E8623492E3F8294065203636). E48F37C90304240139A8C83035B85A9F70D3451C

[Boggin]

That isn't a PuP but an infection and you want something more stronger than an adware remover -

Real-time file system protection file C:\Users\.. \AppData\Local\Temp\tmp000002eb\tmp000000b9 variety of threats Trojan horse URWin32/Injector.ANCS cured by removing the event occurred when you create a new file by the application: C:\EEK\bin64\a2emergencykit.exe (E3E6270C3484EE13E8623492E3F8294065203636). 562F5E0643D67C8143C450910A462C120CB43B37

Real-time file system protection file C:\Users\.. \AppData\Local\Temp\tmp000002eb\tmp00000080 variety of threats Win32/Plambot Trojan horse.

Which program has produced this log ?

What is that emergencykit.exe that you have installed and which website did you use to download it ?

Boot up into Safe Mode with Networking and run a scan with the ESET Free Online Scanner.

http://www.eset.co.uk/Antivirus-Utilities/Online-Scanner

Check the radio button for Enable detection of potentially unwanted applications then click on Advanced.

It's up to you if you want it to scan the archives, but check the button for Scan for potentially unsafe applications.

I've never used the Proxy one.

It's best run in Safe Mode as your AV program can interfere and whatever is on your computer should also be isolated in that mode.

[makinero]

I use two tools (according to me the best lightweight tool)
ESET Smart Security(AV/Firewall) works in real time, detects and move objects to quarantine.

Emsisoft Emergency Scanner 11 (does not work in real time) but it is very, very good and effective tool to scan any kind of malware, rotkit etc.

[Boggin]

Well your AV didn't catch that one from I what I understand of your log.

Did Emisoft produce that log and is that the emergencykit ?

[makinero]

Mr Boggin -
How to detect a website contains malicious software?

Of course, can easily remove malicious object but returns again - probably that I visit a page with malware, but I do not know which side, as it detected? 

[Boggin]

Normally your AV program should be able to detect if a site is malicious - if it doesn't then I suggest you use another AV program.

Another method to check out a website before visiting is to use VirusTotal.com - https://www.virustotal.com/

[makinero]

virustotal.com

This site not private / not anonymous ! !
can paste the 1,000 pages at the same time to check ? ?

[Boggin]

When you go to a website that has something nasty attached to it, your AV program should be able to pick up on it.

However, if you need to click on something in the article/website, then an AV program probably wouldn't pick up on that - this is how Ransomware gets onto computers.

I don't understand your bit about 1,000 pages - can you clarify ?

If this is a single file, then MSRT will be able to scan it - just go Start - type mrt.exe and press enter where you will the scan options.

[makinero]

Explanation.
I have an open session with the tabs "suspended"
so not all the tabs are loaded, but probably in this session are pages from unwanted malicious software that creates temporary files: