ADWCleaner item

[egdufwollamhsram1851]

HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA

This was the only thing found, by ADWCleaner, what does it refer to? I've seen several items about it, don't know
tks

[HAN]

Here's a link to an analysis by Sophos with the same numbers in question. I'm no authority but it doesn't look the best...

http://www.sophos.com/en-us/threat-c...-analysis.aspx

[egdufwollamhsram1851]

I read that also, plus others, not sure if it's one time or?

[jdc2000]

The article indicates that the registry key in question is one of those created by the Trojan listed. It does not say whether anything else might also create that registry key, but if I were working on that computer I would be scanning it for malware with Malwarebytes, my antivirus software, and any tools specific for that particular trojan.

[egdufwollamhsram1851]

i have done that ADWC found it none others

[jdc2000]

If that was the only remnant found, then you are probably OK.

[egdufwollamhsram1851]

i ran malwarebytes, clean
------------------------------
here is the ADWC log
---------
# AdwCleaner v4.111 - Logfile created 26/02/2015 at 14:11:16
# Updated 18/02/2015 by Xplode
# Database : 2015-02-18.3 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Owner - OWNER-PC
# Running from : C:\Users\Owner\Downloads\AdwCleaner.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v36.0 (x86 en-US)


*************************

AdwCleaner[R0].txt - [3000 bytes] - [14/10/2014 16:35:33]
AdwCleaner[R10].txt - [1880 bytes] - [25/02/2015 23:04:29]
AdwCleaner[R11].txt - [1999 bytes] - [26/02/2015 14:05:07]
AdwCleaner[R1].txt - [3054 bytes] - [14/10/2014 20:56:52]
AdwCleaner[R2].txt - [925 bytes] - [14/10/2014 21:05:13]
AdwCleaner[R3].txt - [989 bytes] - [16/11/2014 18:37:28]
AdwCleaner[R4].txt - [1111 bytes] - [19/11/2014 22:36:19]
AdwCleaner[R5].txt - [3121 bytes] - [01/02/2015 00:36:58]
AdwCleaner[R6].txt - [1448 bytes] - [06/02/2015 21:47:00]
AdwCleaner[R7].txt - [3621 bytes] - [13/02/2015 11:15:53]
AdwCleaner[R8].txt - [1645 bytes] - [16/02/2015 00:32:50]
AdwCleaner[R9].txt - [1763 bytes] - [24/02/2015 19:14:25]
AdwCleaner[S0].txt - [3053 bytes] - [14/10/2014 21:00:18]
AdwCleaner[S1].txt - [1049 bytes] - [16/11/2014 18:39:34]
AdwCleaner[S2].txt - [1173 bytes] - [19/11/2014 22:38:56]
AdwCleaner[S3].txt - [2841 bytes] - [01/02/2015 00:40:04]
AdwCleaner[S4].txt - [1516 bytes] - [06/02/2015 21:49:35]
AdwCleaner[S5].txt - [3693 bytes] - [13/02/2015 11:18:50]
AdwCleaner[S6].txt - [1713 bytes] - [16/02/2015 00:35:10]
AdwCleaner[S7].txt - [1831 bytes] - [24/02/2015 19:16:43]
AdwCleaner[S8].txt - [1948 bytes] - [25/02/2015 23:07:29]
AdwCleaner[S9].txt - [1928 bytes] - [26/02/2015 14:11:16]

########## EOF - C:\AdwCleaner\AdwCleaner[S9].txt - [1987 bytes] ##########


I just ran ADWCleaner again and it's still there.

[fink]

If ADWCleaner is deleting it then something else that has not yet been found is replacing it. I'd suggest starting a thread in the intensive care forum to get a more comprehensive cleaning.

[egdufwollamhsram1851]

I did, it got moved here.

right now i am doing a full scan with essentials, it is usually a quick scan, see what happens

maybe you can move this back?

[jdc2000]

Your initial post did not indicate that the entry was being re-created after ADWCleaner had deleted it. This is the type of information that is useful in recommending actions to take.

[egdufwollamhsram1851]

wouldn't it just be simpler to move this back, , it could have been answered there to begin with? i have been running a full scan on essentials for 2 hours, , this is coming from the desk top, this message, i read the history on this last night, apparently some one else must know also? sophos according to pc mag is not highly thought of on cleaning

[jdc2000]

Follow the steps from the sticky thread in the Intensive Care Unit forum, and post the scan logs and we'll move this back to that forum.

[egdufwollamhsram1851]

Follow the steps from the sticky thread in the Intensive Care Unit forum, and post the scan logs and we'll move this back to that forum.

It's there