# AdwCleaner 7.0.6.0 - Logfile created on Tue Jan 16 15:41:41 2018 # Updated on 2017/21/12 by Malwarebytes # Running on Windows 10 Pro (X64) # Mode: clean # Support: https://www.malwarebytes.com/support ***** [ Services ] ***** Deleted: AdvancedSystemCareService10 ***** [ Folders ] ***** Deleted: C:\ProgramData\IObit\Advanced SystemCare Deleted: C:\ProgramData\Application Data\IObit\Advanced SystemCare Deleted: C:\Windows\System32\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare Deleted: C:\Windows\System32\config\systemprofile\AppData\LocalLow\IObit\Advanced SystemCare Deleted: C:\Program Files (x86)\IObit\Advanced SystemCare Deleted: C:\Program Files (x86)\Common Files\IObit\Advanced SystemCare Deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\IObit\Advanced SystemCare Deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare Deleted: C:\Users\All Users\IObit\Advanced SystemCare Deleted: C:\Users\Tony\AppData\LocalLow\IObit\Advanced SystemCare Deleted: C:\Users\Tony\AppData\Roaming\IObit\Advanced SystemCare Deleted: C:\ProgramData\IObit\Advanced SystemCare Deleted: C:\ProgramData\Application Data\IObit\Advanced SystemCare Deleted: C:\Windows\System32\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare Deleted: C:\Windows\System32\config\systemprofile\AppData\LocalLow\IObit\Advanced SystemCare Deleted: C:\Program Files (x86)\IObit\Advanced SystemCare Deleted: C:\Program Files (x86)\Common Files\IObit\Advanced SystemCare Deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\IObit\Advanced SystemCare Deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare Deleted: C:\Users\All Users\IObit\Advanced SystemCare Deleted: C:\Users\Tony\AppData\LocalLow\IObit\Advanced SystemCare Deleted: C:\Users\Tony\AppData\Roaming\IObit\Advanced SystemCare Deleted: C:\Users\All Users\Documents\Guid Deleted: C:\Users\Public\Documents\Guid Deleted: C:\Program Files (x86)\Common Files\Tencent Deleted: C:\Users\Tony\AppData\Roaming\Tencent Deleted: C:\ProgramData\IObit\ASCDownloader Deleted: C:\ProgramData\Application Data\IObit\ASCDownloader Deleted: C:\Users\All Users\IObit\ASCDownloader Deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare Deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\minergate Deleted: C:\Program Files\minergate Deleted: C:\Users\Tony\AppData\Local\minergate Deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auslogics Deleted: C:\ProgramData\Auslogics Deleted: C:\ProgramData\Application Data\Auslogics Deleted: C:\Users\All Users\Auslogics Deleted: C:\Users\Tony\AppData\Roaming\ScreenSnapshotTool Deleted: C:\ProgramData\\WindowsErrorReporting Deleted: C:\ProgramData\WindowsErrorReporting Deleted: C:\ProgramData\Application Data\WindowsErrorReporting Deleted: C:\Users\All Users\WindowsErrorReporting ***** [ Files ] ***** Deleted: C:\Windows\SysNative\REGISTRYDEFRAGBOOTTIME.EXE Deleted: C:\Users\Tony\appdata\local\installationconfiguration.xml Deleted: C:\Users\Tony\AppData\Local\PO.DB Deleted: C:\Users\Tony\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Driver Booster.lnk ***** [ DLL ] ***** No malicious DLLs cleaned. ***** [ WMI ] ***** No malicious WMI cleaned. ***** [ Shortcuts ] ***** No malicious shortcuts cleaned. ***** [ Tasks ] ***** Deleted: Driver Booster Scheduler Deleted: Microsoft\Windows\Windows Error Reporting\ErrorReporting Deleted: ASC10_SkipUac_Tony ***** [ Registry ] ***** Deleted: [Key] - HKLM\SOFTWARE\IOBIT\ASC Deleted: [Key] - HKLM\SOFTWARE\IObit\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\IObit\RealTimeProtector Deleted: [Key] - HKLM\SOFTWARE\IObit\ASC Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{BA935377-E17C-4475-B1BF-DE3110613A99} Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{2803063F-4B8D-4dc6-8874-D1802487FE2D} Deleted: [Key] - HKLM\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Advanced SystemCare Deleted: [Key] - HKLM\SOFTWARE\{61FFE1F9-137D-4c31-A181-3415FCAA5946} Deleted: [Key] - HKLM\SOFTWARE\ScreenSnapshotTool Deleted: [Key] - HKU\S-1-5-21-3954657305-822291749-994707393-1001\Software\VideoBox Deleted: [Key] - HKCU\Software\VideoBox Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare_is1 Deleted: [Key] - HKLM\SOFTWARE\Microsoft\DMunversion Deleted: [Key] - HKLM\SOFTWARE\Classes\AppID\{51BEE30D-EEC8-4BA3-930B-298B8E759EB1} Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{6B3732AA-F6D4-4F16-9E22-49EDC52C9514} Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E} Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{70DE12EA-79F4-46BC-9812-86DB50A2FD64} Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{B9E49847-9822-4139-BC55-7173ED1ADA11} Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{B9E49847-9822-4139-BC55-7173ED1ADA11} Deleted: [Value] - HKU\S-1-5-21-3954657305-822291749-994707393-1001\Software\Microsoft\Windows\CurrentVersion\Run|Advanced SystemCare 10 Deleted: [Value] - HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Advanced SystemCare 10 Deleted: [Key] - HKLM\SOFTWARE\Classes\AppID\DownloadProxy.EXE Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION|AndroidServer.exe Deleted: [Value] - HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|YeaDesktop.exe Deleted: [Value] - HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION|YeaDesktop.exe Deleted: [Key] - HKU\S-1-5-21-3954657305-822291749-994707393-1001\Software\isMiner Deleted: [Key] - HKCU\Software\isMiner Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MinerGate Deleted: [Key] - HKU\S-1-5-21-3954657305-822291749-994707393-1001\Software\FastDataX Deleted: [Key] - HKCU\Software\FastDataX Deleted: [Key] - HKU\S-1-5-21-3954657305-822291749-994707393-1001\Software\MICROSOFT\wewewe Deleted: [Key] - HKCU\Software\MICROSOFT\wewewe Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{D4EF86C3-77D7-4F82-BBB8-6DFFAB6E2D32} Deleted: [Key] - HKLM\SOFTWARE\DtsEncodeTools Deleted: [Key] - HKU\S-1-5-21-3954657305-822291749-994707393-1001\Software\Microsoft\BigTime Deleted: [Key] - HKCU\Software\Microsoft\BigTime Deleted: [Key] - HKU\S-1-5-21-3954657305-822291749-994707393-1001\Software\Installer Deleted: [Key] - HKCU\Software\Installer Deleted: [Key] - HKLM\SOFTWARE\Microleaves Deleted: [Key] - HKLM\SOFTWARE\Microsoft\APreSam Deleted: [Key] - HKLM\SOFTWARE\Microsoft\NSaveA Deleted: [Key] - HKLM\SOFTWARE\Microsoft\PrAmNP Deleted: [Key] - HKLM\SOFTWARE\Microsoft\MPrForShutT Deleted: [Key] - HKLM\SOFTWARE\Microsoft\PrIncub Deleted: [Key] - HKU\S-1-5-21-3954657305-822291749-994707393-1001\Software\Microsoft\{cc6eb6d8-85b7-435p-8b86-51e4d16ea76d} Deleted: [Key] - HKCU\Software\Microsoft\{cc6eb6d8-85b7-435p-8b86-51e4d16ea76d} Deleted: [Key] - HKLM\SOFTWARE\Auslogics Deleted: [Key] - HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\26D9E607FFF0C58C7844B47FF8B6E079E5A2220E Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ASC10_SkipUac_Tony ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries deleted. ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries deleted. ************************* ::Tracing keys deleted ::Winsock settings cleared ::Additional Actions: 0 ************************* C:/AdwCleaner/AdwCleaner[S0].txt - [10199 B] - [2018/1/16 15:40:1] ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########