Rechercher

Ok.

So, to remove UCGuard, can you try this:

• Download MalwareBytes Anti Malware here.
• Launch MalwareByte's Anti Malware from your desktop
• Click on the tab Settings -> Detection & Protection -> PUP/PUM and check "Treat these detections like malware".
• Tab Exam choose Threats, click on Scan now, and click on Launch the exam.
• If something is detected, choose to Quarantine everything. If it as...

Hello,

Ok.

• So please launch AdwCleaner.
• Do a scan.
• Then, in the "Services" tab, please unselect "UCGuard".
• Click on "Clean", the computer will reboot.

Finally, please share the file C:\AdwCleaner\AdwCleaner[Cxx].txt (where xx is the highest number you have).

Best regards,

---

fr33tux, 2016-08-31 11:31:57 (UTC)

yeah. It work. but what is the "UCGuard"? How to delete it?

Thankss!

Hello,

Ok.

• So please launch AdwCleaner.
• Do a scan.
• Then, in the "Services" tab, please unselect "UCGuard".
• Click on "Clean", the computer will reboot.

Finally, please share the file C:\AdwCleaner\AdwCleaner[Cxx].txt (where xx is the highest number you have).

Best regards,

bonjour,

juste pour vous signaler un faux positif dans la détection du registre 

Clé trouvée:  HKU\S-1-5-21-1809650161-3470081474-3047720606-1124\Software\Classes\DWGTrueViewToolCatalog Clé trouvée:  HKCU\Software\Classes\DWGTrueViewToolCatalog

DWG True View est une visionneuse de plan DWG très utilisé dans le monde du dessin :

http://www.autodesk.fr/products/dwg/viewers

merci :)

Hello,

Have you already done a "Clean", with UCGuard unselected in the Services tab ?

Of so, can you share me the file AdwCleaner[Cxx].txt ?

---

fr33tux, 2016-08-31 04:35:14 (UTC)

Sorry. but I can't find the files you mention

Hello,

Have you already done a "Clean", with UCGuard unselected in the Services tab ?

Of so, can you share me the file AdwCleaner[Cxx].txt ?

Please help me,

# AdwCleaner v6.000 - Logfile created 30/08/2016 at 19:08:51 # Updated on 12/08/2016 by ToolsLib # Database : 2016-08-23.1 [Local] # Operating System : Windows 8.1 Pro  (X64) # Username : PT.NB - ACER # Running from : D:\NBKC\Komputer\Software\adwcleaner_6.000.exe # Mode: Clean # Support : https://toolslib.net/forum

***** [ Services ] *****

[!] Service not deleted: 2cad402bf3...

Fortunately, I kept backups of CCleaner's registry deletions, some of which are clearly nothing to do with this adware:

• First run
• Second run

MBAM later found StartGo123, which had been hijacking Chrome.

I imagine the malware writers reading our conversation and learning too, but HTH.

Have now run CCleaner to clean Registry and remove many, but not all, references to BrowserAir.

Windows: Settings: System: Default apps: Choose default applications by file type: .htm no longer shows BrowserAir.

Ah, minor problems remain.

Opera now works again as my default browser.  However, Opera could not see that it was the default browser until I used Windows: Control Panel: Default Programs to set it as the default.

Even then:

• Neither Windows: Settings: System: Default apps: Web browser nor Windows: Settings: System: Default apps: Choose default applications by protocol: HTTP shows any of the ...