Search

the problem is that it actually found the ucguard.sys.. and then it asked me to restart the computer to remove it but it is still there

---

pedromatt, 2016-09-30 12:37:05 (UTC)

that bad news ! I just to ran Roguekiller and I will see what report ! did you ran a scan with your AV ?

which mode did you ran Roguekiller ? normal or safe mode ?

have you ran the Roguekliller in safe mode ? will . I need to run the Roguekliller once again to confirm it! you no need to ran adwcleaner again . it’s maybe a bug in adwcleaner (and I had the same problem as your)

also you could to ran adware cleaner in the safe mode and see if that is help or not

if non above is helped then I can to let you about other options !

https://postimg.org/image/y...

So I was really happy that roguekiller found ucguard.sys.. was suposed to remove it but I scanned with adwcleaner and it's still there.. This UCGuard is really annoying, ffs..

Trying it now while I wait for the admin to answer, thank you! I'll leave feedback in a moment

And this is what went to quarantine:

https://gyazo.com/5be47efeb58258eaa48f2ffaf39c3b35

it did not ask me to restart my computer

I don't have a tab "Exam" . Do you mean the "Scan one"? ( https://gyazo.com/3a8031657b4499e05de41e695c64fcb2  ) If it is indeed that tab, I think this is what you want:

Malwarebytes Anti-Malware www.malwarebytes.org

Scan Date: 30/09/2016 Scan Time: 00:32 Logfile: test.txt Administrator: Yes

Version: 2.2.1.1043 Malware Database: v2016.09.29.13 Rootkit Database: v2016.09.26.02 License: F...

Hello,

• Download MalwareBytes Anti Malware here.
• Launch MalwareByte's Anti Malware from your desktop
• Click on the tab Settings -> Detection & Protection -> PUP/PUM and check "Treat these detections like malware".
• Tab Exam choose Threats, click on Scan now, and click on Launch the exam.
• If something is detected, choose to Quarantine everything. If it asks you to reboot the computer, do it.
...

Better?  what do you mean no more threats?

Hello,

Yes. It should be better now, do you confirm ?

Ok. In this case, can you share the file "C:\AdwCleaner\quarantine\quarantine.db" ?

Thanks,