No replies to this topic

[Metallica]

Content is republished with permission from Malwarebytes.

What is Reg Tuneup?

The Malwarebytes research team has determined that Reg Tuneup is a fake registry cleaner. These so-called "registry cleaners" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.

How do I know if I am infected with Reg Tuneup?

This is how the main screen of the registry cleaning application looks:



You will find these icons in your startmenu, taskbar, and on your desktop:



And see these warnings during install:





You may see this entry in your list of installed programs:



and these tasks in your Task Scheduler:



How did Reg Tuneup get on my computer?

These so-called registry cleaners use different methods of getting installed. This particular one was downloaded from their website.

How do I remove Reg Tuneup?

Our program Malwarebytes can detect and remove this potentially unwanted application.

• Please download Malwarebytes to your desktop.
• Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
• Then click Finish.
• Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
• If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
• When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
• Restart your computer when prompted to do so.

Is there anything else I need to do to get rid of Reg Tuneup?

• No, Malwarebytes' Anti-Malware removes Reg Tuneup completely.
• This PUP creates some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks.

How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this registry cleaner.

As you can see below the full version of Malwarebytes would have protected you against the Reg Tuneup installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.



and we block traffic to their domain:



Technical details for experts

You may see these entries in FRST logs:

 (Reg Tuneup) C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\RegTuneup.exe
 C:\Users\{username}\AppData\Roaming\7200c83b-a5d5-400a-b1b7-be1cb3cba95c
 C:\Windows\System32\Tasks\Reg Tuneup_DEFAULT
 C:\Windows\System32\Tasks\Reg Tuneup
 C:\Windows\System32\Tasks\Reg Tuneup_UPDATES
 C:\Users\Public\Desktop\Reg Tuneup.lnk
 C:\Windows\Tasks\Reg Tuneup_UPDATES.job
 C:\Windows\Tasks\Reg Tuneup_DEFAULT.job
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reg Tuneup
 C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c
 (hxxp://www.regtuneup.com/ ) C:\Users\{username}\Desktop\regtusetup_site.exe

Reg Tuneup (HKLM-x32\...\Reg Tuneup_is1) (Version: 3.6.18.560 - hxxp://www.regtuneup.com/)
Task: {41DA5632-B982-4C35-9C9A-779EEB10A4DF} - System32\Tasks\Reg Tuneup => C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\RegTuneup.exe [2017-01-06] (Reg Tuneup)
Task: {4A7A53FF-5734-420B-B100-3166F7EA2E75} - System32\Tasks\Reg Tuneup_UPDATES => C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\RegTuneup.exe [2017-01-06] (Reg Tuneup)
Task: {5C6F7F48-8E0A-487B-96E4-3ACEF1EDCC52} - System32\Tasks\Reg Tuneup_DEFAULT => C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\RegTuneup.exe [2017-01-06] (Reg Tuneup)
Task: C:\Windows\Tasks\Reg Tuneup_DEFAULT.job => C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\RegTuneup.exe
Task: C:\Windows\Tasks\Reg Tuneup_UPDATES.job => C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\RegTuneup.exe

Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c
       Adds the file eng_regtu.ini"="12/9/2016 6:00 PM, 75856 bytes, A
       Adds the file eng_uninst.ini"="12/2/2016 3:05 PM, 2830 bytes, A
       Adds the file FileList.regtu"="12/2/2016 3:05 PM, 13618 bytes, A
       Adds the file isxdl.dll"="1/6/2017 10:49 AM, 157632 bytes, A
       Adds the file RegList.regtu"="12/2/2016 3:05 PM, 93350 bytes, A
       Adds the file RegTuneup.exe"="1/6/2017 10:49 AM, 8909760 bytes, A
       Adds the file REGTUUns.exe"="1/6/2017 10:49 AM, 572864 bytes, A
       Adds the file Spanish_regtu.ini"="12/6/2016 6:47 PM, 87276 bytes, A
       Adds the file spanish_uninst.ini"="12/2/2016 3:05 PM, 3086 bytes, A
       Adds the file unins000.dat"="1/9/2017 8:13 AM, 40731 bytes, A
       Adds the file unins000.exe"="1/9/2017 8:12 AM, 1210816 bytes, A
       Adds the file unins000.msg"="1/9/2017 8:13 AM, 22701 bytes, A
       Adds the file xmllite.dll"="12/2/2016 3:05 PM, 126976 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reg Tuneup
       Adds the file Reg Tuneup.lnk"="1/9/2017 8:13 AM, 1226 bytes, A
       Adds the file Register Reg Tuneup.lnk"="1/9/2017 8:13 AM, 1252 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\7200c83b-a5d5-400a-b1b7-be1cb3cba95c
       Adds the file backup6.bin"="1/9/2017 8:13 AM, 534 bytes, A
       Adds the file eng_regtu.dat"="1/9/2017 8:13 AM, 29542 bytes, A
       Adds the file log_01-09-2017.log"="1/9/2017 8:13 AM, 0 bytes, A
       Adds the file results.regtu"="1/9/2017 8:14 AM, 7194 bytes, A
    In the existing folder C:\Users\Public\Desktop
       Adds the file Reg Tuneup.lnk"="1/9/2017 8:13 AM, 1208 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file Reg Tuneup"="1/9/2017 8:13 AM, 3152 bytes, A
       Adds the file Reg Tuneup_DEFAULT"="1/9/2017 8:13 AM, 3282 bytes, A
       Adds the file Reg Tuneup_UPDATES"="1/9/2017 8:13 AM, 3094 bytes, A
    In the existing folder C:\Windows\Tasks
       Adds the file Reg Tuneup_DEFAULT.job"="1/9/2017 8:13 AM, 328 bytes, A
       Adds the file Reg Tuneup_UPDATES.job"="1/9/2017 8:13 AM, 336 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures]
       "Reg Tuneup_DEFAULT.job"="REG_BINARY, ................................
       "Reg Tuneup_DEFAULT.job.fp"="REG_DWORD", -479819351
       "Reg Tuneup_UPDATES.job"="REG_BINARY, ................................
       "Reg Tuneup_UPDATES.job.fp"="REG_DWORD", -408786923
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\7200c83b-a5d5-400a-b1b7-be1cb3cba95c]
       "Expired"="REG_DWORD", 0
       "FirstTimeASPFired"="REG_DWORD", 1
       "MaxFixLimit"="REG_DWORD", 15
       "REGTUURL"="REG_SZ", "http://www.regtuneup.com/buynow/?utm_source=site&utm_campaign=default&utm_medium=newbuild"
       "RENEWALURL"="REG_SZ", "http://www.regtuneup.com/renewal/?utm_source=site&utm_campaign=default&utm_medium=newbuild"
       "ShowExitPage"="REG_DWORD", 0
       "TELNO"="REG_SZ", "(855) 761-8856"
       "TELNODE"="REG_SZ", "(800) 180-6512"
       "TELNOFR"="REG_SZ", "01.76.54.27.59"
       "TELNOJP"="REG_SZ", "03-5050-1410 "
       "TrialType"="REG_DWORD", 0
       "utm_campaign"="REG_SZ", "default"
       "utm_medium"="REG_SZ", "newbuild"
       "utm_source"="REG_SZ", "site"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\LANG]
       "LangID"="REG_DWORD", 0
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Jawego\Params]
       "REGTU"="REG_DWORD", 1
       "REGTUGuid"="REG_SZ", "7200c83b-a5d5-400a-b1b7-be1cb3cba95c"
       "utm_campaign"="REG_SZ", "default"
       "utm_medium"="REG_SZ", "newbuild"
       "utm_source"="REG_SZ", "site"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Reg Tuneup_is1]
       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\RegTuneup.exe"
       "DisplayName"="REG_SZ", "Reg Tuneup"
       "DisplayVersion"="REG_SZ", "3.6.18.560"
       "EstimatedSize"="REG_DWORD", 12391
       "HelpLink"="REG_SZ", "http://www.regtuneup.com/"
       "Inno Setup: App Path"="REG_SZ", "C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c"
       "Inno Setup: Icon Group"="REG_SZ", "Reg Tuneup"
       "Inno Setup: Language"="REG_SZ", "en"
       "Inno Setup: Setup Version"="REG_SZ", "5.5.6 (u)"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20170109"
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\"
       "MajorVersion"="REG_DWORD", 3
       "MinorVersion"="REG_DWORD", 6
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "http://www.regtuneup.com/"
       "QuietUninstallString"="REG_SZ", ""C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\unins000.exe" /silent"
       "URLInfoAbout"="REG_SZ", "http://www.regtuneup.com/"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Reg\Tuneup\key\6]
       "(Default)"="REG_BINARY, .......................................................................................................................o............................................................................................................................H...........
    [HKEY_CURRENT_USER\Software\7200c83b-a5d5-400a-b1b7-be1cb3cba95c]
       "1stInstalled_Time"="REG_SZ", "1/9/2017 8:13:27 AM"
       "AutoRepair"="REG_DWORD", 0
       "CanAutoScan"="REG_DWORD", 0
       "ConfirmBkUps"="REG_DWORD", 1
       "CurrentScanTime"="REG_BINARY, ........
       "ErrorCount"="REG_DWORD", 19
       "FirstRun"="REG_DWORD", 1
       "GoToSystemTrayOnClose"="REG_DWORD", 0
       "ImprovementProgram"="REG_DWORD", 1
       "NumTimesPCPRunned"="REG_DWORD", 1
       "RegErrFoundTillDate"="REG_DWORD", 0
       "RegErrsFixedLast"="REG_DWORD", 0
       "RegErrsFixedTillDate"="REG_DWORD", 0
       "ScheduledTime"="REG_SZ", ""
       "SetChkDontShowRedTrayPopup"="REG_DWORD", 0
       "SetChkREmovableMedia"="REG_DWORD", 1
       "SetChkSkipEmptyKeys"="REG_DWORD", 1
       "SetEnableSound"="REG_DWORD", 1
       "StartMinimized"="REG_DWORD", 0
       "StartScan"="REG_DWORD", 0
       "StartWhenWinBoots"="REG_DWORD", 1
       "StrLastOptimizeTime"="REG_SZ", ""
       "StrLastScan"="REG_SZ", "Mon. January 09, 2017. 08:14 AM"
       "StrLastScanResults"="REG_SZ", "19"
       "StrLastStartupOpt"="REG_SZ", ""
       "StrLatestRegDefrag"="REG_SZ", ""
       "StrLatestRestorePoint"="REG_SZ", ""
       "TrialType"="REG_DWORD", 0
    [HKEY_CURRENT_USER\Software\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\LANG]
       "LangCode"="REG_SZ", "en"
       "LangID"="REG_DWORD", 0
    [HKEY_CURRENT_USER\Software\Jawego\Params]
       "REGTUGuid"="REG_SZ", "7200c83b-a5d5-400a-b1b7-be1cb3cba95c"
    [HKEY_CURRENT_USER\Software\Reg\Tuneup\key\6]
       "(Default)"="REG_BINARY, .......................................................................................................................o............................................................................................................................H...........

Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/9/17
Scan Time: 8:26 AM
Logfile: mbamRegTuneup.txt
Administrator: Yes

-Software Information-
Version: 3.0.5.1299
Components Version: 1.0.43
Update Package Version: 1.0.955
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {Computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 354615
Time Elapsed: 7 min, 7 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 1
PUP.Optional.Jawego, C:\PROGRAM FILES (X86)\7200C83B-A5D5-400A-B1B7-BE1CB3CBA95C\REGTUNEUP.EXE, Quarantined, [2343], [351347],1.0.955

Module: 3
PUP.Optional.Jawego, C:\PROGRAM FILES (X86)\7200C83B-A5D5-400A-B1B7-BE1CB3CBA95C\REGTUNEUP.EXE, Quarantined, [2343], [351347],1.0.955
PUP.Optional.Jawego, C:\PROGRAM FILES (X86)\7200C83B-A5D5-400A-B1B7-BE1CB3CBA95C\ISXDL.DLL, Quarantined, [2343], [351347],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\xmllite.dll, Quarantined, [2343], [358615],1.0.955

Registry Key: 8
PUP.Optional.Jawego, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Reg Tuneup_is1, Delete-on-Reboot, [2343], [351347],1.0.955
PUP.Optional.Jawego, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Reg Tuneup, Delete-on-Reboot, [2343], [358619],1.0.955
PUP.Optional.Jawego, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Reg Tuneup_DEFAULT, Delete-on-Reboot, [2343], [358619],1.0.955
PUP.Optional.Jawego, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Reg Tuneup_UPDATES, Delete-on-Reboot, [2343], [358619],1.0.955
PUP.Optional.Jawego, HKCU\SOFTWARE\Jawego, Delete-on-Reboot, [2343], [351909],1.0.955
PUP.Optional.Jawego, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{41DA5632-B982-4C35-9C9A-779EEB10A4DF}, Delete-on-Reboot, [2343], [358620],1.0.955
PUP.Optional.Jawego, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{4A7A53FF-5734-420B-B100-3166F7EA2E75}, Delete-on-Reboot, [2343], [358620],1.0.955
PUP.Optional.Jawego, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{5C6F7F48-8E0A-487B-96E4-3ACEF1EDCC52}, Delete-on-Reboot, [2343], [358620],1.0.955

Registry Value: 3
PUP.Optional.Jawego, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{41DA5632-B982-4C35-9C9A-779EEB10A4DF}|PATH, Delete-on-Reboot, [2343], [358620],1.0.955
PUP.Optional.Jawego, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{4A7A53FF-5734-420B-B100-3166F7EA2E75}|PATH, Delete-on-Reboot, [2343], [358620],1.0.955
PUP.Optional.Jawego, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{5C6F7F48-8E0A-487B-96E4-3ACEF1EDCC52}|PATH, Delete-on-Reboot, [2343], [358620],1.0.955

Data Stream: 0
(No malicious items detected)

Folder: 2
PUP.Optional.Jawego, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\REG TUNEUP, Delete-on-Reboot, [2343], [358616],1.0.955
PUP.Optional.Jawego, C:\PROGRAM FILES (X86)\7200C83B-A5D5-400A-B1B7-BE1CB3CBA95C, Delete-on-Reboot, [2343], [358615],1.0.955

File: 58
PUP.Optional.Jawego, C:\PROGRAM FILES (X86)\7200C83B-A5D5-400A-B1B7-BE1CB3CBA95C\REGTUNEUP.EXE, Delete-on-Reboot, [2343], [351347],1.0.955
PUP.Optional.Jawego, C:\PROGRAM FILES (X86)\7200C83B-A5D5-400A-B1B7-BE1CB3CBA95C\ISXDL.DLL, Delete-on-Reboot, [2343], [351347],1.0.955
PUP.Optional.Jawego, C:\USERS\{Username}\DESKTOP\REGTUSETUP_SITE.EXE, Delete-on-Reboot, [2343], [358621],1.0.955
PUP.Optional.Jawego, C:\USERS\PUBLIC\DESKTOP\REG TUNEUP.LNK, Delete-on-Reboot, [2343], [358614],1.0.955
PUP.Optional.Jawego, C:\PROGRAM FILES (X86)\7200C83B-A5D5-400A-B1B7-BE1CB3CBA95C\REGTUUNS.EXE, Delete-on-Reboot, [2343], [351347],1.0.955
PUP.Optional.Jawego, C:\PROGRAM FILES (X86)\7200C83B-A5D5-400A-B1B7-BE1CB3CBA95C\UNINS000.EXE, Delete-on-Reboot, [2343], [351347],1.0.955
PUP.Optional.Jawego, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reg Tuneup\Reg Tuneup.lnk, Delete-on-Reboot, [2343], [358616],1.0.955
PUP.Optional.Jawego, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reg Tuneup\Register Reg Tuneup.lnk, Delete-on-Reboot, [2343], [358616],1.0.955
PUP.Optional.Jawego, C:\WINDOWS\TASKS\REG TUNEUP_DEFAULT.JOB, Delete-on-Reboot, [2343], [358617],1.0.955
PUP.Optional.Jawego, C:\WINDOWS\SYSTEM32\TASKS\REG TUNEUP_DEFAULT, Delete-on-Reboot, [2343], [358618],1.0.955
PUP.Optional.Jawego, C:\WINDOWS\TASKS\REG TUNEUP_UPDATES.JOB, Delete-on-Reboot, [2343], [358617],1.0.955
PUP.Optional.Jawego, C:\WINDOWS\SYSTEM32\TASKS\REG TUNEUP_UPDATES, Delete-on-Reboot, [2343], [358618],1.0.955
PUP.Optional.Jawego, C:\WINDOWS\SYSTEM32\TASKS\REG TUNEUP, Delete-on-Reboot, [2343], [358618],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Chinese_regtu.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Chinese_uninst.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Danish_regtu.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Danish_uninst.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Dutch_regtu.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Dutch_uninst.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\eng_regtu.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\eng_uninst.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\FileList.regtu, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Japanese_uninst.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\korean_regtu_ko.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\korean_uninst_ko.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Norwegian_regtu.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Norwegian_uninst.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\polish_regtu_pl.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\polish_uninst_pl.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\portugese_regtu_pt.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\portugese_uninst_pt.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Portuguese_regtu.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Portuguese_uninst.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Finnish_regtu_fi.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Finnish_uninst_fi.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\French_regtu.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\French_uninst.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\German_regtu.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\German_uninst.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\greek_regtu_el.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\greek_uninst_el.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Italian_regtu.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Italian_uninst.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\russian_regtu_ru.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\russian_uninst_ru.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Spanish_regtu.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\spanish_uninst.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Swedish_regtu.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\swedish_uninst.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\TraditionalCn_regtu_zh-tw.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\traditionalcn_uninst_zh-tw.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\turkish_regtu_tr.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Turkish_uninst_tr.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\unins000.dat, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\unins000.msg, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\xmllite.dll, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\Japanese_regtu.ini, Delete-on-Reboot, [2343], [358615],1.0.955
PUP.Optional.Jawego, C:\Program Files (x86)\7200c83b-a5d5-400a-b1b7-be1cb3cba95c\RegList.regtu, Delete-on-Reboot, [2343], [358615],1.0.955

Physical Sector: 0
(No malicious items detected)


(end)9:10 9-1-2017

As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
• Malware Execution Prevention

Save yourself the hassle and get protected.