Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for RegProtech

- - - - -
Started by Metallica , Apr 30 2018 01:16 AM
1-800-291-7856

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 30 April 2018 - 01:16 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is RegProtech?

The Malwarebytes research team has determined that RegProtech is a "system optimizer". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.

How do I know if I am infected with RegProtech?

This is how the main screen of the system optimizer looks:

main.png

You will find these icons in your taskbar, your startmenu, and on your desktop:

icons.png

and see this warning during install:

warning1.png

and this screens when you try to fix the "problems":

warning5.png

You may see this entry in your list of installed programs:

warning4.png

and this task in your list of Scheduled Tasks:

warning3.png

How did RegProtech get on my computer?

These so-called system optimizers use different methods of getting installed. This particular one was downloaded from their website:

website.png

How do I remove RegProtech?

Our program Malwarebytes can detect and remove this potentially unwanted application.
  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of RegProtech?
  • No, Malwarebytes removes RegProtech completely.
  • This PUP creates some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks.
How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this system optimizer.

As you can see below the full version of Malwarebytes would have protected you against the RegProtech installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png


and we block access to their domain:

protection2.png


Technical details for experts

You may see these entries in FRST logs:

 (RegProtech) C:\Program Files (x86)\iHaveAnswer LLC\RegProtech\RegProtech.exe
 C:\Users\{username}\AppData\Roaming\regcl.dll
 C:\Windows\System32\Tasks\RegProtech_Daily
 C:\Users\Public\Desktop\RegProtech.lnk
 C:\Users\{username}\AppData\Roaming\RegProtech
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iHaveAnswer LLC
 C:\Program Files (x86)\iHaveAnswer LLC
 (iHaveAnswer LLC) C:\Users\{username}\Downloads\regprotech-setup.exe

RegProtech (HKLM-x32\...\{6E64E0B7-9E40-4D0C-BF43-332BDE875C3E}) (Version: 1.0.0.0 - iHaveAnswer LLC)
Task: {C9A2B808-E1E4-4641-AB92-DB7452BB5FB3} - System32\Tasks\RegProtech_Daily => C:\Program Files (x86)\iHaveAnswer LLC\RegProtech\RegProtech.exe [2017-04-12] (RegProtech)
Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\iHaveAnswer LLC\RegProtech
       Adds the file HtmlAgilityPack.dll"="4/12/2017 1:59 PM, 138640 bytes, A
       Adds the file Microsoft.Win32.TaskScheduler.dll"="4/12/2017 1:59 PM, 174992 bytes, A
       Adds the file MySql.Data.dll"="4/12/2017 1:59 PM, 448912 bytes, A
       Adds the file RegProtech.exe"="4/12/2017 1:59 PM, 1384848 bytes, A
       Adds the file RegProtech.exe.config"="3/17/2017 12:28 AM, 452 bytes, A
       Adds the file RegProtech.pdb"="4/12/2017 12:00 PM, 589312 bytes, A
       Adds the file RegProtech.vshost.exe"="4/12/2017 1:59 PM, 11664 bytes, A
       Adds the file RegProtech.vshost.exe.config"="3/17/2017 12:28 AM, 452 bytes, A
       Adds the file RegProtech.vshost.exe.manifest"="4/1/2017 1:35 AM, 1559 bytes, A
       Adds the file SharpUpdate.dll"="4/12/2017 1:59 PM, 31632 bytes, A
       Adds the file SharpUpdate.pdb"="4/12/2017 12:00 PM, 38400 bytes, A
       Adds the file System.Data.SQLite.dll"="4/12/2017 1:59 PM, 983440 bytes, A
       Adds the file Uninstall.exe"="4/12/2017 1:59 PM, 197520 bytes, A
       Adds the file Uninstall.exe.config"="7/12/2014 2:45 PM, 245 bytes, A
       Adds the file Uninstall.pdb"="3/10/2017 10:33 PM, 26112 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iHaveAnswer LLC\RegProtech
       Adds the file RegProtech.lnk"="4/30/2018 8:33 AM, 2783 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\Downloaded Installations\{4C6156A3-0B19-4F93-BFEA-D5F65E01ADFC}
       Adds the file RegProtech.msi"="4/30/2018 8:32 AM, 3103232 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming
       Adds the file regcl.dll"="4/30/2018 8:35 AM, 152 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\RegProtech\BackupStartup
    In the existing folder C:\Users\Public\Desktop
       Adds the file RegProtech.lnk"="4/30/2018 8:33 AM, 2765 bytes, A
    In the existing folder C:\Windows\Installer
       Adds the file 218e38.msi"="4/30/2018 8:32 AM, 3103232 bytes, A
       Adds the file SourceHash{6E64E0B7-9E40-4D0C-BF43-332BDE875C3E}"="4/30/2018 8:33 AM, 20480 bytes, A
    Adds the folder C:\Windows\Installer\{6E64E0B7-9E40-4D0C-BF43-332BDE875C3E}
       Adds the file ARPPRODUCTICON.exe"="4/30/2018 8:33 AM, 56472 bytes, RA
       Adds the file RegProtech.exe_23DE3EC60E11414B8743704A43DC2E5A.exe"="4/30/2018 8:33 AM, 56472 bytes, RA
       Adds the file RegProtech.exe1_B8936C0A3FA9499F94C85804D217A0A1.exe"="4/30/2018 8:33 AM, 56472 bytes, RA
    In the existing folder C:\Windows\System32\Tasks
       Adds the file RegProtech_Daily"="4/30/2018 8:33 AM, 4016 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6E64E0B7-9E40-4D0C-BF43-332BDE875C3E}]
       "AuthorizedCDFPrefix"="REG_SZ", ""
       "Comments"="REG_SZ", ""
       "Contact"="REG_SZ", ""
       "DisplayName"="REG_SZ", "RegProtech"
       "DisplayVersion"="REG_SZ", "1.0.0.0"
       "EstimatedSize"="REG_DWORD", 3956
       "HelpLink"="REG_SZ", ""
       "HelpTelephone"="REG_SZ", ""
       "InstallDate"="REG_SZ", "20180430"
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\iHaveAnswer LLC\RegProtech\"
       "InstallSource"="REG_SZ", "C:\Users\{username}\AppData\Local\Downloaded Installations\{4C6156A3-0B19-4F93-BFEA-D5F65E01ADFC}\"
       "Language"="REG_DWORD", 1033
       "ModifyPath"="REG_EXPAND_SZ, "MsiExec.exe /I{6E64E0B7-9E40-4D0C-BF43-332BDE875C3E}"
       "Publisher"="REG_SZ", "iHaveAnswer LLC"
       "Readme"="REG_SZ", ""
       "Size"="REG_SZ", ""
       "UninstallString"="REG_EXPAND_SZ, "MsiExec.exe /I{6E64E0B7-9E40-4D0C-BF43-332BDE875C3E}"
       "URLInfoAbout"="REG_SZ", "http://www.ihaveanswer.com"
       "URLUpdateInfo"="REG_SZ", ""
       "Version"="REG_DWORD", 16777216
       "VersionMajor"="REG_DWORD", 1
       "VersionMinor"="REG_DWORD", 0
       "WindowsInstaller"="REG_DWORD", 1
Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 4/30/18
Scan Time: 8:47 AM
Log File: 5e24d96d-4c42-11e8-83b0-080027235d76.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.4920
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 247030
Threats Detected: 22
Threats Quarantined: 22
Time Elapsed: 3 min, 37 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 1
PUP.Optional.RegProTech.TskLnk, C:\PROGRAM FILES (X86)\iHaveAnswer LLC\REGPROTECH\RegProtech.exe, Quarantined, [5443], [515304],1.0.4920

Module: 1
PUP.Optional.RegProTech.TskLnk, C:\PROGRAM FILES (X86)\iHaveAnswer LLC\REGPROTECH\RegProtech.exe, Quarantined, [5443], [515304],1.0.4920

Registry Key: 9
PUP.Optional.RegProTech.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\RegProtech_Daily, Quarantined, [5443], [515304],1.0.4920
PUP.Optional.RegProTech.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C9A2B808-E1E4-4641-AB92-DB7452BB5FB3}, Quarantined, [5443], [515304],1.0.4920
PUP.Optional.RegProTech.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\PLAIN\{C9A2B808-E1E4-4641-AB92-DB7452BB5FB3}, Quarantined, [5443], [515304],1.0.4920
PUP.Optional.RegProTech.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegProtech_Daily, Quarantined, [5443], [-1],0.0.0
PUP.Optional.RegProTech.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C9A2B808-E1E4-4641-AB92-DB7452BB5FB3}, Quarantined, [5443], [-1],0.0.0
PUP.Optional.RegProTech.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C9A2B808-E1E4-4641-AB92-DB7452BB5FB3}, Quarantined, [5443], [-1],0.0.0
PUP.Optional.RegProTech.TskLnk, HKLM\SOFTWARE\MICROSOFT\TRACING\RegProtech_RASAPI32, Quarantined, [5443], [515303],1.0.4920
PUP.Optional.RegProTech.TskLnk, HKLM\SOFTWARE\MICROSOFT\TRACING\RegProtech_RASMANCS, Quarantined, [5443], [515303],1.0.4920
PUP.Optional.RegProTech.TskLnk, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{6E64E0B7-9E40-4D0C-BF43-332BDE875C3E}, Quarantined, [5443], [515305],1.0.4920

Registry Value: 1
PUP.Optional.RegProTech.TskLnk, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{6E64E0B7-9E40-4D0C-BF43-332BDE875C3E}|DISPLAYNAME, Quarantined, [5443], [515305],1.0.4920

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 1
PUP.Optional.RegProTech, C:\USERS\{username}\APPDATA\LOCAL\DOWNLOADED INSTALLATIONS\{4C6156A3-0B19-4F93-BFEA-D5F65E01ADFC}, Quarantined, [3049], [515298],1.0.4920

File: 9
PUP.Optional.RegProTech, C:\USERS\PUBLIC\DESKTOP\REGPROTECH.LNK, Quarantined, [3049], [515301],1.0.4920
PUP.Optional.RegProTech, C:\USERS\{username}\APPDATA\LOCAL\DOWNLOADED INSTALLATIONS\{4C6156A3-0B19-4F93-BFEA-D5F65E01ADFC}\RegProtech.msi, Quarantined, [3049], [515298],1.0.4920
PUP.Optional.RegProTech.TskLnk, C:\WINDOWS\SYSTEM32\TASKS\RegProtech_Daily, Quarantined, [5443], [515304],1.0.4920
PUP.Optional.RegProTech.TskLnk, C:\PROGRAM FILES (X86)\iHaveAnswer LLC\REGPROTECH\RegProtech.exe, Quarantined, [5443], [515304],1.0.4920
PUP.Optional.RegProTech.TskLnk, C:\WINDOWS\SYSTEM32\TASKS\RegProtech_Daily, Quarantined, [5443], [-1],0.0.0
PUP.Optional.RegProTech, C:\USERS\{username}\APPDATA\ROAMING\REGCL.DLL, Quarantined, [3049], [515300],1.0.4920
PUP.Optional.RegProTech, C:\USERS\{username}\DESKTOP\REGPROTECH-SETUP.EXE, Quarantined, [3049], [515306],1.0.4920
PUP.Optional.RegProTech, C:\USERS\{username}\DOWNLOADS\REGPROTECH-SETUP.EXE, Quarantined, [3049], [515306],1.0.4920
PUP.Optional.RegProTech, C:\WINDOWS\INSTALLER\218E38.MSI, Quarantined, [3049], [515306],1.0.4920

Physical Sector: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.