Removal instructions for Device Doctor

Content is republished with permission from Malwarebytes.

What is Device Doctor?

Device Doctor is a system optimizer that triggers our PUP detection rules. By doing so we offer users a choice to consider whether they want to use this software. More information can be found on our Malwarebytes Labs blog.

How do I know if I am affected by Device Doctor?

This is how the main screen of the system optimizer looks:

You will find these icons in your taskbar, your startmenu, and on your desktop:

and see this type of windows during install:

and this type of screens during operations:

You may see this entry in your list of installed programs:

and this task in your list of Scheduled Tasks:

How did Device Doctor get on my computer?

These so-called system optimizers use different methods of getting installed. This particular one was downloaded from their website.

How do I remove Device Doctor?

Our program Malwarebytes can detect and remove this PUP, but it is recommended to use the built-in uninstaller first.

Please download Malwarebytes for Windows to your desktop.
Double-click MBSetup.exe and follow the prompts to install the program.
When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
Click on the Get started button.
Click Scan to start a Threat Scan.
When the scan is finished click Quarantine to remove the found threats.
Reboot the system if prompted to complete the removal process.

Is there anything else I need to do to get rid of Device Doctor?

No, Malwarebytes removes Device Doctor completely.
This PUP creates some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks.

What if I want to keep Device Doctor?

Should users wish to keep this program and exclude it from being detected in future scans, they can add the program to the exclusions list. Heres how to do it.

Open Malwarebytes for Windows.
Click the Detection History
Click the Allow List
To add an item to the Allow List, click Add.
Select the exclusion type Allow a file or folder and use the Select a folder button to select the main folder for the software that you wish to keep.
Repeat this for any secondary files or folder(s) that belong to the software.

If you want to allow the program to connect to the Internet, for example to fetch updates, also add an exclusion of the type Allow an application to connect to the internet and use the Browse button to select the file you wish to grant access.

How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you in dealing with this system optimizer.

As you can see below the full version of Malwarebytes would have warned you against the Device Doctor installer.

and we block access to their domain:

Technical details for experts

You may see these entries in FRST logs:

(AVANQUEST SOFTWARE SAS -> Device Doctor Software Inc.) C:\Program Files (x86)\Device Doctor\DDTray.exe
(AVANQUEST SOFTWARE SAS -> Device Doctor Software Inc.) C:\Program Files (x86)\Device Doctor\DeviceDoctor.exe
Task: {AE6CD8A6-2FC2-4027-8D82-98C16652FD3C} - System32\Tasks\Device Doctor automatic scan and new device notifications => C:\Program Files (x86)\Device Doctor\DDTray.exe [3309896 2020-10-20] (AVANQUEST SOFTWARE SAS -> Device Doctor Software Inc.)
C:\Users\{username}\AppData\Roaming\Device Doctor
C:\Windows\system32\Tasks\Device Doctor automatic scan and new device notifications
C:\Users\Public\Desktop\Device Doctor.lnk
C:\ProgramData\Desktop\Device Doctor.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Device Doctor
C:\Program Files (x86)\Device Doctor
(Device Doctor Software Inc. ) C:\Users\{username}\Downloads\DeviceDoctor_Bundle.exe

Device Doctor v5.2.473 (HKLM-x32\...\Device Doctor_is1) (Version: 5.2.473 - Device Doctor Software Inc.)

Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Program Files (x86)\Device Doctor
       Adds the file 7z.dll"="3/22/2018 7:06 PM, 1024000 bytes, A
       Adds the file DDSchedule.exe"="10/20/2020 3:51 PM, 3638088 bytes, A
       Adds the file DDTray.exe"="10/20/2020 3:51 PM, 3309896 bytes, A
       Adds the file DeviceDoctor.chm"="4/10/2018 3:47 PM, 16084 bytes, A
       Adds the file DeviceDoctor.exe"="10/20/2020 3:51 PM, 8366408 bytes, A
       Adds the file English.ini"="10/10/2020 6:02 PM, 38633 bytes, A
       Adds the file HomePage.url"="1/7/2021 9:11 AM, 134 bytes, A
       Adds the file SList.db"="1/9/2016 5:04 PM, 1093632 bytes, A
       Adds the file SList.txt"="3/22/2017 4:21 PM, 79258 bytes, A
       Adds the file sqlite3.dll"="3/22/2018 7:06 PM, 656864 bytes, A
       Adds the file stub64.exe"="10/20/2020 3:51 PM, 1255752 bytes, A
       Adds the file unins000.dat"="1/7/2021 9:11 AM, 46401 bytes, A
       Adds the file unins000.exe"="1/7/2021 9:10 AM, 2558817 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Device Doctor
       Adds the file Device Doctor on the Web.lnk"="1/7/2021 9:11 AM, 1162 bytes, A
       Adds the file Device Doctor.lnk"="1/7/2021 9:11 AM, 1080 bytes, A
       Adds the file Help.lnk"="1/7/2021 9:11 AM, 1080 bytes, A
       Adds the file Uninstall Device Doctor.lnk"="1/7/2021 9:11 AM, 1060 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Device Doctor
       Adds the file 04074E7867D72A5F07BC16742DF4AFE77381C7A3.7z.pre"="1/7/2021 9:11 AM, 3633 bytes, A
       Adds the file 04074E7867D72A5F07BC16742DF4AFE77381C7A3.7z.status"="1/7/2021 9:11 AM, 38 bytes, A
       Adds the file Devices.ini"="1/7/2021 9:11 AM, 116871 bytes, A
       Adds the file DevicesPlus.ini"="1/7/2021 9:11 AM, 112035 bytes, A
       Adds the file Drivers_new.db"="1/7/2021 9:11 AM, 24110080 bytes, A
       Adds the file program.log"="1/7/2021 9:12 AM, 3542 bytes, A
       Adds the file Scan.ini"="1/7/2021 9:11 AM, 5143 bytes, A
       Adds the file settings.ini"="1/7/2021 9:11 AM, 34 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Device Doctor\Backup
    Adds the folder C:\Users\{username}\AppData\Roaming\Device Doctor\Cache
       Adds the file 006809FA0E088371EF9693B3AD3D41EA226DC1AC1_7_64.ini"="1/7/2021 9:11 AM, 231 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\Device Doctor\Log
    Adds the folder C:\Users\{username}\AppData\Roaming\Device Doctor\Undo
    In the existing folder C:\Users\Public\Desktop
       Adds the file Device Doctor.lnk"="1/7/2021 9:11 AM, 1062 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file Device Doctor automatic scan and new device notifications"="1/7/2021 9:11 AM, 3060 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Device Doctor_is1]
       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\Device Doctor\DeviceDoctor.exe,0"
       "DisplayName"="REG_SZ", "Device Doctor v5.2.473"
       "DisplayVersion"="REG_SZ", "5.2.473"
       "EstimatedSize"="REG_DWORD", 21498
       "HelpLink"="REG_SZ", "http://www.devicedoctor.com/"
       "Inno Setup: App Path"="REG_SZ", "C:\Program Files (x86)\Device Doctor"
       "Inno Setup: Deselected Tasks"="REG_SZ", ""
       "Inno Setup: Icon Group"="REG_SZ", "Device Doctor"
       "Inno Setup: Language"="REG_SZ", "en"
       "Inno Setup: Selected Tasks"="REG_SZ", "desktopicon"
       "Inno Setup: Setup Version"="REG_SZ", "6.0.3 (u)"
       "Inno Setup: User"="REG_SZ", "{username}"
       "InstallDate"="REG_SZ", "20210107"
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\Device Doctor\"
       "MajorVersion"="REG_DWORD", 5
       "MinorVersion"="REG_DWORD", 2
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "Device Doctor Software Inc."
       "QuietUninstallString"="REG_SZ", ""C:\Program Files (x86)\Device Doctor\unins000.exe" /SILENT"
       "UninstallString"="REG_SZ", ""C:\Program Files (x86)\Device Doctor\unins000.exe""
       "URLInfoAbout"="REG_SZ", "http://www.devicedoctor.com/"
       "URLUpdateInfo"="REG_SZ", "http://www.devicedoctor.com/"
       "VersionMajor"="REG_DWORD", 5
       "VersionMinor"="REG_DWORD", 2
    [HKEY_CURRENT_USER\Software\Device Doctor]
       "a7330f1905bae25449ee92f7acd1def1"="REG_SZ", "AVANQUEST SOFTWARE SAS"
       "AppStart"="REG_DWORD", 1
       "BackupDir"="REG_SZ", "C:\Users\{username}\AppData\Roaming\Device Doctor\Backup"
       "DatabaseDate"="REG_BINARY, ....
       "DelayedStart"="REG_DWORD", 0
       "InstallationDate"="REG_SZ", "01-07-2021"
       "InstallPath"="REG_SZ", "C:\Program Files (x86)\Device Doctor"
       "InstallStat"="REG_DWORD", 0
       "Language"="REG_DWORD", 1
       "LastNotificationTime"="REG_BINARY, ....
       "LastScan"="REG_BINARY, ....
       "nDownloads"="REG_DWORD", 3
       "NewAppNotifier"="REG_DWORD", 1
       "NewToolbarNotifier"="REG_DWORD", 1
       "OutdatedDrivers"="REG_DWORD", 5
       "OutdatedPackages"="REG_DWORD", 5
       "ProxyAddress"="REG_SZ", ""
       "ProxyLogin"="REG_SZ", ""
       "ProxyPassword"="REG_SZ", ""
       "ProxyPort"="REG_SZ", ""
       "ScanExecuted"="REG_DWORD", 1
       "SetupName"="REG_SZ", "C:\Users\{username}\Desktop\DeviceDoctor_Bundle.exe"
       "StartupNotifier"="REG_DWORD", 1
       "StartWithWindows"="REG_DWORD", 1
       "TotalDrivers"="REG_DWORD", 63
       "UseProxy"="REG_DWORD", 0

Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/7/21
Scan Time: 9:23 AM
Log File: 96f1da20-50c1-11eb-a2b8-080027235d76.json

-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1130
Update Package Version: 1.0.35361
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 232769
Threats Detected: 5
Threats Quarantined: 5
Time Elapsed: 2 min, 41 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 1
PUP.Optional.Avanquest, C:\PROGRAM FILES (X86)\DEVICE DOCTOR\DEVICEDOCTOR.EXE, Quarantined, 8364, 894039, , , , , C4BC8A28379AFF3D4CE7393C60C6889A, A2DD8062F390BA994267D7FFCA08704E931F17F526412E3EADAC0D77D3308F42

Module: 1
PUP.Optional.Avanquest, C:\PROGRAM FILES (X86)\DEVICE DOCTOR\DEVICEDOCTOR.EXE, Quarantined, 8364, 894039, , , , , C4BC8A28379AFF3D4CE7393C60C6889A, A2DD8062F390BA994267D7FFCA08704E931F17F526412E3EADAC0D77D3308F42

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 3
PUP.Optional.Avanquest, C:\DOCUMENTS AND SETTINGS\PUBLIC\Desktop\Device Doctor.lnk, Quarantined, 8364, 894039, , , , , BA2D5D4FE9210DF97E4A7F9F2A3B680F, 5F8D66D98E1CD27C9CD66B37FF03BE3D31A27D4C065436328B638FE06146876C
PUP.Optional.Avanquest, C:\PROGRAM FILES (X86)\DEVICE DOCTOR\DEVICEDOCTOR.EXE, Quarantined, 8364, 894039, 1.0.35361, , ame, , C4BC8A28379AFF3D4CE7393C60C6889A, A2DD8062F390BA994267D7FFCA08704E931F17F526412E3EADAC0D77D3308F42
PUP.Optional.Avanquest, C:\PROGRAM FILES (X86)\DEVICE DOCTOR\DDSCHEDULE.EXE, Quarantined, 8364, 894039, 1.0.35361, , ame, , F79A0732AC2C67F3BA1625D42A2EF61A, DFAE294E3FEE7B56A02E6004D756193520F570F654554E0E2824603519D3E71D

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):

Dynamically Blocks Malware Sites & Servers
Malware Execution Prevention

Save yourself the hassle and get protected.

#1
Metallica

Posted 07 January 2021 - 03:48 AM

Advertisements

Also tagged with one or more of these keywords: avanquest

Removal instructions for System Assistant

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us