Hack Forums
[MRT-X Academy] Malwarebytes AdwCleaner Tutorial - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [MRT-X Academy] Malwarebytes AdwCleaner Tutorial (/showthread.php?tid=6292278)

[MRT-X Academy] Malwarebytes AdwCleaner Tutorial - Tha Sneak - Feb 14, 2025

[Image: Ao15uxN.gif]


Malwarebytes AdwCleaner is a powerful tool for removing adware and junkware. Originally named Junkware Removal Tool until it was bought by Malwarebytes.

When instructing the user to use Malwarebytes AdwCleaner use the canned speeches located here: https://hackforums.net/showthread.php?tid=6292354

I have provided pictures to be used for instructions they also contain instructions on them.

- Have them download and save the program to their desktop.
- When they open it all they have to do is click Scan Now and it will begin to scan.
- To display or save a log file have them click on 'Log Files'. Then, check the log wished to open and double click on it to open it in notepad.
- Instruct them to either copy and paste the log in a reply or post it to a Pastebin style site.

[Image: Begin-Scan.png]

[Image: Retrieving-Log-File.png]

[Image: Screenshot-2025-02-15-112202.png]


[Image: h9AAT39.gif]


📌 Malwarebytes AdwCleaner - Full Tutorial 📌

Malwarebytes AdwCleaner is a specialized tool designed to remove adware, browser hijackers, toolbars, and potentially unwanted programs (PUPs) from your system. Follow the steps below to use it effectively.

[Image: h9AAT39.gif]


🔹 Step 1: Download AdwCleaner
  • Download Malwarebytes AdwCleaner from the official website:
    - Download AdwCleaner

  • Save the file to your Desktop for easy access.

  • No installation is required, as AdwCleaner is a portable application.



[Image: h9AAT39.gif]


🔹 Step 2: Run AdwCleaner
  • Close all open programs to prevent interference.

  • Double-click AdwCleaner.exe to launch the tool.

  • If prompted by User Account Control (UAC), click Yes.

  • The main AdwCleaner interface will appear.



[Image: h9AAT39.gif]


🔹 Step 3: Scan Your System
  • Click on Scan Now to start scanning for adware and potentially unwanted programs.

  • The scan will take a few minutes to complete.

  • Once finished, AdwCleaner will display a list of detected threats.



[Image: h9AAT39.gif]


🔹 Step 4: Quarantine & Remove Detected Items
  • Review the detected items.

  • Click Quarantine to move threats to a secure location.

  • You may be prompted to restart your computer to complete the removal process.

  • Click Restart Now if required.



[Image: h9AAT39.gif]


🔹 Step 5: Review the Scan Log
  • After restarting, reopen AdwCleaner.

  • Click on Log Files to view the scan report.

  • Upload the scan log to one of the following services:
    - Pastebin
    - Mozilla Pastebin

  • Set the log to Never Expire and share the link if further analysis is needed.



[Image: h9AAT39.gif]


✅ What Does AdwCleaner Remove?
AdwCleaner targets:
  • Adware (unwanted ads and pop-ups)

  • Browser hijackers (search engine and homepage redirects)

  • Unwanted toolbars and extensions

  • Potentially unwanted programs (PUPs)

  • Registry modifications made by adware



[Image: h9AAT39.gif]


Malwarebytes AdwCleaner Log Breakdown

Header Section (General Information)
  • Software Version: 8.4.2.0 (AdwCleaner version used)

  • Build Date: 03-04-2024 (software compiled on March 4, 2024)

  • Database Version: 2024-10-23.4 (Cloud) (latest malware/adware definitions)

  • Support Link: Malwarebytes Support



[Image: h9AAT39.gif]


Scan Information
  • Mode: Scan (only scanning, no cleaning performed)

  • Start Time: 02-14-2025 (scan was run on February 14, 2025)

  • Duration: 00:00:21 (scan took 21 seconds)

  • Operating System: Windows 11 (Build 22631.4751)

  • Objects Scanned: 32,109

  • Threats Detected: 12



[Image: h9AAT39.gif]


Scan Results

Services:
No malicious services found.

Folders:
No malicious folders found.

Files:
No malicious files found.

DLLs (Dynamic Link Libraries):
No malicious DLLs found.

WMI (Windows Management Instrumentation):
No malicious WMI found.

Shortcuts:
No malicious shortcuts found.

Tasks (Scheduled Tasks):
No malicious tasks found.

Registry:
No malicious registry entries found.

Chromium-based Browsers:
No malicious Chromium entries found.

Chromium URLs:
No malicious Chromium URLs found.

Firefox-based Browsers:
No malicious Firefox entries found.

Firefox URLs:
No malicious Firefox URLs found.

Hosts File Entries:
No malicious hosts file entries found.

RE: [MRT-X Academy] Malwarebytes Anti-Malware, Anti-Rootkit, and AdwCleaner - Tha Sneak - Feb 18, 2025

[Image: h9AAT39.gif]


Preinstalled Software Detected

The following preinstalled software was flagged as potentially unnecessary but is not malware.

Dell SupportAssistAgent
  • Folder: C:\Program Files\DELL\SAREMEDIATION\AGENT

  • Folder: C:\Program Files\DELL\SAREMEDIATION\AUDIT

  • Folder: C:\Program Files\DELL\SAREMEDIATION\PLUGIN

  • Folder: C:\Program Files\DELL\SUPPORTASSISTAGENT

  • Folder: C:\ProgramData\DELL\SAREMEDIATION\PLUGIN

  • Folder: C:\ProgramData\DELL\SUPPORTASSIST

  • Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FF4DE1AE-AF1F-4332-BB33-225C483B2A14}

  • Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FF4DE1AE-AF1F-4332-BB33-225C483B2A14}

  • Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Dell SupportAssistAgent AutoUpdate

  • Task: C:\Windows\System32\Tasks\DELL SUPPORTASSISTAGENT AUTOUPDATE



Dell Update for Windows 10
  • Folder: C:\Program Files (x86)\DELL\UPDATESERVICE

  • Folder: C:\ProgramData\DELL\UPDATESERVICE



[Image: h9AAT39.gif]


Summary & Recommendations

Key Findings:
  • No malware, adware, or browser hijackers were found.

  • The scan flagged 12 preinstalled Dell software components, which are not necessarily harmful but may be unnecessary.



Recommendations:
  • If you don't use Dell SupportAssistAgent or Dell Update, you may choose to remove them using AdwCleaner’s "Clean" function.

  • If you want to keep them, you can add them to the exclusions list in AdwCleaner.

  • No further action is required since no malicious threats were detected.



EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt

[Image: h9AAT39.gif]


Malwarebytes AdwCleaner Pictures:

[Image: 1.png]

[Image: 2.png]

[Image: 3.png]

[Image: 4.png]

[Image: 5.png]

[Image: 6.png]


RE: [MRT-X Academy] Malwarebytes AdwCleaner Tutorial - Tha Sneak - Feb 22, 2025

[Image: 7.png]

[Image: 8.png]

[Image: 9.png]

[Image: 10.png]

[Image: 11.png]

[Image: 12.png]


[Image: h9AAT39.gif]


Clean Malwarebytes AdwCleaner Log File:

# -------------------------------
# Malwarebytes AdwCleaner 8.4.2.0
# -------------------------------
# Build: 03-04-2024
# Database: 2024-10-23.4 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start: 02-19-2025
# Duration: 00:00:11
# OS: Windows 10 (Build 19045.2965)
# Scanned: 32106
# Detected: 0

*** [ Services ] ***

No malicious services found.
*** [ Folders ] ***

No malicious folders found.
*** [ Files ] ***

No malicious files found.
*** [ DLL ] ***

No malicious DLLs found.
*** [ WMI ] ***

No malicious WMI found.
*** [ Shortcuts ] ***

No malicious shortcuts found.
*** [ Tasks ] ***

No malicious tasks found.
*** [ Registry ] ***

No malicious registry entries found.
*** [ Chromium (and derivatives) ] ***

No malicious Chromium entries found.
*** [ Chromium URLs ] ***

No malicious Chromium URLs found.
*** [ Firefox (and derivatives) ] ***

No malicious Firefox entries found.
*** [ Firefox URLs ] ***

No malicious Firefox URLs found.
*** [ Hosts File Entries ] ***

No malicious hosts file entries found.
*** [ Preinstalled Software ] ***

No Preinstalled Software found.



########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

[Image: h9AAT39.gif]


Infected Log File:

# -------------------------------
# Malwarebytes AdwCleaner 8.4.2.0
# -------------------------------
# Build: 03-04-2024
# Database: 2024-10-23.4 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 03-02-2025
# Duration: 00:00:04
# OS: Windows 7 Service Pack 1
# Cleaned: 12
# Failed: 0

*** [ Services ] ***

No malicious services cleaned.
*** [ Folders ] ***

No malicious folders cleaned.
*** [ Files ] ***

No malicious files cleaned.
*** [ DLL ] ***

No malicious DLLs cleaned.
*** [ WMI ] ***

No malicious WMI cleaned.
*** [ Shortcuts ] ***

No malicious shortcuts cleaned.
*** [ Tasks ] ***

No malicious tasks cleaned.
*** [ Registry ] ***

Deleted HKCU\SOFTWARE\1DFfcratxAYBy9SnFPeNyxcELHDn1uS1X6
Deleted HKCU\SOFTWARE\1DFfcratxAYBy9SnFPeNyxcELHDn1uS1X6
Deleted HKCU\SOFTWARE\55f14a8db5ea6dd90881e2cf6f95dea7d6195640
Deleted HKCU\SOFTWARE\6b7932228d40fdceadadc51b9e9645e479427ad8
Deleted HKCU\SOFTWARE\7b6cefcaf4ae58382e4de6eb6b098a989cea476c
Deleted HKCU\SOFTWARE\c303b85b8b30dd313bd29e0978d843c8874f573f
Deleted HKCU\SOFTWARE\c96997237ff7daefaef9d98bbf847cb3ccb0562c
Deleted HKCU\SOFTWARE\ec723f1e330cc4fab2864af614610985eb3f99aa
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Run|IEXPLORE
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Run|System
Deleted HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell
Deleted HKLM\Software\Microsoft\Windows\CurrentVersion\Run|IEXPLORE
*** [ Chromium (and derivatives) ] ***

No malicious Chromium entries cleaned.
*** [ Chromium URLs ] ***

No malicious Chromium URLs cleaned.
*** [ Firefox (and derivatives) ] ***

No malicious Firefox entries cleaned.
*** [ Firefox URLs ] ***

No malicious Firefox URLs cleaned.
*** [ Hosts File Entries ] ***

No malicious hosts file entries cleaned.
*** [ Preinstalled Software ] ***

No Preinstalled Software cleaned.

***********************

[+] Delete Tracing Keys
[+] Reset Winsock
***********************

AdwCleaner[S00].txt - [2449 octets] - [02/03/2025 15:15:42]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

RE: [MRT-X Academy] Malwarebytes AdwCleaner Tutorial - Tha Sneak - Mar 1, 2025

Please do NOT reply to this thread in case information needs to be added or edited.

If you have a questions about the contents of the thread or other tutorials please go to this thread and post your question in this thread: https://hackforums.net/showthread.php?tid=6293473

Thanks,

Tha Sneak