AdwCleaner FP in the news

[DonnaB]

Heads up!

AdwCleaner is detecting the following during an initial scan:

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software

User must click on the Registry tab and uncheck to prevent deletion of that key.

On some systems, AdwCleaner is falsely deleting this key, on other systems the deletion is successful.

[LilBambi]

The simplest way to fix this is to go get the latest version:

http://www.bleepingcomputer.com/download/adwcleaner/

or from the developer Website:

https://toolslib.net/downloads/viewdownload/1-adwcleaner/

On 5-18-2014 (v3.209 - 18/05/14) the false positive was removed as noted in the following link to the changelog:

http://general-changelog-team.fr/~xplode/Changelogs/CG_AdwCleaner_EN.txt

==========================================
|                                                                            |
| AdwCleaner - Adware / Toolbar / PUP Removal Tool     |
|                                 |
| Code : Xplode                           |
| Logo & Icons by Da GuRu  (trojaner-board.de)            |

--snip---

//////// v3.211 - 26/05/14  ////////

- Database update

//////// v3.210 - 19/05/14  ////////

- False positive removed

//////// v3.209 - 18/05/14  ////////

[Corrine]

It has been reported that the false detection of that registry key will be corrected in the next update of AdwCleaner. 

[DonnaB]

Yes, Nasdaq had pointed out that the FP would be corrected in the next update here. I am assuming that the latest update is version 3.211 from the 26th of May, '14. This morning I had an OP download AdwCleaner and key was still found.

If you read the post at BC, you'll see that that OP said that when he re-scanned after clicking "Clean" and rescanned the file was still there. Though I  updated my version and ran a scan. The key was detected. I exported that key to my desktop and clicked "Clean". navigated to the key in the registry and it gone. Clicked on the .reg export from my desktop and merged the key back into my registry.

I don't think it is fixed yet. Evidence > See here:

OP scanned and posted log in post #3 ~ key found
Had OP rescan and uncheck key found under Registry tab in post #5 ~ Key not deleted
Had OP rescan and post fresh log ~ Key still found and is where it is supposed to be in post #6

[LilBambi]

Wait, Corrine's right. Nasdaq's post was yesterday, so looks like maybe he didn't get that FP yet.

[Corrine]

I meant to update this topic after the update:

//////// v3.212 - 05/06/14  ////////

- Database update
- False positive removed

[LilBambi]

Excellent! Thanks!

[Corrine]

It has been decided to discontinue posting AdwCleaner Updates (See AdwCleaner Updates).  In the event there is an issue with AdwCleaner that needs to be discussed, that is, of course, fine.  Generally, however, AdwCleaner is used during malware cleanup.  Unless you are knowledgeable about the files shown for removal, it is best to ask for assistance.

[LilBambi]

Definitely! Thanks Corrine!