AdGuard Uninstall - Attempting to create garbage files?

Asudem

New Member
Greetings,

I used AdGuard for about a day and determined that it did not meet my ad blocking needs. However, I saw that the uninstaller of the program was hanging at 99% for a very long time. I wanted to see what the program was doing so I logged all the changes setup.exe was making and found that the program was attempting to create many items during the uninstall process. Like, a LOT of files. Here are a few examples.

Code:
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\AOLTECH\MODEMS.SIM
C:\ProgramData\Handbuch\AVK InternetSecurity 2006.pdf
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\program files\Aspyr\Wakeboarding Unleashed\Start.exe
C:\ProgramData\Package Cache\ArmedAndDangerous.exe
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\program files\Microsoft BizTalk Server\Setup\BTSsetupDB.exe
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\Setup\Dino\HD\Dino.exe
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\Hallmark Card Studio 2005\Program Files\Sierra\Hallmark Card Studio 2005\Hallmark Card Studio.exe
C:\ProgramData\Package Cache\What's_New_in_HomeSite_45\WhatsNewHS45.exe
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\GUARDDOG\SETUP.EXE
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\Game\wws98.exe
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\Manual\Peachtree Office Accounting User's Guide.pdf
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\QuickBooks Letters\Employee Letters\Sick time.doc
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\Setup\Creating Keepsakes Scrapbook Designer.msi
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\Setup\PrintMaster 16.pdf
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\Oil Change\readme.txt
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\NRC\WINDOWS\INSTALL\EN\MAKEDISK.EXE
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\3rdPartyApp\GoogleToolBar\GoogleToolbarInstaller_zh-TW.exe
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\setup\hpphotosmartessential\HPPhotosmartEssential.cab
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\TurboTax 2008\TurboTax 2008 Installer.exe
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\Pack\CSI4_Optional_Install\CSI4_Movies_B\CSI4_Intro.bik
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\Min\Asteroids.exe
C:\ProgramData\Package Cache\{393a29d6-8f64-490d-8d6b-5e63801a44da}\Setup\win_vista\KT_WCM_KWD_U1300_200107038_VISTA.exe
I have attached the PML file for reference.

EDIT: It appears this may be related?
 

Attachments

Last edited by a moderator:

avatar

Administrator
Staff member
Administrator
Hi!

Adguard uses "Windows Installer" for both install and uninstall.

According to the PML file, it was scanning packages cache, that's why you see lots of files being accessed.

One thing that could be misleading in that PML: "CreateFile" operation is not for creating files.
Look at "Detail" column:
Desired Access: Read Attributes
So it was not file creation, but reading file attributes.

https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx
Creates or opens a file or I/O device.
 
Top