Hello everyone. So I've done a few Reg Clean Pro removals in my time. It's usually pretty simple to just run a Revou tool and remove it that way or manually uninstall it. Well my dad has a friend whose computer got infected pretty bad. I've managed to kill the fix25 popups but Reg Clean pro is being a massive nuisance.
So here is the deal. I ran the uninstaller. I've gone through the registry and cleaned out everything that remotely looks like Regclean pro as I've done several times. Usually the problems stop, however upon starting his computer, there is a start up service that is clearly trying to run Reg Clean Pro. I can't for the life of me find it. It's not in the startup in msconfig, its not in the services but it has to be somewhere because it doesn't show up in safe mode.
What it's doing is it is attempting to run and then it gets a C# error saying that it can't locate the file reg_pro_cleaner\sys_auth.xml. If you click ok, then the reg clean pro UI comes up, but is blank. If you click on it, it crashes because it can't run. I have ran various tools such as malwarebytes, JRT, and everything short of combofix, which I am not confident enough to try on my own just yet. All the results come up negative and there are 0 infections left. Anyone have any idea what might be causing this issue? I'm certain its either a registry value, file or service but I can't for the life of me find it. Thanks for the help!