beginner troubleshooting registry values / system variables

[alexei5243]

hi, a local business has an annoyance on a windows 7 x64 pro machine
it is not worth hiring a technician to solve it and technicians here are no good so im trying to see if i can do anything for them

an engineering software has recently been installed
i checked the version and it is not officially available
so im guessing they might have installed cracked software for compatibility with 7

after that installation they began having a problem with a file renamer software
when they run the file renamer it invokes the windows installer with the process msiexec.exe and starts searching for the engineering software msi installer file, the one that was recently installed and probably caused the problem
it does that for 3 consecutive times whether you cancel it immediately or wait for it to go through searching the setup file, not find it and then cancel

at first i thought it was malicious behaviour / virus installed with the crack but as it turns out it isnt
something has been set wrong by the crack probably so my mind went to shortcut arguments / registry values / system variables
the problem is i am a beginner, i dont know much about these or how to troubleshoot them

for example i searched the registry and found a few exact matches for the file path that the renamer is trying to find the engineering installer in
(the file path is the value of the keys listed below)

HKEY_CLASSES_ROOT\Installer\Products\FEE98B82100300001020FCF3A3907BD7\SourceList\Net 1
HKEY_CLASSES_ROOT\Installer\Products\FEE98B82100300001020FCF3A3907BD7\SourceList LastUsedSource
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\FEE98B82100300001020FCF3A3907BD7\SourceList\Net 1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\FEE98B82100300001020FCF3A3907BD7\SourceList LastUsedSource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28B89EEF-3001-0000-0102-CF3F3A09B77D} InstallSource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\FEE98B82100300001020FCF3A3907BD7\InstallProperties InstallSource

can anyone make anything out that, meaning should i change the value / file path and see if it solves the problem?

 

[torchwood]

As you believe he has installed an un-official/cracked software, first option is to revert to a previous restore point before installation of suspected infected download
following this, they should run an AV scan.....(there are multiple ones that are still W7 compatible)

Based on you investigation i have to assume you have remote access to his comp...

fly over to BleepingComputers and follow this instruction link
FRST Tutorial Forum - BleepingComputer Forums

 

[alexei5243]

As you believe he has installed an un-official/cracked software, first option is to revert to a previous restore point before installation of suspected infected download following this, they should run an AV scan.....(there are multiple ones that are still W7 compatible)
Based on you investigation i have to assume you have remote access to his comp...
fly over to BleepingComputers and follow this instruction link
FRST Tutorial Forum - BleepingComputer Forums

hi, thanks for the reply, i think you ve missed an important part of my post but np i ll repeat it:

at first i thought it was malicious behaviour / virus installed with the crack but as it turns out it isnt

there is no need to write walls of text to go through how i know that step by step, because that is not what im asking for at all
that was the background story, my question is specific about registry / variables / shortcut arguments, not virus scanning
when i said that i am a beginner i was referring to dealing with those, not that i dont know how to check a machine for malware
thanks again, any comments on registry / variables etc will be appreciated

 

[torchwood]

oh well,
considering the next line in the paragraph that you referenced;

something has been set wrong by the crack probably so my mind went to shortcut arguments / registry values / system variables

suggest you revisit my comments
the tool i suggested has a search option for program/shortcuts and registry entries

good luck