There's nothing (logfile) to control what the tool is removing:
The website is hosted on 209.44.126.16 IP (Netelligent Hosting Services Inc.). This IP is also used for well known rogue: System Security
system-tuner.net (209.44.126.16)
systemsecurityonline.com (209.44.126.16)
systemsecuritytool.com (209.44.126.16)
systemsecuritysite.com (209.44.126.16)
