Every time I restart my computer, this one piece of PUP keeps coming back

[marshedpotato]

Hi everyone. For the past few months I have had this problem. Any help with this would be very much appreciated.

 

Some time ago I got a little bit of PUP on my machine. Nothing too bad, just a browser hijack called Trovi. I ran a Malwarebytes scan there and then, and it found and removed Trovi. Since then, I have never experienced any of the symptoms of Trovi. My computer is working fine and as far as I can tell there is no Trovi anymore, however every time I do a Malwarebytes scan, it finds a Trovi file. Here is a picture of what Malwarebytes finds: http://goo.gl/d9vf71

 

If I tell Malwarebytes to remove it, and then do another scan, it doesn't find anything. However, if I restart my computer and then do another scan, Malwarebytes will then find the same "PUP.Optional.Trovi.A" in the same exact location. It comes back every time I restart!

 

Like I say, as far as I can tell this Trovi file isn't actually doing anything. My browser has been completely normal ever since Malwarebytes removed it the first time. I'm just concerned about what on earth it could be doing in the background and how the heck it keeps managing to come back every time I restart. Does anyone have any ideas on how to get rid of it short of reinstalling Windows?

 

Here is a Malwarebytes log file from one of the many times it has detected the Trovi file: https://goo.gl/acJJr2

 

Many thanks in advance

 

Brad

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll try to help your with your issue.
 
     
    
Before we start please read and note the following:

• We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Keep in mind that private life gets in the way too. Note that we may live in totally different time zones, what may cause some delays between answers.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 

---

 
Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[marshedpotato]

Hi TwinHeadedEagle

 

Thankyou very much for your quick response. Here are the log files you requested.

 

Brad

FRST.txt

Addition.txt

[marshedpotato]

Hi everyone

 

Sorry to be "that guy" who bumps his posts, but since my post is no longer on the first page of threads I'm just a bit concerned about it will be missed.

 

I could really use some advice on this if anyone knows how I can stop this Trovi file from coming back every time I restart? 

 

Brad

[AdvancedSetup]

2015-05-24 18:19 - 2015-05-24 18:19 - 00018751 _____ () C:\Users\Brad\Downloads\[kat.cr.prx.websiteproxy.co.uk.prx.websiteproxy.co.uk]home.2015.1080p.web.dl.aac2.0.h264.rarbg.torrent

2015-05-24 18:17 - 2015-05-24 18:31 - 00000000 ____D () C:\Users\Brad\Downloads\Home.2015.1080p.WEB-DL.AAC2.0.H264-RARBG

2015-05-23 18:10 - 2015-05-23 18:21 - 00000000 ____D () C:\Users\Brad\Downloads\Kingsman The Secret Service (2014) [1080p]

2015-05-23 18:09 - 2015-05-23 18:09 - 00020613 _____ () C:\Users\Brad\Downloads\[kat.cr.prx.websiteproxy.co.uk.prx.websiteproxy.co.uk]kingsman.the.secret.service.2014.1080p.brrip.x264.yify.torrent

2015-05-19 19:04 - 2015-05-19 19:04 - 00106819 _____ () C:\Users\Brad\Downloads\[kat.cr.prx.websiteproxy.co.uk.prx.websiteproxy.co.uk]rg.games.presents.the.witcher.3.wild.hunt.repack.dlc.cracked.multi2.torrent

2015-05-18 14:25 - 2015-05-18 14:32 - 00000000 ____D () C:\Users\Brad\Downloads\Game.of.Thrones.S05E06.720p.HDTV.x264-SNEAkY

2015-05-18 14:25 - 2015-05-18 14:25 - 00015644 _____ () C:\Users\Brad\Downloads\[kat.cr]game.of.thrones.s05e06.720p.hdtv.x264.sneaky.torrent

2015-05-16 20:43 - 2015-05-16 23:09 - 00000000 ____D () C:\Users\Brad\Downloads\Guitar Hero 3 [PC] Crack Included

2015-05-16 20:43 - 2015-05-16 20:43 - 00017078 _____ () C:\Users\Brad\Downloads\[kat.cr.prx.websiteproxy.co.uk.prx.websiteproxy.co.uk]guitar.hero.3.pc.crack.included (1).torrent

2015-05-16 20:42 - 2015-05-16 20:42 - 00017078 _____ () C:\Users\Brad\Downloads\[kat.cr.prx.websiteproxy.co.uk.prx.websiteproxy.co.uk]guitar.hero.3.pc.crack.included.torrent

2015-05-11 20:00 - 2015-05-16 23:11 - 00000000 ____D () C:\Users\Brad\Downloads\The.Big.Bang.Theory.S08E24.HDTV.x264-LOL[ettv]

2015-05-11 20:00 - 2015-05-11 20:01 - 00000000 ____D () C:\Users\Brad\Downloads\Furious.7.2015.1080p.WEBRip.KORSUB.x264.AAC2.0-RARBG

2015-05-11 19:59 - 2015-05-11 19:59 - 00014876 _____ () C:\Users\Brad\Downloads\[kickass.to.prx.websiteproxy.co.uk.prx.websiteproxy.co.uk]furious.7.2015.1080p.webrip.korsub.x264.aac2.0.rarbg.torrent

2015-05-11 19:59 - 2015-05-11 19:59 - 00010291 _____ () C:\Users\Brad\Downloads\[kickass.to.prx.websiteproxy.co.uk.prx.websiteproxy.co.uk]the.big.bang.theory.s08e24.hdtv.x264.lol.ettv.torrent

2015-05-11 14:22 - 2015-05-16 23:11 - 00000000 ____D () C:\Users\Brad\Downloads\Game.of.Thrones.S05E05.1080p.HDTV.x264-BATV[rarbg]

2015-05-11 14:20 - 2015-05-11 14:20 - 00180565 _____ () C:\Users\Brad\Downloads\[kickass.to]game.of.thrones.s05e05.1080p.hdtv.x264.batv.rarbg.torrent

2015-05-01 16:48 - 2015-05-16 23:11 - 00000000 ____D () C:\Users\Brad\Downloads\Get.Hard.2015.HC.HDRip.XViD-ETRG

2015-05-01 16:48 - 2015-05-01 16:48 - 00057343 _____ () C:\Users\Brad\Downloads\[kickass.to.prx.websiteproxy.co.uk.prx.websiteproxy.co.uk]get.hard.2015.hc.hdrip.xvid.etrg.torrent

2015-04-29 20:09 - 2015-05-16 23:11 - 00000000 ____D () C:\Users\Brad\Downloads\The Gambler 2014 1080p BRRip x264 AAC-JYK

2015-04-29 20:09 - 2015-04-29 20:09 - 00018733 _____ () C:\Users\Brad\Downloads\[kickass.to.prx.websiteproxy.co.uk.prx.websiteproxy.co.uk]the.gambler.2014.1080p.brrip.x264.aac.jyk.torrent

2015-04-29 20:08 - 2015-04-29 20:09 - 00000000 ____D () C:\Users\Brad\Downloads\The.Gambler.2014.1080p.BluRay.x264-SPARKS[rarbg]

2015-04-29 20:07 - 2015-04-29 20:07 - 00083008 _____ () C:\Users\Brad\Downloads\[kickass.to.prx.websiteproxy.co.uk.prx.websiteproxy.co.uk]the.gambler.2014.1080p.bluray.x264.sparks.rarbg.torrent

[AdvancedSetup]

This topic will now be closed due to evidence of cracked or pirated software on this system.

Piracy Policy