PUP Iobit ASCDownloader

[nodrog633]

I have been getting PUPs on this even after deleting and would greatly appreciate help in removing it.

Please advise.

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/27/17
Scan Time: 6:06 PM
Logfile:
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.75
Update Package Version: 1.0.1610
License: Premium

-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: Den\Jon

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 380525
Time Elapsed: 7 min, 31 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 1
PUP.Optional.AdvancedSystemCare, C:\PROGRAMDATA\IObit\ASCDownloader, No Action By User, [1857], [380336],1.0.1610

File: 1
PUP.Optional.AdvancedSystemCare, C:\ProgramData\IObit\ASCDownloader\Downloader.log, No Action By User, [1857], [380336],1.0.1610

Physical Sector: 0
(No malicious items detected)

(end)

[digmorcrusher]

Do you have Advanced System Care from IObit installed on your system? If so that is why the pup detections keep re-occuring,  If not you could try deleting that folder yourself "C:\ProgramData\IObit " or uninstall any IObit programs, they are not highlly recommended around here.

[Telos]

@nodrog633 Give MB's AdwCleaner a whirl. It should nail the PUPs.

https://www.malwarebytes.com/adwcleaner/

[Firefox]

Also according to the scan log, it shows No Action By User which means that you did not tell Malwarebytes to remove the items.  After the scan make sure all items are checked for removal...

[nodrog633]

Sorry if I haven't been clear.

I have removed them several times and they keep showing up.

I have also run Adwcleaner several times without success. The files keep regenerating after they have been deleted from quarantine.

The scan above was right after I had deleted them. Here's the latest scan:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/29/17
Scan Time: 3:46 AM
Logfile:
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.75
Update Package Version: 1.0.1620
License: Premium

-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: System

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 438442
Time Elapsed: 5 min, 59 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 1
PUP.Optional.AdvancedSystemCare, C:\PROGRAMDATA\IObit\ASCDownloader, Quarantined, [1857], [380336],1.0.1620

File: 1
PUP.Optional.AdvancedSystemCare, C:\ProgramData\IObit\ASCDownloader\Downloader.log, Quarantined, [1857], [380336],1.0.1620

Physical Sector: 0
(No malicious items detected)

(end)

[Unicore]

You need to uninstall Advanced System Care.

[Firefox]

As mentioned, you need to uninstall Advanced System Care... it you can't or are still having issues then follow the instruction's below to get one on one expert help with cleaning it up.

For expert assistance, I suggest that you please follow the advice in this pinned topic: Available Assistance For Possibly Infected Computers.

It explains the options for free, expert help -->>AND<<-- the suggested, preliminary steps to expedite the process.
A malware analyst will assist you with looking into your issue.

Thank you

[lmcdougall]

On 3/27/2017 at 6:32 PM, nodrog633 said:

I have been getting PUPs on this even after deleting and would greatly appreciate help in removing it.

Please advise.

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/27/17
Scan Time: 6:06 PM
Logfile:
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.75
Update Package Version: 1.0.1610
License: Premium

-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: Den\Jon

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 380525
Time Elapsed: 7 min, 31 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 1
PUP.Optional.AdvancedSystemCare, C:\PROGRAMDATA\IObit\ASCDownloader, No Action By User, [1857], [380336],1.0.1610

File: 1
PUP.Optional.AdvancedSystemCare, C:\ProgramData\IObit\ASCDownloader\Downloader.log, No Action By User, [1857], [380336],1.0.1610

Physical Sector: 0
(No malicious items detected)

(end)

 

[lmcdougall]

With regard to ASCDownloader, I seem to have gotten rid of it for good. Malwarebytes would detect and quarantine it. Then Malwarebytes would require a reboot to finish the removal process. After the reboot I ran Malwarebytes again and it would detect ASCDownloader again. If you search for FreeFixer on Google and run the free version, the results will show IObit/updater.exe (or something very similar to that). I checked the box for that one and clicked the FIX button. After that Malwarebytes removed the ASCDownloader and it didn't come back. I guess the IObit/updater.exe was reinstalling the unwanted program on every startup. I used FreeFixer v1.14 on a 64 bit computer running Windows 10.