pup.optional.PSScriptLoad.Encjob & pup.optional.PSScriptLoad.SHHKRST

[Peter301290]

Can't seem to get rid of these 2 reported pups

Downloaded and run Farbar as this seems to be your favoured tool - reports attached

Please help

 

Addition.txt

FRST.txt

[TwinHeadedEagle]

Hello and

Your issue is that on every scan MalwareBytes detects the same lines? Is it happening on every scan or after your reboot your PC?

Edited July 2, 2017 by TwinHeadedEagle

[Peter301290]

I only find them after a powershell window that flashes up if i run a scan after i find them.

The powershell install apears to be on a timer of some sort as the last few tiems its come back has alwasy been at 23:11, MWB also then stops an out going website conection i assume is related.

To compleate the removal  I restart the PC and normally scan again, (when i find nothing) it then tends to  come back agian at 23:11 then next day.

Last night i pulled out the ethernet cable at 2300 and closed all browers and it still popped a powershell window, i scanned right away and found it still.

 

Hope this helps

[Peter301290]

Here are the last 2 scan reports - I hope these will help answer your questions

malwarescan_6-30-17.txt

malwarescan_7-1-17.txt

[TwinHeadedEagle]

Let's see with this:

 

Please download Zemana AntiMalware and save it to your  Desktop.

• Install the program and once the installation is complete it will start automatically.
• Without changing any options, press Scanto begin.
• After the short scan is finished, if threats are detected press Next to remove them.
  

Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.

• Open Zemana AntiMalware again.
• Click on icon and double click the latest report.
• Now click File > Save As and choose your Desktop before pressing Save.
• The only left thing is to attach saved report in your next message.
  

[Peter301290]

HI thanks for your help report attached.

 

It did find a few thign so thats good!

2017.07.02-18.04.52-i0-t92-d11 zemana scan.txt

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition.txt option is checked. option is checked.

  

• Press Scan button and wait.
  

• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
  

Please attach report into your next reply.

[Peter301290]

Thanks again heres the second Farbar scans you asked for.

Addition.txt

FRST.txt

[TwinHeadedEagle]

How is the situation now?

[Peter301290]

Hi again

 

Ive run a MWB and the Zemana again and cant find anything, we'll  just have to see if it comes back at 23:11, If its doesnt then it must ahve been caught by Zemana.

Ill let you know when i know.

 

thanks again

[Peter301290]

HI again

So... at 2311 it managed to pop a powershell window and came back again I scanned and removed it all again righ away see scan report.

So although zemana found soem stuff it wasnt this, i did also run zemana again after the restart to check if that was gonna find anythign else aw well but that came back clean.

 

thanks again

mwb scan 2-7-17 2311.txt

[TwinHeadedEagle]

Please open a Command Prompt as Administrator and execute the following command:

SCHTASKS /Query /FO LIST /V >"%USERPROFILE%\Desktop\MyScheduledTasks.txt"

Upload MyScheduledTasks.txt from your Desktop.

[Peter301290]

HI again

heres the file you asked for.

 

thanks again

 

MyScheduledTasks.txt

[TwinHeadedEagle]

Thanks. This will remove it:

 

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.
  

Please attach it to your reply.

fixlist.txt

[Peter301290]

HI thank again

ive run the fix, log attached.

I run spybot in the back ground as a second opion(just the free version) and it detected a registry change deleting something i assume that was part of the fix so I said ok to it, mentioning it just incase.

Thanks again hope the log shows what your looking for

 

Fixlog.txt

[TwinHeadedEagle]

Yes, the malicious task has been removed now. Keep me updated if it vanished from your system now.

[Peter301290]

Hi again

 

All apears good 2311 pas passed and now recurrance has occured, (scannned just incase and nothign found)

thanks again for all your help.

[ballyhoo]

Hi MWB

I hope it's ok to post into this thread.

I have this problem: 3 re-appearing PUPs when the PC is left on overnight.  I have tried every brand of (free) AV, and still they (the subject of this thread) reappear daily.  I have MWB on premium trial.  It has not prevented these from reappearing when left with realtime protection on.  Can you help?  

Thanks