Since update, 324 PUPs appear after scan.

[pinetrader]

I updated to the current version on 2 systems. Each day, after completing a scan and quarantining the 324 PUPs, they reappear in the next scan, It has been happening for more than a month, It never happened  before. Any ideas how to stop this? I appreciate any help with this.

[Firefox]

Hello and Welcome

Let's try and get some logs first so the team can review them and see if they can tell what may be causing your issues.... (also please provide a scan log with the detected items)
 

1. FIRST: Create and obtain Farbar Recovery Scan Tool (FRST) logs
2. Download FRST and save it to your desktop
   Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
3. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
4. Press the "Scan" button
5. This will product two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   
   • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
     
6. NEXT: Create and obtain an mb-check log
7. Download MB-Check and save to your desktop
8. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK"
9. This will produce one log file on your desktop: mb-check-results.zip
   
   • This file will include the FRST logs generated from the previous set of instructions
   • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area
     
   
   
   

 

[pinetrader]

I have 2 systems: 1 - I-5 64-bit win10, 1 - I7 64-bit win10. These results are from the I7-64 bit win10.

FRST.txt

mb-check-results.zip

[Firefox]

Are you getting these same detections on both computers?

thanks for the logs... lets wait for someone from staff to review them...

@nikhils @AdvancedSetup @dcollins

[pinetrader]

This was not an issue prior the the recent update. Both systems have the identical symptoms since the latest update a little over a month ago. I was quite surprised when the I7 system updated about 10 days after the I5 system and displayed the identical results as the I5 system. First scan results after update "324 PUPs", "elect to quarantine", "yes"  over & over , every day since. Each system  is hardwired to the same ISP modem. Some I5 directories are shared with the I7.

[Firefox]

One more thing... when the items are detected, did you make sure that all items had a check mark on them?  You did not provide a copy of your last scan log, can you please provide that?

Thanks

[pinetrader]

Sorry for the oversight. Do you want the I5 results ?

MalBytes Scan Log - I7 - 2017-1102.txt

[Firefox]

Thanks for the log.... in the log it shows that you chose to take no action.... just a snip for the logs...

Folder: 85
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\components\abstractbutton\background, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\components\embedscript\background, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\components\thirdparty\background, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\components\uninstall\background, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\components\embedhtml\background, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\widget-api\widgets\weather\css, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\widget-api\widgets\topapps\css, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\widget-api\widgets\weather\js, No Action By User, [850], [443121],1.0.3159

 

[pinetrader]

The result seem to be identical each day. Ido check all for quarantine and  all are show as quarantined in the dialog box. I can forward these tests from the I5 system if needed.

[pinetrader]

30 minutes ago, Firefox said:

Thanks for the log.... in the log it shows that you chose to take no action.... just a snip for the logs...

Folder: 85
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\components\abstractbutton\background, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\components\embedscript\background, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\components\thirdparty\background, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\components\uninstall\background, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\components\embedhtml\background, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\widget-api\widgets\weather\css, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\widget-api\widgets\topapps\css, No Action By User, [850], [443121],1.0.3159
PUP.Optional.MindSpark.Generic, C:\Users\Pine Trader\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdfofellfkldcddminajkgcgocndgkip\12.703.12.2805_0\common\widget-api\widgets\weather\js, No Action By User, [850], [443121],1.0.3159

 

 

[pinetrader]

The I7 scan checked & quarantined. Also another report application named "Addition".

I7 results checked & quarantined 2017-1102.txt

Addition.txt

Edited November 2, 2017 by pinetrader

[pinetrader]

These are the I5 system results:

Addition.txt

FRST.txt

I5 Scan Results - Checked & Quarantined.txt

mb-check-results.zip

[dcollins]

This is most likely due to having your Chrome profile synced, which is re-installing the offending add-on over and over. Once you run a scan, you'll want to open Chrome, and go to Settings -> More Tools -> Extensions. Find PackageTracer in the list and click the trash can icon next to Package Tracer.

This manual process should hopefully be resolved in a future build.

[pinetrader]

This suggested fix has solved the repetitive quarantine problem. Thank you for your help. I appreciate it;