Malware keeps reappearing after every scan.

[strelok]

Hi y'all, I'm stuck in a jam right now.  Every time I run Malware bytes it detects "PUP.optional.spigot" and every time I quarantine and delete the malware but it keeps reappearing after every scan.  Does anyone know how I can solve this problem? 

[strelok]

Here's the scan log. 

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 11/25/17
Scan Time: 1:39 PM
Log File: c8f356ca-d220-11e7-baa5-ac220b8ba1df.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.236
Update Package Version: 1.0.3344
License: Trial

-System Information-
OS: Windows 10 (Build 16299.64)
CPU: x64
File System: NTFS
User: STRELOK\Samuel

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 398525
Threats Detected: 1
Threats Quarantined: 1
Time Elapsed: 4 min, 2 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
PUP.Optional.Spigot, C:\USERS\SAMUEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Backup Default\Web Data, Replaced, [647], [454814],1.0.3344

Physical Sector: 0
(No malicious items detected)

(end)

[Porthos]

@strelock

Follow the instructions in the thread below, it should help solve your issue.

https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/

[strelok]

But I don't have google chrome, I use mozilla.  I deleted Google Chrome.  So now what do I do? 

[Porthos]

15 minutes ago, strelok said:

But I don't have google chrome, I use mozilla.  I deleted Google Chrome.  So now what do I do? 

I will ket @Aura Guide you from here. please provide the following logs.

Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.

You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to the disclaimer.
• Press the Scan button.

• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've run it before it may not and you may need to select it manually
• Please attach both logs to your reply if possible. Otherwise, you may copy/paste the logs directly if you have to, but an attachment is better.
• To save attachments please click the link as shown below. Then browse to where your file is located and select it and click the Open button.

Edited November 25, 2017 by Porthos

[strelok]

Here you go.  Is this sufficient?   Or should I scan it again and make another log? 

Addition.txt

[Aura]

There should be a FRST.txt log on your desktop as well. Can you attach it?

[strelok]

Found it, here you go.  And thank you  

FRST.txt

[Aura]

Alright. Close Google Chrome, and and go in the following folder:

C:\USERS\SAMUEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

Now, look for the "Backup Default" folder, and rename it to "Backup Default Old". Once done, restart your Google Chrome. Are your settings (bookmarks, extensions, history, etc.) still there?

[strelok]

Restart google chrome....  I deleted google chrome.  I use firefox.  Does all this still apply to me? 

[Aura]

If you don't plan on using Google Chrome anymore then no, it doesn't apply anymore.

[strelok]

So does that mean I shouldn't worry about this particular malware than?  Or should I do something about it? 

[Aura]

As long as Google Chrome isn't installed on your system, you don't need to worry. Though if you reinstall it and sign back into Chrome with your Google account, it'll comeback. The detection is for one entry in a Chrome settings file. All we need to do is to manually find and remove that setting in Chrome, and the detection will go away.

[Aura]

Hi strelok,

Are you still with me?

[strelok]

I think so.  You told me not to worry about it anymore since I deleted google chrome.  Is their anything else I should do? 

[Aura]

Not unless you have any other malware-related issues that needs to be taken care of  

[Aura]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!