PUPs not deleted after system scan

[Yawnny]

Hello,

I ran a virus scan on an external device last night. The scan was still running on the file system as I went to bed and noticed it had detected 42 PUPs up to that point.

When I woke up this morning the 'Scan Complete' window was up saying no threats detected but didn't mention anything about the PUPs. 

I was hoping I would get the opportunity to delete the PUPs as I noticed 'AssistMonitor.dll' was detected in addition to a handful of other DLLs and EXEs that I want removed.

This scan took over 4 hours to complete. I'm really hoping I don't have to stay by my computer to wait for the window to come up asking me to delete the PUPs.

Is there any way to confirm if it deleted the PUPs or is there another log to see PUPs that were deleted? I noticed the scan log doesn't mention anything about the PUPs either.. it just says there were 0 threats detected.

All help is appreciated.
Thank you

[Yawnny]

Well at least we both have the issue which hopefully brings in some more support.

I agree that it's odd I can't even see in the log what the PUPs were so I can't try and remove the files myself unless I wrote down/took a picture of the file path.

It's situations like this that makes fixing clients computers a much longer than process than is necessary. For all I know removing these PUPs WILL solve the issue for the client but now I have to scan again and monitor much closer to see what's happening as soon as the scan is finished. More of a nuisance than anything.

 

 

Edited December 21, 2017 by Yawnny

[AdvancedSetup]

Hello @Yawnny and

Sorry for the delay.

 

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[CES]

Have followed your instructions Step 01. File attached.

Still not sure whether the PUP has been removed.

CES

Malwarebyes 31.12.17.txt

[AdvancedSetup]

File: 1
PUP.Optional.GolSearch, C:\USERS\CELIAS\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, No Action By User, [11652], [455243],1.0.3597

Log says you did not tell it to remove @CES

I also need the logs from STEPS 2 and 3 please.

Thanks

Ron

 

[AdvancedSetup]

Please follow these instructions for Chrome cleanup

Ron

 

[CES]

Thanks Ron. I have now been through Steps 1 and 2 as well, and also in Step 1 given an instruction to Remove PUP.

Files attached.

Is everything OK now?

CES

 

Addition.txt

FRST.txt

Malwarebytes 1.1.18.txt

[AdvancedSetup]

No, you can see here that the Google removal failed.

PUP.Optional.GolSearch, C:\USERS\CELIAS\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Removal Failed, [11652], [455243],1.0.3597

Let's try the following

 

 

Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Firefox
Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• First, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the run dialog box.
  • 
• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks

 

Restart your computer now and make sure there are no longer any redirects or other browser issues. 

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks