DriverSupport PUP

[Maulden]

A Malwarebytes scan quarantined about 19 occurrences of driverSupport which I then removed. But Malwarebytes still reported every minute that it had blocked an outgoing call to a web site and quoted driverSupport as as PUP even though I had removed all the occurrences it had found. So how does driverSupport continue to make these suspicious calls? I found driverSupport was an active ttask using Windows 10 task manager and ended their task but on start-up there they were again and every minute a new pop-up from Malwarebytes.

[shadowwar]

Did you reboot after the detections and removal?

 

[Maulden]

Yes. Used Windows RESTART

 

[shadowwar]

I recommend visiting our malware removal subforum to have your system checked to see if something you have is being missed.

 

[Maulden]

What is the malware removal subforum? How do I find it?

It seems clear that Malwarebytes scan has indeed missed at least one instance of driverSupport beause it was not reported in the latest scan.Perhaps for some reason it does not regard it as a potentially unwanted program. Yet Malwarebytes identifies and stops this same program from contacting a web site. Indeed the report about the web blocking identifies the driverSupport program location in progam files. Note that this program is not in the list of programs when I use normal Windowssystem for program to be deleted.

[exile360]

To seek help from the malware removal forum please follow the instructions in this topic and then create a new topic in the malware removal area including the requested logs and info by clicking here and one of our malware removal specialists will assist you in checking and cleaning the system of any threats as soon as one becomes available.

[Maulden]

I am hesitant about removing the elements of driverSupport that Malwarebytes did not flag in a scan. The reason I hesitate is that I found that the user of this background process is SYSTEM not one of the human users. I deduce that this software may have been included in the system by the Lenovo people who engineered my computer. I therefore think it might be risky just to remove it - especially as Malwarebytes did not identify it as a threat during a scan. Is there a risk here?

[AdvancedSetup]

Hello @Maulden and

Please run the following scans and I will assist you in determining if something has infected the computer or not.

 

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks