Jump to content
Cippolippo1959

PUP.Optional.Legacy Chrome Avira SafeSearch Plus extension

Recommended Posts

Hi, I have Malwarebytes Premium installed which does not give me any kind of problem in the scan, but if I run Adwcleaner it is a "PUP.Optional.Legacy Chrome Avira SafeSearch Plus extension". After removing it through Adwcleaner, on the next restart Google Chrome installs it again even if I deny the authorization.
I searched on the forum and in the closed post "I'm infected - What do I do now?" it was written to open a new one with the FRST.txt and Addition.txt files attached and so here I am. The result of Adwcleaner is also attached.
Thank you.

Adwcleaner.png

Addition.txt FRST.txt

Share this post


Link to post
Share on other sites

Good morning, I performed exactly the procedure as described in the miekiemoes post and, after the restart, the pup had been canceled; for safety I also deleted all the search engines except google as described in the post of Aura and everything was perfect. The moment I launched Google Chrome, the "PUP.Optional.Legacy Chrome Avira SafeSearch Plus extension" was automatically installed again and, although I still deleted it from the extensions, it was always present in the control performed by Adwcleaner.
Any other suggestions?

07.png

06.png

05.png

04.png

03.png

02.png

01.png

Share this post


Link to post
Share on other sites

I redone a scan with Farbar recovery scan tool and this is a small extract of the result in the FSRT file under Google: 

Chrome: 
=======
CHR DefaultProfile: Default
CHR NewTab: Default ->  Active:"chrome-extension://jpfpebmajhhopeonhlcgidhclcccjcik/newtab.html"
CHR DefaultSearchURL: Default -> hxxps://search.avira.com/#web/result?source=omnibar&q={searchTerms}
CHR DefaultSearchKeyword: Default -> Avira
CHR DefaultSuggestURL: Default -> hxxps://search.avira.com/suggestions?q={searchTerms}&li=ff&hl=en
CHR Session Restore: Default -> is enabled.

Share this post


Link to post
Share on other sites

Your copy of Chrome may have been compromised

Remove and re-install Chrome. Follow these instructions.


step1.gif Remove Chrome from your Computer and reinstall a fresh copy later.

step2.gifIf you remove the syncing of your account you must remove it before you save your bookmarks etc...
Delete Your Google Chrome Browser Sync Data if you sync with other devices. <- Important ...
https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/

step3.gif Before you remove Chrome Export your Bookmarks
Chrome will export your bookmarks as a HTML file, which you can then import into another browser.
How To: http://ccm.net/faq/31791-how-to-backup-your-google-chrome-bookmarks

step4.gif Before you remove Chrome Export your Passwords
How to export your saved passwords from Chrome
https://www.google.com/search?q=chrome+export+password&oq=chrome+export+password&aqs=chrome..69i57j69i60l2.7991j0j7&sourceid=chrome&ie=UTF-8

step5.gif Clear your Chrome cache and cookies
https://support.google.com/chromebook/answer/183083?hl=en

step6.gif Remove Chrome using the the instructions on this page.
https://support.google.com/chrome/answer/95319?hl=en

step7.gif Re-install Chrome and the Bookmarks.
<<<>>

How is it now?

 

Share this post


Link to post
Share on other sites

All done, just installed Google Chrome, of course there was no problem even in Adwcleaner, but after a few minutes the Avira extension was installed again as if I hadn't done anything. For the moment, since it doesn't give me any particular problem, I believe that I will give it up and then, in the future, we will see ……

Share this post


Link to post
Share on other sites

I did it!
After a thousand attempts, since every time I removed it, it automatically installed it on restart without letting me see it in the extensions, I decided to install it completely from Google Play. After that I clicked on details in the extensions tab and saw that it told me that it would use this extension on all sites, I changed the setting by entering only "https://www.avira.com" then, always in the details I clicked on "uninstall this extension" and then on "uninstall". At that point, a page came out in Google Chrome that had never been done before and that told me that Avira was sorry to see me go and the next check Adwcleaner tells me that everything is clean. P.Š. it had nothing to do with history because even without access, it still installed it on reboot. Thanks anyway for everything.

scansione.png

Share this post


Link to post
Share on other sites

Hi,

Can you translate to English what long message says.

If I could copy the present text I would be able to get it translated by I cannot copy the text in the image.

Share this post


Link to post
Share on other sites

Hi, my message is in English (translated by Google), instead the adwcleaner message only says that nothing has been detected on my system. the longer one says that I can optionally perform a basic repair that will restore winsock and other settings and their default values (basic on adwcleaner). Nothing important.

Share this post


Link to post
Share on other sites

Hi,

If all is well fine.

If ever you have problems with the winsock  we can fix it using a Farbar fix.

Let me know.

Share this post


Link to post
Share on other sites

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.