Jump to content

AdwCleaner does not remove PUP.Optional.Legacy


Recommended Posts

Hi , while running AdwCleaner it detected a PUP.Optional.Legacy registry value that seems related to Internet Explorer toolbar. [HKLM\Software\Microsoft\Internet Explorer\Toolbar|{32099AAC-C132-4136-9E9A-4E364A424E17}]Upon quarantine and restart of computer, AdwCleaner shows that the item is still not fixed.

I've tried disabling extensions on IE and running scan again but the PUP remains unfixed. When I reset IE settings and re-scan, a new PUP.Optional.Legacy registry key shows up additionally but I am able to quarantine it successfully leaving behind the PUP.Optional.Legacy registry value that I can't seem to fix. I've tried running scans using Malwarebytes, HitmanPro, Sophos Virus Removal Tool and ESET but this PUP does not show up on any of them.

Link to post
Share on other sites

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

If your Default browser is synced with other devices you should reset it.
If need to know how let me know which browser it is and I will guide you.

If the problem is not solved.

Download the Farbar Recovery Scan Tool (FRST).
Choose the 32 or 64 bit version for your system.
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file:
In the Reply section in the bottom of the topic Select Click the Choose a File.
Navigate to the location of the File.
Click the file. It will appear in section.
Click the Saving button.

Please attach the logs for my review.

Wait for further instructions

Link to post
Share on other sites

My default browser was Chrome. I've reset settings and sync data but the PUP is still there and can't be fixed. My computer is an old computer that I've recently started using, I have Internet Explorer 9 which doesn't have sync if I am not mistaken. Should I proceed with Farbar?

Link to post
Share on other sites

Hi, I'm not sure how or where to select the 32 bit version, when I click on download I seem to automatically get the 64 bit version. 

I did not see any popups or push notifications as I have not actively been using Internet Explorer. The PUP showed up in a scan and I was worried it would be harmful as it could not be removed. 

Link to post
Share on other sites

Hi,

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt.

If the problem persists and Chrome is Synced with other Devices reset it.

https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/
https://support.google.com/chrome/answer/185277

Execute the suggested fix.

Restart the computer normally.
===========

Is the problem solved?

fixlist.txt

Link to post
Share on other sites

Hi,

Glad we could help.

Remove Farbar by running this tool.

Please download KpRm by Kernel-panik and save to your Desktop.

Click on KpRm.exe to run the tool.
Vista/Windows 7/8/10 users right-click and select Run As Administrator.

Put a check mark next to these items:
- Delete tools
- Delete now

Click the "Run" button.
 

automatic.png

 

p.s.
Do not use the other options unless guided by a qualified helper.

====

 - Delete tools
 - Delete Restore points
 - Create Restore point
 - Registry Backup
 - UAC Restore
 - Restore System Settings

 

Edited by AdvancedSetup
updated inline image view
Link to post
Share on other sites

  • Root Admin

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.