PUP.Optional.MailRu keep coming back

[AdvancedSetup]

Sorry about that. I was going to say, export, save your Persistent Routes as they have probably been removed using this fix. If you still want or need them then you'll probably need to re-add them.

Please run the following steps in the order provided, and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed click on the View Report button, then the Export button and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a checkmark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

[Antr]

Heres a result of step1 , 2 and 3
 

AdwCleaner[C03].txt malwarebytes_scan_result.txt FRST.txt Addition.txt

[AdvancedSetup]

Please close Chrome. Use another browser if you need to view this reply. Google Chrome cannot be open.

Then using Windows Explorer - aka My Computer
Browse to the following location

C:\Users\Arc\AppData\Local\Google\Chrome\User Data\Default\Sync Data\

Then locate and delete the following folder:  LevelDB

Now, scan with Malwarebytes again and post back the new log

 

Edited May 7, 2020 by AdvancedSetup
updated information

[Antr]

Even if i make new fresh windows install and doing fresh google chrome install. It wont go away. mail ru search engine will come back

new_scan_malwarebytes.txt

[Antr]

i made few test for education purpose:
testing.txt - i completely deleted syncdata and levelDB folder (then i did not open google chrome after that)
testing2.txt - now i opened google chrome for once
testing3.txt & test_chrome.PNG & test_chrome2.PNG( be advised that i used malwarebytes to remove that mailru search engine before) - i completely deleted all data i could from google itself using clear data function from google itself 
testing4.txt - made new malwarebytes scan test and found nothing aswell
test_chrome3.PNG & test_chrome4.PNG &  test_chrome5.PNG - since i found nothing from both testing3 and testin4 test i tought i could go wild and reset browser itself from settings.

testing5.txt - heres result of testing test_chrome3.png & test_chrome4.PNG &  test_chrome5.PNG no sync data from internet just reset from browser itself.

all files are in testing.zip

testing.zip

[Antr]

made another test
i completely uninstalled chrome itself and downloaded brand new google chrome installer
testing1.txt - scan test without google chrome
https://www.virustotal.com/gui/file/7a95e9ef40e067a480129035914f8f28cb7130f808f42804f9e4d5ab2d60923e/detection
virustotal test for google chrome installer
testing2.txt - scan test after brand new google chrome install and i even did not log in into google account with my user

conclusion: Malwarebytes falseflags mail.ru search engine because it was a thing back then. Also someone made a adware while back with that search engine.
another conclusion: mail.ru search engine is by default with google chrome, because it depens where i live.
next conclusion: i asked person in my country, do they have the same search engine and i found out thats a correct. People have the same search engine installed in their system and malwarebytes picks that up as potentially harmful.

final conclusion: theres no help for me in that situation other else than just i have to accept that finding from malwarebytes and google policy.

testing2.txt testing1.txt

[AdvancedSetup]

I've sent you a private message @Antr

[Antr]

This thread can closed right now

[AdvancedSetup]

Thank you @Antr

Have a great weekend coming up. Take care and stay safe out there.

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you