Jump to content

PUP.Optional.... Not removing. Removal Failed/Replaced


Recommended Posts

Struggling with a slow running PC. Running Malwarebyters software reveals between15-25 PUP.Optional files, that don't seem to remove. Conduit, Legacy, MySearch, Perion, Sweetpacks, Funmoods. 


How can I get rid of these correctly? Thanks

Link to post
Share on other sites
Hello traceylou and welcome to malwarebytes....

Continue with the following:

If you do not have Malwarebytes installed do the following:

Download Malwarebytes from the following link:

https://www.malwarebytes.com/mwb-download/thankyou/

or,

https://downloads.malwarebytes.com/file/mb4_offline

Double click on the installer and follow the prompts. If necessary select the Blue Help tab for video instructions....

When the install completes or Malwarebytes is already installed do the following:

Open Malwarebytes, select > "settings" > "security tab"

Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on....

Go back to "DashBoard" select the Blue "Scan Now" tab......

When the scan completes quarantine any found entries...

To get the log from Malwarebytes do the following:
 
  • Single click on the target sight above scanner window.
  • In the new window select Report
  • Double click on the Scan log which shows the Date and time of the scan just performed.
  • Click Export > From export you have two options:
    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Export toTxt - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply

     
  • Please use "Export to Txt" then attach the log to your reply...


Next,

Download AdwCleaner by Malwarebytes onto your Desktop.

Or from this Mirror
 
  • Right-click on AdwCleaner.exe and select user posted imageRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Quarantine button. This will kill all the active processes
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...
 
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
    user posted image
     
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.


Let me see those logs in your reply...

Thank you,

Kevin....
Link to post
Share on other sites

Thanks for those logs Tracey,

Continue please:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Download ESET Online Scanner and save it to your desktop.
  • Right-click on esetonlinescanner_enu.exe and select Run as Administrator.
  • When the tool opens, click Get Started.
  • Read and accept the license agreement.
  • At the Welcome to ESET Online Scanner window, click Get Started.
  • Select whether you would like to send anonymous data to ESET.
  • Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
  • Click on the Full Scan option.
  • Select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
  • ESET will now begin scanning your computer. This may take some time.
  • When the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
  • ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature. Click on Continue.
  • On the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
  • Open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.

Let me see those logs in your reply, also tell me if there are any remaining issues or concerns..

Thank you,

Kevin

fixlist.txt

Link to post
Share on other sites

Thanks Kevin, 

running the FIX now. However i've had a pop up of "ret2" with just "2" and an "ok" selection. Just checking that this is normal..?

 

Thanks

Link to post
Share on other sites

Hiya Kevin,

So yesterday, whilst running the ESET scan my pc decided to reboot itself... -_-

Due to the length of time the scan was taking to run I have waited until this morning to try and run the scan again. However, this morning the programme wont open?

I have since tried to delete the original file and re-download it, however no joy.

Any ideas? 

I have attached the FIXLOG that did manage to complete.

Thanks again,

Tracey

Fixlog.txt

Link to post
Share on other sites

Maybe your onboard security has stopped ESET, not 100% sure why it will not run. Try the following:

Download "Microsoft's Safety Scanner" and save direct to the desktop

Ensure to get the correct version for your system....

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download


Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window
In the "Scan Type" window, select Quick Scan
Perform a scan and Click Finish when the scan is done.


Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function
2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\mrt.log

The log will include log details for each time MSRT has run, we only need the most recent log by date and time....
 
Also let me know if you have any remaining issues or concerns..
 
Thank you,
Kevin..
Link to post
Share on other sites

Hi Kevin,

Sorry for the delayed reply. 

I finally got the ESET to run.

Here is the details of the log file


29/05/2020 13:25:28
Files scanned: 617832
Detected files: 0
Cleaned files: 0
Total scan time: 04:54:53
Scan status: Finished



Should I still run the MSRT Scan?

Thanks

Link to post
Share on other sites

Hello traceylou,

No need to run MSRT scan, ESET is returned a clean log. How does your system respond now, any issues or concerns..?

Thank you,

Kevin...

Link to post
Share on other sites

Hiya Kevin,

The system seems to be somewhat faster, however the Malware Bytes scan this morning, returned 13 PUP. again... Is this just something I'm going to have to deal with? 

Thanks,

Tracey

Link to post
Share on other sites

Hi Kevin,

Please see attached. MWB_0206 is the scan from this morning. MWBSCAN is one I have just run. I haven't done anything other than these scans on the PC, so I'm unsure of why there is a difference between the two. The system was restarted between scans however.

Thanks

MWB_0206.txt MWBSCAN.txt

Link to post
Share on other sites

Hiya traceylou,

I half expected there would be ongoing issues as Chrome is your default browser. Recently we have seen many similar situations to yours, Chrome sync has the unfortunate role of replacing any entries we remove from backed up data on Google servers. The only way past this is to remove all data from Google servers and start afresh...

@AdvancedSetup has a great set of instructions at the following link, please use those instructions and see if the issue ceases....

https://forums.malwarebytes.com/topic/258886-chrome-secure-preferences-detection-always-returns/

When those instructions are complete do this please:

 

Link to post
Share on other sites

I thought it was Chrome that was causing the issues,

Im logged into chrome on a load of devices so I'll have a go at sorting it all out and following your guidance tomorrow. Won't be able to get to it today.

Thanks so much for all of your help.

Tracey

Link to post
Share on other sites

Hiya Kevin,

 

sorry for the delayed reply, life got in the way as per...

 

so going through the instructions for sync etc on Google. I know it says to do the same things on ANY computer that you’re signed in to with chrome, so I’m logged into phones etc including my mothers laptop etc. Firstly, how do I run a scan on my iPhone 5 and iPad...? Also, will it be crucial for me to remove myself and do the same on my mothers laptop even though I haven’t used it for a while? Or should I log into it remotely to make sure it’s cleaned too?

 

sorry for all of the questions!

Link to post
Share on other sites

Don`t worry too much about the other items, the main crux of the fix is to delete data from Google servers. Se how your system runs after that...

Link to post
Share on other sites

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks

 

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.