Jump to content

AdwCleaner finding & cleaning PUP.Optional.Legacy but it keeps coming back


Go to solution Solved by kevinf80,

Recommended Posts

So a couple days ago I downloaded some adware without realizing and only noticed around 8 PM earlier today when my laptop started to fail to connect to a DNS server and I couldn't do anything on any browsers. I had been scanning with Malwarebytes this entire time and it had been coming back clean, but once I downloaded AdwCleaner it noticed an adware and some PUPs and got rid of them-- among them was an anti-virus program, which I assume was suddenly blocking my access to my default DNS server. I then changed my DNS server. After a lot of confusion and things kind of working and then failing again (not helped by my housing complex's already unstable wifi) I am back at a normal state: my laptop can connect to the internet and everything is working at the same speeds as before.

The problem now is these 4 PUP.Optional.Legacy files that keep popping up every once in a while when I scan with AdwCleaner. I've attached the most recent log which shows those 4 files having been deleted, but they keep returning.  I can see that they are related to DHCP server, so I'm wondering if this has anything to do with the changed DNS server-- but I am, frankly, a total fool when it comes to IT so I have no idea if I'm on the right track. It is true, however, that these 4 specific files only popped up after I got rid of the initial adware/PUPs, and probably thus after I'd changed my DNS server.   AdwCleaner[C12].txt

I just ran the Microsoft Safety Scanner and the only thing it found and removed was this, which does not feel related whatsoever:image.thumb.png.588873e8e89dc3054be0a43d72cd56c5.png

 

If you need any other logs/files please let me know, and thanks so much for the help. 

Link to post
Share on other sites

Hello tuna2 and welcome to Malwarebytes,

Disable smart screen if it interferes with software we may have to use:

https://support.microsoft.com/en-us/microsoft-edge/what-is-smartscreen-and-how-can-it-help-protect-me-1c9a874a-6826-be5e-45b1-67fa445a74c8

Please remember to enable when we are finished....

Next,

Disable any Anti-virus software you have installed if it stops software we may use from working:

https://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/

Please remember to enable AV software when we are finished running scans....

Next,

Lets grab some logs and see whats going on, continue with the following:

If you do not have Malwarebytes installed do the following:

Download Malwarebytes version 4 from the following link:

https://www.malwarebytes.com/mwb-download/thankyou/

Double click on the installer and follow the prompts.

When the install completes or Malwarebytes is already installed do the following:

Open Malwarebytes, select > small cog wheel top right hand corner, that will open "settings" from there select "Security" tab.

Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on....

Close out the settings window, this will take you back to "DashBoard" select the Blue "Scan Now" tab......

When the scan completes quarantine any found entries...

To get the log from Malwarebytes do the following:
 
  • Open Malwarebytes
  • Click on the Detection History tab > from main interface.
  • Then click on "History" that will open to a historical list
  • Double click on the Scan log which shows the Date and time of the scan just performed.
  • Click Export > From export you have two options:
    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply

     
  • Please use "Text file (*.txt), then name the file and save to a place of choice, recommend "Desktop" then attach to reply


Next,

Download AdwCleaner by Malwarebytes onto your Desktop.

Or from this Mirror
 
  • Right-click on AdwCleaner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Quarantine button. This will kill all the active processes
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status... If English is not your primary language Right click on FRST/FRST64 and rename FRSTEnglish/FRST64English

 
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
    user posted image
     
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.


Let me see those logs in your reply...

Thank you,

Kevin....
Link to post
Share on other sites

Hi Kevin, thanks for your help with this!

I've attached the Malwarebytes log, AdwCleaner log, and FRST log with the Addition txt file. If you need it specifically copy/pasted into this textbox and not just attached as files, let me know.

I should let you know that I actually tried running AdwCleaner this morning while accessing a different wifi network and each time the scan was clean. But as soon as I got home (I use the wifi network provided by my housing complex) the scans show the same 4 PUP.Optional.Legacy files. Not sure what that means, but maybe it'll help explain something. Computer is still running fine so far. 

AdwCleaner[C22].txt FRST.txt Addition.txt MalwarebytesLog.txt

Link to post
Share on other sites

  • Solution

Hiya tuna2

I`m really not sure why AdwCleaner would remove the DhcpNameServer entries, I`ve checked them at virustotal and they comeback as clean:

https://www.virustotal.com/gui/ip-address/216.240.32.64/detection

The ISP identity also shows as correct. One point I should make here, DHCP name server is the DNS address(es) that will be handed out to LAN clients behind the USG. That is relevent if you connect via cable... You are using wifi so make your connection via DNS, hence your connection remains constant when LAN is removed via AdwCleaner, they will of course be reset by the router. So basically what differs here is the WAN setting (which you use) and the LAN settings (which you do not use).

DHCP (Dynamic Host Configuration Protocol) and DNS (Domain Name System) both work across the client-server architecture though they are different terms. While DNS maps the name of the domain to the IP address, DHCP is a protocol that assigns the IP address to the host in a network either dynamically or statically.

Also as you have tried your laptop at other wifi connections without issue I would say your system is clean

does that make sense to you..?

Thanks,

Kevin

Link to post
Share on other sites

Hiya tuna2,

Thanks for the update, maybe adding those DhcpNameServer entries as exclusions to AdwCleaner is a better option. Instructions at following link:

https://support.malwarebytes.com/hc/en-us/articles/360038520154-Malwarebytes-AdwCleaner-Exclusions-setting

Continue to finish up;

Right click on FRST here: C:\Users\yuna_\Desktop\FRST.exe and rename uninstall.exe when complete right click on uninstall.exe and select "Run as Administrator"

If you do not see the .exe appended that is because file extensions are hidden, in that case just rename FRST to uninstall

That action will remove FRST and all created files and folders...

Next,

Condsider the following:

Disable Remote Desktop: https://www.tenforums.com/tutorials/92433-enable-disable-remote-desktop-connections-windows-10-pc.html

Disable Windows Telemetry: https://helpdeskgeek.com/windows-10/how-to-disable-windows-10-telemetry/

Malwarebytes Browser Guard (Free) for Firefox: https://addons.mozilla.org/en-GB/firefox/addon/malwarebytes/

Malwarebytes Browser Guard (Free) for Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee Will also work for Opera and Edge..

PatchMyPC, keep all your software upto date - https://patchmypc.com/home-updater#download

From there you should be good to go...

Next,

Read the following links to fully understand PC Security and Best Practices, you may find them useful....

Answers to Common Security Questions and best Practices

Do I need a Registry Cleaner?

Take care and surf safe

Kevin... user posted image
Link to post
Share on other sites

  • Root Admin

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.