Persistent PUP.Optional.Legacy with Total AV windows popup ads

[Xanith]

I have been trying to get rid of this PUP for about 3 hours now, no matter what I do it will not go away. Every time I try to remove it, it comes back on ADW scan. It constantly gives me windows notifications with a link to Total AV.

 

I'm not sure how to get rid of this, any help would be appreciated

[Xanith]

I have seen a couple other post fAdwCleaner[C26].txtrom people with similar issues and they asked for files from MWB adwCleaner and FRST. I have attached mine below if needed.

MWBscanlog.txt FRST.txt Addition.txt

[AdvancedSetup]

Hello @Xanith and

Please do the following and we'll see about getting you fixed up 😃

The Farbar Recovery Scan Tool is a free Windows utility designed to create troubleshooting logs for your computer. These logs help our Support team to identify and resolve issues with your computer.

There are two versions of the Farbar Recovery Scan Tool available for download: 32-bit and 64-bit.
To find which operating system is installed on your computer, refer to Microsoft's article: 32-bit and 64-bit Windows: Frequently asked questions

Download and launch Farbar Recovery Scan Tool

1. Download the Farbar Recovery Scan Tool
   Do not click on any Ads.
    
2. Locate the file you downloaded on your computer.
   Downloaded files are often saved to the Downloads folder.
    
3. Double-click the downloaded file to run the Farbar Recovery Scan Tool.
   
   
    
4. A Windows protected your PC notification may appear. This notification is from the Windows Defender SmartScreen Filter which prevents unfamiliar apps from running on your PC.
   Disable smart screen ONLY if it interferes with software we may have to use:  What is SmartScreen and how can it help protect me?
   
        a.  Click More info.
   
   
        b.  Click Run anyway.
   
   
5. When the User Account Control window appears, click Yes.
   
   
   
    
6. To accept the Disclaimer of warranty, click Yes.
   
   
   
    
7. Ensure only the boxes listed below are checked
   
   

   Registry  Services  Drivers
   Processes  Internet  One month
   Addition.txt
   
   
   
    

8. Disable any Antivirus software you have installed ONLY if it stops software we may use from working.
   Please remember to re-enable any Antivirus software when we are finished running scans
   
   Click Scan. The scan may take a few minutes to complete.
   
   
    

9. When the scan completes, Farbar Recovery Scan Tool shows two messages:

• Scan completed. FRST.txt is saved in the same directory FRST is located.
  
  

• Addition.txt is saved in the same directory FRST is located.
  
  
   

• Click OK to close each message window

 

Please attach both of those logs on your next reply, DO NOT copy/paste the contents of the logs directly

 

 

It's quite late for me so I may be away by the time you're done but I'll check back on you in the morning

Thank you

 

 

 

[AdvancedSetup]

Okay, I see we were both posting at the same time. I see your logs now. Let me review them and get back to you in a few.

 

[AdvancedSetup]

Why do you have a downloaded file set to run on Startup?

HKU\S-1-5-21-3846563935-1855506986-2465769798-1001\...\Run: [{657E5009-3D96-41DA-BDD9-36113EE99AE3}] => C:\Users\Jonathan\Downloads\ProtonVPN_win_v1.22.2.exe [24023256 2021-09-17] (Proton Technologies AG -> Proton Technologies AG) <==== ATTENTION

If you're using Proton VPN it should be installed and use that, not a link to a downloaded installer.

Where are you seeing this these popups? Can you show me a screenshot please.

 

[AdvancedSetup]

I'll be back in a few. Please respond, reply per my questions above.

Thanks

 

[Xanith]

I am not sure why that is there. I did not put it there but I did download protonVPN intentionally. I've been trying to get a popup since you sent your last response but I haven't gotten one. The PUP still shows up on adwCleaner though. I will send a screenshot if it pops up again.

[AdvancedSetup]

Okay I'll check back on you in the morning. The logs are not showing anything obvious to cause an issue.

Is the alert or pop-up in a web browser or in Malwarebytes? How did you become aware of it?

I'm heading out now but will check again in the morning

Goodnight

 

 

[Xanith]

The alert is a Microsoft notification that shows up on the desktop. I was redirected to a fishy website and I decided to run a scan to make sure there was nothing malicious on the website. 

 

Doing some more testing, I have determined that the PUP is liked to my google account. Uninstalling chrome fully does not cause the PUP to be detected, however as soon as I sync my google account back to chrome the PUP returns.

[Xanith]

I belive I have fixed the issue. I no longer get the detection after multiple PC resets. The solution for me, if you ever encounter this issue again, was that I restored my chrome account setting to the original defaults and that fixed the issue. 

Thanks for all the help!

[AdvancedSetup]

Yes, that is what I was wanting to see. We do have an article on cleaning Google Chrome but looks like  you got it figured out already.

 

Please follow the directions from the following topic and let us know if that corrects the issue for you.

 

Please let me know if there is anything else we can assist you with.

Thank you

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you