Need help removing PUP.Optional.22ChromeEXT

[Altair79]

So I get this PUP.Optional.22ChromeEXT malware when I run Adwcleaner. I can quarantine it but it doesn't show up in the quarantine list to remove.

I can't find it in the Chrome extensions. Really want to get rid of this...it keeps coming back every day even if I don't restart Chrome and it really bogs down my Disk%

Thanks

[MKDB]

Hello @Altair79 and

 

My name is MKDB and I will assist you.

 

• Please follow the steps in the given order and post back the logs as an attachment when ready. Thank you very much for your cooperation.
• Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
• Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
• As English is not my native language, please do not use slang or idoms. It may be hard for me to understand.

 

 

Step 1

• If you already have Malwarebytes installed, then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed or if you don't run the newest version yet, please download it from here and install it.
• Once the MBAM dashboard opens, click on Settings (gear icon).
• Click on Security tab and make sure that all four Scan options are enabled.
• Close Settings and click on the Scan button on the dashboard.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT button and save the file as a Text file to your desktop.
• If there were detections then once the quarantine has completed click on the View report button, then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run, then please skip to the next step and let me know in your next reply that the scanner would not run.

 

 

 

Step 2

Please download AdwCleaner and save it to your desktop.

• Double-click to run it.
• Accept the End User License Agreement.
• Click Scan Now.
• When finished, if items are found please click Next / Quarantine.
• Maybe your PC will be rebooted, AdwCleaner will be opened automatically.
• Click View Log File.
• AdwCleaner will open one log (AdwCleaner[Cxx].txt).
• Please attach the log to your next reply.

 

 

 

Step 3

Please download the suitable version of Farbar Recovery Scan Tool (FRST) and save it to your desktop: 32bit | 64bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Check the box in front of Shortcut.txt.
• Press the Scan button.
• FRST will create three logs (FRST.txt + Addition.txt + Shortcut.txt) in the same directory the tool is run.
• Please attach these logfiles to your next reply.

 

Thank you in advance!

[Altair79]

Hello, here are the requested files

AdwCleaner[S51].txt FRST.txt malwarebytes scan.txt Shortcut.txt Addition.txt

[MKDB]

Thanks for those logfiles.

 

 

Step 1

• Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( C:\Users\Benjamin Turzynski\Downloads ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

• Close all open programs and save your work.
• Run FRST again.
• Press the Fix button only once and wait. Please be patient.
• If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
• FRST will create one log now (Fixlog.txt) in the same directory the tool is run.
• Please attach this logfile to your next reply.

 

 

 

Step 2

Please follow these two instructions and reboot your system:

https://forums.malwarebytes.com/topic/258886-chrome-secure-preferences-detection-always-returns/

https://support.google.com/chromebook/answer/3296214?hl=en

 

 

 

Step 3

• Run FRST again.
• Do not change any settings.
• Press the Scan button.
• FRST will create two logs now (FRST.txt + Addition.txt) in the same directory the tool is run.
• Please attach these logfiles to your next reply.

 

 

fixlist.txt

Edited November 8, 2021 by MKDB

[Altair79]

Here you go

Addition.txt FRST.txt

[Altair79]

Fixlog.txt

[Altair79]

Just to follow up, adwcleaner is still finding it when I scan

[MKDB]

Thanks for those logfiles.

Did you follow Step 2 (resetting chrome and clear sync)? Usually that fixes almost all problems.

Can you post me the scan logfile from AdwCleaner, please? It should be located unter C:\AdwCleaner\Logs\AdwCleaner[Sxx].txt. (xx = serial number).

 

[Altair79]

Okay I forgot to do the clear sync. So far, it hasn't come back. I'll check back in with you if it does.

Thanks.

[MKDB]

If it doesn't come back, then we're done @Altair79. Thank you for your cooperation.

 

Step 1

• Right-Click on FRST64 and choose Rename.
• Rename FRST64 into Uninstall.
• Run Uninstall.
• FRST and it’s files/folders will be deleted.
• If the tool needs a restart, please make sure you let the system restarts normally.

 

 

 

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection.

Thank you.

Edited November 10, 2021 by MKDB

[MKDB]

As this topic seems to be solved, I do not follow it any longer.

Take care!

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you