Cant remove PUP.Optional.Eaburl 2022

[kip123ca]

I found this same issue in a thread from 2019...but the link to the Malwarebyte removal instructions is no longer valid.

I downloaded the program Farbar and ran it in admin mode.  I also reset Google per instructions.  No change.  Thank you.

Addition.txt FRST.txt

[Maurice Naggar]

Hello @kip123ca    Weclome aboard.   

My name is Maurice.  I will guide you.  It may well be that we will need to do multiple passes, with different tools.  Patience is key. Thank you so much for attaching the FRST reports. 

Do a new scan with Malwarebytes for Windows.

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Let me know how that goes.    Next, the Malwarebytes scan.

Then click the Security tab.  Scroll down and lets be sure the line in SCAN OPTIONs for

"Scan for rootkits" is ON 👈   Click it to get it ON if it does not show a blue-color .

 

Next, click the small x on the Settings line to go to the main Malwarebytes Window.   Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

 

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

😉

[kip123ca]

Hi Maurice. See scan report attached.

2022-01-28_Scan.txt

[Maurice Naggar]

That is much better.  This run with Malwarebytes for Windows has removed a extension on the Chrome browser. Hopefully, that action quashes the P U P.  What follows should only take a few minutes. 

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it

https://support.malwarebytes.com/hc/en-us/articles/360038520054-Download-and-install-Malwarebytes-AdwCleaner

 

Then be sure to close all web browsers.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

https://support.malwarebytes.com/hc/en-us/articles/360038520114-Malwarebytes-AdwCleaner-scan-and-clean

Attach the clean log.

[kip123ca]

Attached the clean log from AdwCleaner.  THank you.

AdwCleaner[S01].txt

[kip123ca]

Previous scan was with web browers open.  Re-cleaned with no web browser open.

AdwCleaner[S02].txt

[Maurice Naggar]

Next, a couple of housekeeping & safety issues. 1) Adobe Flash PLayer is entirely obsolete & no longer advisable. Please uninstall Adobe Flash Player 32 PPAPI .
1. Press & hold  the Windows key on keyboard & then tap the R key   to open the Run box-window.
2. Type

appwiz.cpl

and tap Enter.
The Programs and Features window will appear.   Locate on the list "Adobe Flash Player 32 PPAPI".

Do a right-click on it.  Then choose Uninstall.   Let it proceed.

Exit Programs and Features, when done.
^
Next, take action to enable Windows System Restore feature.
Look at OPTION TWO.  Do steps 2,  then 4, 5, 6, 7  of this Tenforums article
https://www.tenforums.com/tutorials/175367-how-enable-disable-system-restore-configuration-windows.html

Edited January 29, 2022 by Maurice Naggar
edit gor second part

[kip123ca]

Thank you, Maurice

completed housekeeping steps.

[Maurice Naggar]

Hello.  Good to hear from you.    

Next, a custom script to do  checks & some  cleanups. There is a Edge browser auto-start that needs removal.

We will use FRST64.exe  on the Desktop\FRST-OlderVersion  folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Kip123ca  only / for this machine only.

 

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .  It will run the Windows DISM tool to check the system.  It will rebuild the Winsock.  

NOTE-2: As part of run it will remove the cache on Edge browser & Chrome browser.  It will gather status readout on some Windows services, so I can review & to help you along.

• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   user Desktop\FRST-OlderVersion  folder

Fixlist.txt                <<< - - - - -

Then, Start the Windows Explorer and then, go  to the  Desktop\FRST-OlderVersion   folder.

RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.  This here is not a one-shot-cure-all.  There will be more to do later.  

[kip123ca]

Thanks, Maurice.  Will get this process started.

[kip123ca]

Good Morning, Maurice

I let it run after hours...... see Fixlog below.  Thank you.

Fixlog.txt

[Maurice Naggar]

Alright. Thanks. Tell me, please, is there as of today, any new notices about PUP.optional ?  How is the situation ?

[kip123ca]

No...I think we are clear.  Attached lastest scan log.  Thank you.

 

2022-02-04_Scan.txt

[Maurice Naggar]

alright. Very good.     We are almost ready to wrap-up.   

•  I would recommend getting a readout report as to update status of some key apps.
• Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe

 

• and save the tool on the desktop.
• If Windows's  SmartScreen block that with a message-window, then
• Click on the MORE INFO spot and over-ride that and allow it to proceed.

                               This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

Also, be sure to make a run to Microsoft Windows Update to be sure this system is all up-to-date with security & critical updates & latest Cumulative updates.

Edited February 4, 2022 by Maurice Naggar

[kip123ca]

HOw long does it take to run?  After typing Yes to run...it see a 1 second scrolling circle that disappears.....and then nothing

[Maurice Naggar]

A few minutes to do its work.  I had not timed it myself.  But give it another 10 minutes or so.

[Maurice Naggar]

It ought to have finished by now. otherwise, perhaps a window got put behind another one. If so, press & hold the ALT-key on keyboard & tap the TAB key to see active windows screens.

[kip123ca]

no...I closed all windows down to the desktop previously....nothing.   Also no 'securitycheck.txt. anywhere.  Searched for it in file explorer

[kip123ca]

Re-downloaded it from "bleepign computer"  - that seemed to work....see log attached.

checkup.txt

[Maurice Naggar]

This report is OK ....but it is not the "Securitycheck" by Glax24.  The name is similar, but what you ran is not the one I was looking for.  Lets just skip the request & just go forward with tools cleanup.

Let's go ahead and do some clean-up work and remove the tools and logs we've run.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt.
• You may attach that file to your next reply. (not compulsory)

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you