Intrilo Posted July 31, 2023 ID:1580208 Share Posted July 31, 2023 Hello, so AdwCleaner have been detecting a PUP.Optional.Legacy everytime I've been scanning from a folder called "Packer" located at "C:\ProgramData\Packer" even if the folder is empty. As far as I know it's been ignoring the file in it and only alerts about the folder itself, originally it was a file called something like "captcha.bin" in it and that file and the folder randomly pops up time to time, and I'm not sure yet which program that keeps adding it back. Is this something to worry about or is this a false positive flag? My PC is just a week old and I have only downloaded trusted programs and games as well as ASUS Armoury Crate. Both Malwarebytes and Windows Defender shows that my PC is clean when I virus scan it so idk Thanks in advanced!! Link to post Share on other sites More sharing options...
Intrilo Posted July 31, 2023 Author ID:1580210 Share Posted July 31, 2023 Here is the AdwCleaner log # ------------------------------- # Malwarebytes AdwCleaner 8.4.0.0 # ------------------------------- # Build: 08-30-2022 # Database: 2023-07-19.3 (Cloud) # Support: https://www.malwarebytes.com/support # # ------------------------------- # Mode: Scan # ------------------------------- # Start: 07-31-2023 # Duration: 00:00:02 # OS: Windows 11 (Build 22621.2070) # Scanned: 32105 # Detected: 1 ***** [ Services ] ***** No malicious services found. ***** [ Folders ] ***** PUP.Optional.Legacy C:\ProgramData\Packer ***** [ Files ] ***** No malicious files found. ***** [ DLL ] ***** No malicious DLLs found. ***** [ WMI ] ***** No malicious WMI found. ***** [ Shortcuts ] ***** No malicious shortcuts found. ***** [ Tasks ] ***** No malicious tasks found. ***** [ Registry ] ***** No malicious registry entries found. ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries found. ***** [ Chromium URLs ] ***** No malicious Chromium URLs found. ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries found. ***** [ Firefox URLs ] ***** No malicious Firefox URLs found. ***** [ Hosts File Entries ] ***** No malicious hosts file entries found. ***** [ Preinstalled Software ] ***** No Preinstalled Software found. AdwCleaner[S00].txt - [1420 octets] - [15/07/2023 02:02:33] AdwCleaner[S01].txt - [1481 octets] - [15/07/2023 07:38:03] AdwCleaner[S02].txt - [1542 octets] - [16/07/2023 07:24:16] AdwCleaner[S03].txt - [1603 octets] - [17/07/2023 15:36:06] AdwCleaner[S04].txt - [1664 octets] - [18/07/2023 02:00:41] AdwCleaner[S05].txt - [1725 octets] - [18/07/2023 06:53:28] AdwCleaner[S06].txt - [1786 octets] - [19/07/2023 02:30:57] AdwCleaner[S07].txt - [1847 octets] - [20/07/2023 04:22:42] AdwCleaner[S08].txt - [1908 octets] - [20/07/2023 06:56:02] AdwCleaner[S09].txt - [1969 octets] - [23/07/2023 22:19:17] AdwCleaner[S10].txt - [2030 octets] - [24/07/2023 03:46:51] AdwCleaner[S11].txt - [2091 octets] - [25/07/2023 03:45:07] AdwCleaner[S12].txt - [2152 octets] - [26/07/2023 08:20:15] AdwCleaner[S13].txt - [2239 octets] - [27/07/2023 21:15:49] AdwCleaner[C13].txt - [2409 octets] - [27/07/2023 21:36:49] AdwCleaner[S14].txt - [2335 octets] - [27/07/2023 21:41:09] AdwCleaner[S15].txt - [2422 octets] - [28/07/2023 04:00:31] AdwCleaner[S16].txt - [2483 octets] - [28/07/2023 04:06:17] AdwCleaner[S17].txt - [2518 octets] - [28/07/2023 04:07:02] AdwCleaner[S18].txt - [2579 octets] - [28/07/2023 04:08:45] AdwCleaner[S19].txt - [2640 octets] - [28/07/2023 04:42:04] AdwCleaner[S20].txt - [2701 octets] - [28/07/2023 18:08:32] AdwCleaner[S21].txt - [2788 octets] - [29/07/2023 03:46:48] AdwCleaner[C21].txt - [2958 octets] - [29/07/2023 03:50:29] AdwCleaner[S22].txt - [2884 octets] - [29/07/2023 03:50:35] AdwCleaner[S23].txt - [2945 octets] - [29/07/2023 03:51:41] AdwCleaner[S24].txt - [3006 octets] - [29/07/2023 03:52:38] AdwCleaner[S25].txt - [3067 octets] - [29/07/2023 07:38:19] AdwCleaner[S26].txt - [3128 octets] - [29/07/2023 08:02:31] AdwCleaner[S27].txt - [3215 octets] - [30/07/2023 02:56:16] AdwCleaner[S28].txt - [3250 octets] - [30/07/2023 02:58:55] AdwCleaner[S29].txt - [3311 octets] - [30/07/2023 03:09:08] AdwCleaner[S30].txt - [3372 octets] - [30/07/2023 05:15:07] AdwCleaner[S31].txt - [3433 octets] - [30/07/2023 07:35:59] AdwCleaner[S32].txt - [3494 octets] - [30/07/2023 08:09:05] AdwCleaner[S33].txt - [3581 octets] - [30/07/2023 22:34:49] AdwCleaner[S34].txt - [3642 octets] - [31/07/2023 04:25:47] AdwCleaner[S35].txt - [3677 octets] - [31/07/2023 04:26:17] AdwCleaner[S36].txt - [3764 octets] - [31/07/2023 04:26:28] AdwCleaner[S37].txt - [3799 octets] - [31/07/2023 04:41:53] ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S38].txt ########## Link to post Share on other sites More sharing options...
Porthos Posted July 31, 2023 ID:1580212 Share Posted July 31, 2023 @Intrilo Please do the following so that we may take a closer look at your system. WARNING: Do Not click the Repair System under Advanced unless requested by a Malwarebytes support agent or authorized helper NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download the Malwarebytes Support Tool In your Downloads folder, open the mb-support-x.x.x.xxx.exe file In the User Account Control pop-up window, click Yes to continue the installation Run the MBST Support Tool In the left navigation pane of the Malwarebytes Support Tool, click Advanced In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply Thank you 1 Link to post Share on other sites More sharing options...
Intrilo Posted July 31, 2023 Author ID:1580215 Share Posted July 31, 2023 (edited) Hello thanks for the quick answer, here are the result Edited July 31, 2023 by AdvancedSetup Log removed per request Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 31, 2023 Root Admin ID:1580291 Share Posted July 31, 2023 Hello @Intrilo Is the folder not actually being removed or is the folder being recreated by some process? Link to post Share on other sites More sharing options...
Intrilo Posted July 31, 2023 Author ID:1580293 Share Posted July 31, 2023 1 minute ago, AdvancedSetup said: Hello @Intrilo Is the folder not actually being removed or is the folder being recreated by some process? The folder is getting removed but once every other day or so it's being recreated with the catache.bin(around 500kb) file in it First I thought it was related to Asus Armoury Crate because the first time i removed it the program stopped working and I had to reinstall it but now I have uninstalled it because it was giving me other problems and the map and the file in it still pops up every other day or so, but it is only the map it detecs not the file itself thats in it Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 31, 2023 Root Admin ID:1580298 Share Posted July 31, 2023 Once the file is in there can you zip it and attach for review? That is not an OEM folder I've heard of before. Let's go ahead and scan with some other scanners to double-check Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop. (Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021) Download: Kaspersky Virus Removal Tool https://devbuilds.s.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe How to run a scan with Kaspersky Virus Removal Tool 2020https://support.kaspersky.com/15674 How to run Kaspersky Virus Removal Tool 2020 in the advanced modehttps://support.kaspersky.com/15680 How to restore a file removed during Kaspersky Virus Removal Tool 2020 scanhttps://support.kaspersky.com/15681 Select the Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt Note the space between KVRT.exe and -dontencryptC:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box. That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply. To start the scan select OK in the "Run" box. A EULA window will open, tick all confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed... Thank you Link to post Share on other sites More sharing options...
Rago Posted August 1, 2023 ID:1580626 Share Posted August 1, 2023 (edited) So, was this something to worry about or a false positive flag ? Edited August 1, 2023 by AdvancedSetup Corrected font issue Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 1, 2023 Root Admin ID:1580637 Share Posted August 1, 2023 1 hour ago, Rago said: So, was this something to worry about or a false positive flag ? I don't have an official reply yet but I believe it is a False Positive at this time. Link to post Share on other sites More sharing options...
Rago Posted August 1, 2023 ID:1580642 Share Posted August 1, 2023 ok, thank you boss ! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 1, 2023 Root Admin ID:1580650 Share Posted August 1, 2023 I will go ahead and close this topic now. This was officially confirmed a False Positive by the Research team. 1 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 1, 2023 Root Admin ID:1580651 Share Posted August 1, 2023 Since this issue is resolved the topic will now be closed to prevent others from posting here. If you need assistance please start your own new topic and someone will be happy to assist you. Thanks 1 Link to post Share on other sites More sharing options...
Recommended Posts