Jump to content

Adwcleaner PUP.Optional.Legacy & PUP.Optional.MySearch w/ Chrome sync on.


Go to solution Solved by Rick432,

Recommended Posts

If I run Chrome, Adwcleaner flags PUP.Optional.Legacy and PUP.Optional.MySearch recurrently. After quarantine, Chrome still demonstrates it upon Adwcleaner rescans, unless sync gets turned off within Chrome, and then the PUPs get quarantined under Adwcleaner.

Then if I run Chrome without sync enabled, opening Chrome then closing it, running Adwcleaner maintains clean.

 

But once I sync, then open Chrome even momentarily, close Chrome, run Adwcleaner, I always get PUP.Optional.Legacy and PUP.Optional.MySearch flags (which I quarantine subsequently, but they return immediately upon reopening Chrome browser (when sync is turned back on/logged on)). One time I even additionally triggered PUP.Optional.TheBrightTag flag as well, but that hasn't repeated.

Otherwise virus scans (including Malwarebytes, Windows Defender, Sophos, RogueKiller) not consistently demonstrating anything except occassional Trojan (quarantined at time of discovery, no type seen recurrently, and none actively. System otherwise thoroughly custom scanning clean). FRST64 also clean without generating recommended fix list.

Thanks in advance for any advice.

Attached are FRST64 logs CleanFRST.txt and CleanAddition.txt, results of FRST64 scan without Chrome Synch enabled and no detections with Adwcleaner. Also Adwcleaner log CleanAdwCleaner[S35] from clean scan without Chrome Synch enabled.

Attached also are FRST64 logs SyncFRST.txt and SyncAddition.txt, results of FRST46 scan with Chrome Synch enabled and Adwcleaner detecting PUP.Optional.Legacy and PUP.Optional.MySearch but not yet quarantined by time of FRST64 scan. Also Adwcleaner log SyncAdwCleaner[S52] from scan detecting and quarantining the PUPs.

 

 

SyncAdwCleaner[S52].txt SyncFRST.txt CleanAddition.txt CleanAdwCleaner[S35].txt CleanFRST.txt SyncAddition.txt

Link to post
Share on other sites

Hello @Rick432 and :welcome::

While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility, or its subsets, please carefully follow these instructions:

  1. Download the Malwarebytes Support Tool.
  2. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file.
  3. In the User Account Control (UAC) pop-up window, click Yes to continue the installation.
  4. Run the MBST Support Tool.
  5. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
  6. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer.  WARNING: Do Not click the Repair System under Advanced unless requested to by a Malwarebytes support agent or authorized helper.
  7. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. Please do NOT copy and paste.

For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have posted.

Thank you.

Link to post
Share on other sites

  • Root Admin

Hello  and  :welcome:    @Rick432

 

My screen name is AdvancedSetup and I will assist you with your system issues.
 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

  • Please follow all steps in the provided order and post back all requested logs
  • Please attach all log files to your post, unless otherwise requested
  • Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans have been completed.
  • Temporarily disable Microsoft SmartScreen to download the software below if needed. Make sure to turn it back on once the scans are completed.
  • Searching, detecting, and removing malware isn't instantaneous and there is no guarantee to repair every system.
  • Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
  • Do not run online games while the case is ongoing. Do not do any free-wheeling or risky web-surfing.
  • Only run the tools I guide you to use. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Cracked, Hacked, or Pirated programs are not only illegal but also can make a computer a malware victim.
  • Having such programs installed is the easiest way to get infected. It is the leading cause of ransomware encryption. It is at times also a big source of current Trojan infections.
  • If there are any on the system you should uninstall them before we proceed.
  • Please be patient and stick with me until I give you the "all clear". We don't want to waste your time, please don't waste ours.
  • If your system is running Discord, please be sure to Exit it while this case is ongoing.

 

 

Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop.

(Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021)

Download: Kaspersky Virus Removal Tool

https://devbuilds.s.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe

How to run a scan with Kaspersky Virus Removal Tool 2020
https://support.kaspersky.com/15674

How to run Kaspersky Virus Removal Tool 2020 in the advanced mode
https://support.kaspersky.com/15680

How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan
https://support.kaspersky.com/15681

 


Select the  image.png  Windows Key and R Key together, the "Run" box should open.

user posted image

Drag and Drop KVRT.exe into the Run Box.

user posted image

C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box.

image.png

add -dontencrypt   Note the space between KVRT.exe and -dontencrypt

C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box.
 
image.png


That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file.

Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr
Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply.

To start the scan select OK in the "Run" box.

A EULA window will open, tick all confirmation boxes then select "Accept"

image.png

In the new window select "Change Parameters"

image.png

In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start...

user posted image

When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue"

user posted image

When complete, or if nothing was found select "Close"

image.png

Attach the report information as previously instructed...
 
Thank you
 
 

 

 

Link to post
Share on other sites

I ran the Kaspersky Virus Removal Tool after disabling MalwareBytes and RogueKiller. Full disclosure: I neglected to turn off Real-time protection from Windows Security until nearly 6 hours into the scan, which ran 7h42m long. The PC was otherwise unused except for what I am typing now. Chrome open, Sync enabled, but extensions all off, still flagging the PUPs via adwcleaner as of prior to the Kaspersky scan.

The scan found 5 items, all of which I think are likely red herrings, but deleted as instructed regardless (none of it essential items at all). The report as instructed is attached.

 

Turning Windows Real-Time protection back on as per instructions. Otherwise not using this PC.

 

 

report_2023.08.31_12.08.50.klr.txt

Link to post
Share on other sites

  • Solution

Update: I'm an idiot.

So after the long Kaspersky scan yielded 5 results (which I deleted but think they are false positives due to history of them being triggered by virus scanners in the past), I reran adwcleaner.exe to confirm that I would still get the alerts PUP.Optional.Legacy and PUP.Optional.MySearch. They were still there, but this time I noticed the icon next to the alerts to give more details identifying the location involving Chrome Startup. I went to Chrome Settings > On Startup > Tagged the "Open a Specific page or set of pages" button (it had been on "Continue where you left off") > got to the menu where you choose what specific pages you want. And there was the "MySearch" two startup pages setup. I deleted those entries in that menu, gradually reenabled the extensions, and confirmed that the adwcleaner scan no longer picks up the PUPs.

Regardless, thank you for the thorough cleaning guidance, AdvancedSetup. Things seem to be running smoothly. I'll periodically recheck and come back here if this comes back.

 

Solved.

Link to post
Share on other sites

  • Root Admin

Good detective work @Rick432

We do have an extensive article on cleaning up Google Chrome (though for your own privacy using Firefox would be a better choice)

 

 

Please follow the directions from the following topic for a more extensive article on cleaning Google Chrome

Resetting Google Chrome to clear unexpected issues
 

Thank you

 

Link to post
Share on other sites

  • 2 weeks later...

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.