2 PUPS

[peterr]

When I run MBAM I get the same PUPS.
When they are quarantined and deleted why do I keep getting them back?
What would you advise so my scans are s clean as before. I don't just want to accept them unless I have to.

 

[Tony D]

What PUPs are you getting?
Please post the MBAM log.

Quoting Starbuck.........

To find the reports

• From the main Dashboard click Reports (left hand side)
• Double click on the scan log which shows the Date and time of the scan that showed the infections.
• Click Export >> Copy to Clipboard
• Paste the contents of the clipboard into your reply.

.

 

[peterr]

I copied to clipboard but after selecting all and copying it would not paste here. I attached the file it exported.
Should I try again?

 

[Tony D]

PUP.Optional.Conduit, C:\USERS\PRIME\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\Web Data, No Action By User, [579], [454832],1.0.3263
PUP.Optional.Conduit, C:\USERS\PRIME\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\Web Data, No Action By User, [579], [454832],1.0.3263

You see where is says No Action By User? That indicates that you didn't choose the option to quarantine or delete the items.
Run the scan again and when it's done, ensure there are checkmarks next to those items. Then look to the bottom of the screen and choose Quarantine. If Quarantine is not available, choose Delete.

(I'm writing this from memory. Actual procedure may be different, but similar)

 

[peterr]

I have deleted each of about 12 times but forgot this one. Thank you. Do you need more to solve how I can deal with those two persistent PUPS?

 

[Tony D]

Let's try one more thing before moving this thread to the expert.

Again quoting Starbuck ....

Please download AdwCleaner onto your desktop.

• Close all open programs and internet browsers.
• Double click on adwcleaner.exe to run the tool.
  Vista/Windows 7/8/10 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin to scan your computer.
• After the scan has finished...
• Click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.

 

[peterr]

# AdwCleaner 7.0.4.0 - Logfile created on Wed Nov 15 16:07:15 2017
# Updated on 2017/27/10 by Malwarebytes
# Running on Windows 10 Pro (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

SearchProvider deleted: Conduit Search - conduit.search


*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [1127 B] - [2017/11/13 18:59:11]
C:/AdwCleaner/AdwCleaner[S1].txt - [1196 B] - [2017/11/15 16:1:44]


########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

>>Should I clean out the ADWCLEANER folder?

 

[Tony D]

SearchProvider deleted: Conduit Search - conduit.search

That's good.

Restart and run MBAM. See if it still finds Conduit Search.

 

[peterr]

They are still there.

 

[starbuck]

As those entries relate to Google Chrome, run a reset.

To reset Google Chrome

• Click the Menu option button at the top right of the Google Chrome screen
• Select Settings.
  
  
  
  
  
• Click Show advanced settings and find the "Reset browser settings” section.
  
  
  
  
  
• Click Reset browser settings.
  
  
  
  
  
• In the dialogue that appears, click Reset. Note: When the "Help make Google Chrome better by reporting the current settings" tick box is selected you are anonymously sending Google your Chrome settings. Reporting these settings allows us to analyse trends and work to prevent future unwanted settings changes.

Resetting your browser settings will impact the settings below:

Default search engine and saved search engines will be reset and to their original defaults.
Homepage button will be hidden and the URL that you previously set will be removed.
Default startup tabs will be cleared. The browser will show a new tab when you startup or continue where you left off if you're on a Chromebook.
New Tab page will be empty unless you have a version of Chrome with an extension that controls it. In that case your page may be preserved.
Pinned tabs will be unpinned.
Content settings will be cleared and reset to their installation defaults.
Cookies and site data will be cleared.
Extensions and themes will be disabled.

 

[peterr]

I did reset Chrome but the two PUPS I showed you are still there after quarantine,removal and reboot.
I only have 2 extensions enabled which I have always had.
Any ideas?

 

[Tony D]

What are the extensions?

 

[peterr]

The last scan was done with Docs enabled.

It happens in heuristics.

 

[Tony D]

What are the extensions you referenced in post #11?

 

[peterr]

I think Docs and a red and white icon for sending a page to someone I got from the web store. It is disabled but the same two pups pop up.
Reinstall Chrome and if so, how?

 

[Tony D]

To reinstall Chrome, go to the Control Panel and select Programs and Features. Or in Windows 10 you can go to the Start menu / Settings / System and select Apps & Features. Select Chrome and then click on uninstall.

Restart the computer.

Download and install Chrome from https://www.google.com/chrome/

 

[peterr]

So you agree this is the next step to use?

 

[Tony D]

I'd like to know what the two extensions are that you refer to. Those extensions should have been disabled when you reset Chrome. Are you sure they are still enabled? If they are, then you didn't reset Chrome properly or there is something that is enabling these extensions. If that's the case, then there is malware on your computer and it needs the help of an expert.

For expert malware removal help, go to this forum https://freepchelp.forum/f/24/
Here are instructions for posting. This requires you to install and run a few programs which give our expert an insight into the bowels of your computer. https://freepchelp.forum/t/200448/

Alternately, you can reinstall Chrome and see if the problem persists. If it does, post per my previous paragraph.

 

[peterr]

All extensions were disabled before the reset of both my desktop and my wife's chromebook.
I have written to the expert forum you gave me with the appropriate scan results.
I would be stuck without your kind help and I wish to thank you.