Pup Files

ferretlady3 · Apr 29, 2017

Hi, I thought I was having some issues cuz it seemed my browser was coming up w/some 'warnings' to update either my Firefox with a new 'patch' (which I KNOW is a malware cuz it's not from Mozilla) but now it was also coming up w/some other crap (installing something to better my Facebook experience and a few other 'warnings' to install things). So I went to the READ ME post and ran all the programs as suggested (I've done this before over the yrs to fix stuff on either my PC or friends' PC's) but I see in MB log file it's showing a bunch of PUP files? I've attached the files for all the programs I ran as directed. Is there anything I should do to make my PC run better? It runs ok, but I know PUP files aren't good. I also see a bunch of PUM files too. I know how to get into the registry to delete the files, but I want to be sure it'll be ok before I do. I've done it before, but only on MJ's advice after running a few files that were given to me that wouldn't remove them. Any advice or are there files I should NOT remove?

TimW · Apr 30, 2017

Remove what ADWcleaner found. Then rerun Hitman and remove the two PUP's.

Now rerun Roguekiller and remove these items:

¤¤¤ Registry : 28 ¤¤¤
[PUP.Gen0] (X64) HKEY_CLASSES_ROOT\CLSID\{990F7D4F-09EF-47DF-9ABE-BAF2DCCF5C4B} ("C:\Program Files\Essentware\Common\AccountService.exe") -> Found
[PUP.Gen1] (X64) HKEY_LOCAL_MACHINE\Software\Essentware -> Found
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\csastats -> Found
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\Essentware -> Found
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\IM -> Found
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\ProductSetup -> Found
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\csastats -> Found
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\Essentware -> Found
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\IM -> Found
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\ProductSetup -> Found
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\Microsoft\Windows\CurrentVersion\Run | PCKeeperLive : "C:\Program Files\Essentware\PCKeeper\PCKeeper.exe" /autorun [x] -> Found
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\Microsoft\Windows\CurrentVersion\Run | PCKeeperLive : "C:\Program Files\Essentware\PCKeeper\PCKeeper.exe" /autorun [x] -> Found
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-ce99afda -> Found
[PUM.HomePage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-ce99afda -> Found
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-1009334687-539450264-314055710-1000\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found

¤¤¤ Files : 5 ¤¤¤
[PUP.Gen0|PUP.Gen1][Folder] C:\ProgramData\Essentware -> Found
[PUP.Gen1][Folder] C:\Users\ow\AppData\Local\Essentware -> Found
[PUP.Gen1][Folder] C:\Users\ow\AppData\Local\YSearchUtil -> Found
[PUP.Gen0|PUP.Gen1][Folder] C:\ProgramData\Essentware -> Found
[Hj.Shortcut][File] C:\$RECYCLE.BIN\S-1-5-21-1009334687-539450264-314055710-1000\$R58N1DK.lnk [LNK@] C:\PROGRA~2\INTERN~1\iexplore.exe http://www.weblinksdirect.com/?p=main -private -> Found

Reboot and rescan with both RogueKiller and Hitman and attach the new logs.

Then:

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista,Seven,Eight or 10, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

ferretlady3 · May 6, 2017

SOOOO sorry I didn't respond sooner! I was waiting for an email from my thread, but when nothing came, I logged on and found your instructions.

Here are the files per your instructions and THANK YOU for helping me!!

TimW · May 6, 2017

You're logs are clean......what malware issues are you still having?

ferretlady3 · May 7, 2017

Well, I started up my machine this morning and it's running GREAT! Seems everything I did fixed it. It was late last night when I finished running everything and sent the logs off to you so I wasn't sure as I still saw some files PUM files and 'suspicious' files in the Rogue Killer log.

Thank you SOOOOOOOOO much once again!! Now I need to fix my boyfriend's XP machine. I'll go thru the READ ME first files as I normally do!

TimW · May 7, 2017

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8 or 10, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

ferretlady3 · May 7, 2017

All done! Thanx!!!! I'm not really sure HOW I got malware as I'm VERY careful not to click or download stuff I don't know/recognize, but I guess it happens to all of us. I'm using ZoneAlarm Extreme Security but have been told Kaspersky is the best (?).

TimW · May 7, 2017

If you want guidance with a firewall, post in the software forum for advice.

Log in or Sign up

Pup Files

ferretlady3 Private E-2

Attached Files:

AdwCleaner[S3].txt

HitmanPro.log

MB.txt

MGlogs.zip

roguekiller.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

ferretlady3 Private E-2

Attached Files:

AdwCleaner[C2].txt

HitmanPro_20170506_2116.log

JRT.txt

RogueKiller.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

ferretlady3 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

ferretlady3 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Pup Files

ferretlady3 Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

ferretlady3 Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

ferretlady3 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

ferretlady3 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches