Windows 10: how to remove PUP.OptionalSearch.ShrtCln

W10 18363.535. Ran the AdwCleaner (latest update) today and it found " PUP.OptionalSearch.ShrtCln" was placed in quarantine, removed/reboot and upon re-scan it still remains. Programs that find it: ADWCleaner, MSRT. MSRT did not remove it or list it, just noted 2 items found. Not finding it: MWB Pro, Hitman, MS virus scan.

MWB forums show multiple problems/fixes with the sync in Chrome, I do not have Chrome installed. As a troubleshooting effort, I removed all search ( FF ) engines except Google. (MWB Forum suggestion)

:)

 

Overrun by PUP's


Hi, @Skofab:

A bit of clarification...
As the others have pointed out, MBAM Free is only a manual, on-demand scanner that removes PUPs and malware already on the system.
MBAM Premium -- when properly configured -- can help to PREVENT PUPs/malware infection in the first place.

PUPs are not malware, in the strict sense of the term, as explained HERE. But they are generally junk that one likely does not not need or want and they can eventually get one into trouble with real malware.

Having said that, scanning for ROOTKITS and scanning for PUPs/PUMs are actually different settings.
In order to be sure MBAM is properly configured, open the dashboard > settings > detection and protection > non-malware protection and verify that both PUPs and PUMs are set to "treat detections as malware".

If your settings are correct, but the PUPs seem to come back with each scan, then the most likely explanations include:

• MBAM is having trouble removing them for some reason; and/or
• They are re-spawning, either from software/malware on the system, from Google sync or from another source.

If you would like, please follow the steps in THIS TUTORIAL to locate, export and post here as an ATTACHMENT to your next reply an MBAM SCAN LOG from one of the computers. That log may point to an explanation and possible solution.

Thanks,
MM

 

Remove PUP application from DVD Drive (F CDROM


Here's a shorthand recap

Outstanding tasks:
HitmanPro - were the threats cleaned?
ESET online scan: running with auto set
Clean Boot
Reg key query
Bitdefender Rescue
TDSSKiller
Dism
SFC



Post# 1 Avast
Found a PUP
how-to-remove-driver-side-door-panel-150.ISO
The Holy Library
Holy.app
Holy.exe
8/3/2016
Post# 5 Downloads\how-to-remove-driver-side-door-panel-150.ISO
????? Avast msg says run Mnam?
Avast can not do anything, meaning "repair," "quarantine," or "delete,"
instead an "error" displays prompting me to run the Malwarebytes Anti-Malware scan ?????
Post# 7: Rkill log - No objects found to stop or kill


Post# 10 ISO deleted - in recycle bin
Myrna idenfies the downloader from us1 springfile org
mixed info on research - some malicious, some 1or 2 out of all AV products flagged it

AdwCleaner log - cleaned up minor PUPs
Post# 12 JRT & HitmanPro suggested

Post# 13 - eset online suggested

Post# 15 JRT log - nothing major

Post# 24
hitman results - no threats found
Threats detected 1,095 ?????
Post# 28 suggest Mbam

Post# 32 ESET online hangs at end

Post# 35 Mbam finds Trojan.Poweliks.B in HKU\S-1-5-21

Post# 36 Mbam log two threats quarantined

Post# 37
suggest remove the two threats
suggest TDSSkiller
Post# 38 suggest How to remove the Poweliks Trojan (Removal Guide)

Post# 39 starts ReImage debacle form ad on sevenForums

Post# 49 Avast flags Poweliks guide on bleeping

Post# 50
suggest Rkill and HitmanPro from the guide
follow up with Dism & SFC
Post# 52 correction
suggest Rkill, ESET Poweliks Cleaner, and HitmanPro from the guide

Post# 60 Rkill log
Terminates 1 process
* C:\Users\MyrnaZ\AppData\Local\Temp\{7E6122F0-DB5E-430A-A6AE-6F73E75D1A32}\{BCCE466F-5194-418B-B7A4-55A77A6E62F6}.exe (PID: 16284) [T-HEUR]
This was not found in the first Rkill. Probably belongs to ReImage
Post# 63 ESET Poweliks log - threat not found

Post# 71
suggest Clean boot
Rkill
Hitman
Post# 72
suggest TDSSkiller
Bitdefender Rescue
check reg for Poweliks keys
Post# 73 Hitman log
Were they cleaned or is that just what was found?
Post# 76 suggest ESET online scanner with autoclean set

 

Overrun by PUP's


Hi:

Just to be clear, the ROOTKIT scanning setting in MBAM is separate and different from the PUP/PUM settings.
It's certainly fine to enable the anti-rootkit feature, but it's not likely to directly impact the behavior you reported in your original post (recurring PUPs in sequential MBAM scans).
Adding MBAE (Free or Premium) is another fine suggestion, but it won't fix your original issue, either.

To more directly fix that particular problem, it would help to know if your PUP/PUM settings in MBAM are correctly configured, as suggested in my earlier reply #4 here.
And, yes, the partial AdwCleaner log suggests that the PUPs are likely re-spawning from Google sync/Chrome/a Chrome extension.
But it would also help to see the MBAM scan log, as previously suggested.

>>Some PUPs (and some malware) can be rather pesky, requiring the use of multiple, powerful tools, in the correct sequence, as well as other interventions (e.g. resetting/reinstalling Chrome), for complete removal.

HTH,
MM