Solved Hi, I need assistance for removing a PUP

[Tagglink]

I saw you people helping out another guy who seemed to have the same problem as me, and it worked, so I'll go ahead and ask for your help as well. I have already put all the information I can think of in the boxes above me.

EDIT: It might also be useful to know that I have had two browser extensions in my chrome browser called "NexTCouup 1.0" and "suave oun 2.14", however the NextCoup one vanished once I ran the herdProtect scan. I discovered that if I remove the extensions the ads disappear and all noticable symptoms with them. However restarting the browser casues them to come back. As for now I only have the "suave oun 2.14" left in my browser.

 

[TwinHeadedEagle]

I still need Addition.txt report.

 

[Tagglink]

Ah, here you go.

 

[TwinHeadedEagle]

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  gpt.ini;z 
  C:\Windows\System32\GroupPolicy;v
  C:\Windows\SysWOW64\GroupPolicy;v
  process;
  services-list;
  systemspecs;
  startupall;
  skipfix-iedefaults;
  firefoxlook;
  chromelook;
  filesrcm;
  installedprogs;

• Make sure that Scan All Users option is checked
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

 

[Tagglink]

Ok, I ran the scan after disabling avast and malwarebytes. No restart was needed, apparently.

 

[TwinHeadedEagle]

Scan with ZOEK

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  f.lux;u
  C:\Program Files\NexTCouuP;fs
  C:\Program Files\Adblocker;fs
  C:\Program Files\Reason;fs
  HKEY_USERS\S-1-5-21-365685471-2165170053-2909931169-1000\Software\Microsoft\Windows\CurrentVersion\Run];r
  "f.lux"=-;r
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run];r
  "f.lux"=-;r
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows];r
  "AppInit_DLLs"="";r
  c:\\progra~1\\browse~1;fs
  hbimcelnjiokgnmckiikoccblhnmanmg;chr
  khaciojhmnjalpgcphhjbakaegeacaik;chr
  C:\Windows\System32\GroupPolicy\gpt.ini;f
  C:\Windows\System32\GroupPolicy\Machine;fs
  C:\Windows\System32\GroupPolicy\User;fs
  autoclean;
  emptyalltemp;

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

 

[Tagglink]

Alright, scan is done

 

[TwinHeadedEagle]

Okay, tell me how is your PC now?

 

[Tagglink]

All traces of the malware is gone from what I can see, the suspicious extensions are gone, and the startup and login to windows was also a lot faster.
Are we done?

 

[TwinHeadedEagle]

Yes, we're done


Below you will find my thoughts about securing your machine. Go ahead through it, you will benefit from some useful advice about safe computing.

Recommended reading:
​

MUST READ - security tips: Computer Security - a short guide to staying safer online. Simple and easy ways to keep your computer safe and secure on the Internet

MUST READ - general maintenance: What to do if your Computer is running slowly?

Recommended additional software:
​

TFC - to clean unneeded temporary files.

Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.

Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.

McShield - to prevent infections spread by removable media.

CryptoPrevent - to secure yourself from very severe CryptoLocker infection.

Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.


• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;

Remove disinfection tools

Create registry backup

Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

My help is free for everybody.
If you're happy with the help provided and/or wish to buy me a beer for the assistance you received, then you can consider a donation:
Thank you!​

Stay safe,
TwinHeadedEagle

 

[Tagglink]

Alright, thanks! I'll make sure to read through those links and learn what I can. I can't imagine what kind of effort it takes for one person to offer this kind of help individually, and although I'm unable to donate I'll recommend the site to my friends whenever they need the same help. Thanks again!

 

[TwinHeadedEagle]

You're more than welcome

 

[TwinHeadedEagle]

Since this issue appears to be resolved, I am closing the topic. If that is not the case and you need or wish to continue with this topic, please contact me or any staff member with the address of the thread.

Other members who need assistance please start your own topic in a new thread. Thanks!