PUP.Optional.Claro.A

[CountBassy_37]

Hi all, I'm really not sure if I'm actually infected with PUP.Optional.Claro.A or if it is hiding. I cannot see it installed on any browsers and it is not listed in Programs/Add-Remove folder in Control Panel. The computer is working great and I do not have any so-called Claro Search Bars in IE, Google Chrome or Firefox. I'm running AVG Free, Malwarebytes Premium 2.0.3.1025 and Windows Firewall for security.
All these PUP alerts from Malwarebytes over time is a little annoying since I keep quarantining after the scan detects it and it keeps coming back.
Any help or knowledge about this situation would be greatly appreciated.
Thank you for viewing this post.

 

[argus]

Please download Farbar Recovery Scan Tool (

) by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

[CountBassy_37]

Please download Farbar Recovery Scan Tool (

) by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Hello Argus, thank you for your prompt reply. Here are the Farbar files you requested.

 

[argus]

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Start
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
FF Homepage: hxxp://mysearch.avg.com?cid={9B470462-236D-478A-BF4D-2E8FB78D85DB}&mid=00e7094ab80b47d390c5c13194c2edad-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=en&ds=AVG&coid=avgtbavg&pr=fr&d=2013-11-05 11:53:46&v=18.0.5.292&pid=safeguard&sg=0&sap=hp
FF SearchPlugin: C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\nf8s48vy.default\searchplugins\safeguard-secure-search.xml
C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\nf8s48vy.default\searchplugins\safeguard-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
End

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.




============ Next ==============



Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

• Click on the Scan button.
• After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Post logfile will also be saved in the C:\AdwCleaner folder.

 

[CountBassy_37]

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Start
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
FF Homepage: hxxp://mysearch.avg.com?cid={9B470462-236D-478A-BF4D-2E8FB78D85DB}&mid=00e7094ab80b47d390c5c13194c2edad-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=en&ds=AVG&coid=avgtbavg&pr=fr&d=2013-11-05 11:53:46&v=18.0.5.292&pid=safeguard&sg=0&sap=hp
FF SearchPlugin: C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\nf8s48vy.default\searchplugins\safeguard-secure-search.xml
C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\nf8s48vy.default\searchplugins\safeguard-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
End

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.




============ Next ==============



Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

• Click on the Scan button.
• After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Post logfile will also be saved in the C:\AdwCleaner folder.

Hi argus, here are the fixlog & AdwCleaner files you requested. Thank you very much for your help!

 

[argus]

Is everything ok now?

 

[CountBassy_37]

Is everything ok now?

I think so, not sure as the only indication this pup-Claro was on the machine somewhere is when Malwarebytes scan was alerting to it. But I see it was more imbedded than I would have thought. Apparently it was never installed and running? I couldn't see it anywhere, that's why I came here for some professional help removing it. I'm not very good finding these pests and don't know how it even got on the computer other than being bundled with some other software I downloaded without my knowledge. Thanks a lot for your help!

 

[argus]

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;

Remove disinfection tools

Create registry backup

Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

 

[CountBassy_37]

ooops, just saw you last post on cleanup

 

[argus]

Cheers!

 

[CountBassy_37]

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;

Remove disinfection tools

Create registry backup

Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

Hi argus, ran the DelFix, was it supposed to remove AdwCleaner? I still see it in C: looks like everything is still there.

Here is DelFix report:

 

[argus]

I still see it in C: looks like everything is still there.

Run AdwC and click Uninstall.

 

[CountBassy_37]

Run AdwC and click Uninstall.

oops, don't see the .exe to run it, just the Backup & Quarantine folders & RO - SO text files. Is it OK to just delete those files?

 

[argus]

OK no problem.

 

[CountBassy_37]

OK no problem.

OK Thanks argus, need an app to send ya a beer! lol
Cheers!

 

[argus]