PUP.Optional.Claro.A

CountBassy_37

CountBassy_37

New Member
Thread author
Nov 2, 2014
8
32
8
69
great white north
Hi all, I'm really not sure if I'm actually infected with PUP.Optional.Claro.A or if it is hiding. I cannot see it installed on any browsers and it is not listed in Programs/Add-Remove folder in Control Panel. The computer is working great and I do not have any so-called Claro Search Bars in IE, Google Chrome or Firefox. I'm running AVG Free, Malwarebytes Premium 2.0.3.1025 and Windows Firewall for security.
All these PUP alerts from Malwarebytes over time is a little annoying since I keep quarantining after the scan detects it and it keeps coming back.
Any help or knowledge about this situation would be greatly appreciated.
Thank you for viewing this post.
 
Please download Farbar Recovery Scan Tool (
FRST_canned.png
) by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
 
  • Like
Reactions: CountBassy_37
argus said:
Please download Farbar Recovery Scan Tool (
FRST_canned.png
) by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Click to expand...

Hello Argus, thank you for your prompt reply. Here are the Farbar files you requested.
 

Attachments

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
Code: 
Start
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
FF Homepage: hxxp://mysearch.avg.com?cid={9B470462-236D-478A-BF4D-2E8FB78D85DB}&mid=00e7094ab80b47d390c5c13194c2edad-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=en&ds=AVG&coid=avgtbavg&pr=fr&d=2013-11-05 11:53:46&v=18.0.5.292&pid=safeguard&sg=0&sap=hp
FF SearchPlugin: C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\nf8s48vy.default\searchplugins\safeguard-secure-search.xml
C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\nf8s48vy.default\searchplugins\safeguard-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
End
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.




============ Next ==============



Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
  • Click on the Scan button.
  • After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Post logfile will also be saved in the C:\AdwCleaner folder.
 
  • Like
Reactions: CountBassy_37
argus said:
1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
Code: 
Start
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
FF Homepage: hxxp://mysearch.avg.com?cid={9B470462-236D-478A-BF4D-2E8FB78D85DB}&mid=00e7094ab80b47d390c5c13194c2edad-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=en&ds=AVG&coid=avgtbavg&pr=fr&d=2013-11-05 11:53:46&v=18.0.5.292&pid=safeguard&sg=0&sap=hp
FF SearchPlugin: C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\nf8s48vy.default\searchplugins\safeguard-secure-search.xml
C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\nf8s48vy.default\searchplugins\safeguard-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
End
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.




============ Next ==============



Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
  • Click on the Scan button.
  • After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Post logfile will also be saved in the C:\AdwCleaner folder.
Click to expand...

Hi argus, here are the fixlog & AdwCleaner files you requested. Thank you very much for your help!
 

Attachments

argus said:
Is everything ok now?
Click to expand...
I think so, not sure as the only indication this pup-Claro was on the machine somewhere is when Malwarebytes scan was alerting to it. But I see it was more imbedded than I would have thought. Apparently it was never installed and running? I couldn't see it anywhere, that's why I came here for some professional help removing it. I'm not very good finding these pests and don't know how it even got on the computer other than being bundled with some other software I downloaded without my knowledge. Thanks a lot for your help!:D
 
• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
checkmark.png
Remove disinfection tools
checkmark.png
Create registry backup
checkmark.png
Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.
 
  • Like
Reactions: CountBassy_37
argus said:
• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
checkmark.png
Remove disinfection tools
checkmark.png
Create registry backup
checkmark.png
Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.
Click to expand...

Hi argus, ran the DelFix, was it supposed to remove AdwCleaner? I still see it in C: looks like everything is still there.

Here is DelFix report:
 

Attachments

You may also like...