Wittmann

The Touch VPN - I myself uninstalled the extension, but Adwcleaner did remove it - only PUP.Optional.Legacy was found on re-scan. Here is the log you asked for - PUP.Optional.Legacy would not delete until I deleted the blackjack file - kept coming back - ======= LOG # ------------------------------- # Malwarebytes AdwCleaner 8.0.7.0 # ------------------------------- # Build: 07-22-2020 # Database: 2020-07-20.1 (Local) # Support: https://www.malwarebytes.com/support # # ------------------------------- # Mode: Clean # ------------------------------- # Start: 10-01-2020 # Duration: 00:00:10 # OS: Windows 10 Home # Cleaned: 2 # Failed: 0 ***** [ Services ] ***** No malicious services cleaned. ***** [ Folders ] ***** No malicious folders cleaned. ***** [ Files ] ***** No malicious files cleaned. ***** [ DLL ] ***** No malicious DLLs cleaned. ***** [ WMI ] ***** No malicious WMI cleaned. ***** [ Shortcuts ] ***** Deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Blackjack +.lnk ***** [ Tasks ] ***** No malicious tasks cleaned. ***** [ Registry ] ***** No malicious registry entries cleaned. ***** [ Chromium (and derivatives) ] ***** Deleted Touch VPN - Secure and unlimited VPN proxy - bihmplhobchoageeokmgbdihknkjbknd ***** [ Chromium URLs ] ***** No malicious Chromium URLs cleaned. ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries cleaned. ***** [ Firefox URLs ] ***** No malicious Firefox URLs cleaned. ***** [ Hosts File Entries ] ***** No malicious hosts file entries cleaned. ***** [ Preinstalled Software ] ***** No Preinstalled Software cleaned. ************************* [+] Delete Tracing Keys [+] Reset Winsock ************************* AdwCleaner[S00].txt - [5513 octets] - [30/09/2020 23:38:57] AdwCleaner[C00].txt - [1706 octets] - [30/09/2020 23:40:41] AdwCleaner[S01].txt - [5562 octets] - [01/10/2020 00:24:40] AdwCleaner[S02].txt - [5696 octets] - [01/10/2020 00:36:36] AdwCleaner[S03].txt - [5757 octets] - [01/10/2020 01:04:38] ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C03].txt ##########

Windows 10 - version 1909 I did a scan with Adwcleaner and found one infection - PUP.Optional.Legacy. It was quarantined and checked for delete, which included a restart. I carried out a Chrome sync reset, in case the server Bookmarks data was the culprit and then did a PC restart. On restart I did another Adwcleaner scan and PUP.Optional.Legacy was still there ! In the Adwcleaner cleaned logs it showed that - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Blackjack +.lnk - had been deleted. I entered %ProgramData% in a Run control, followed the path until Blackjack was listed, right clicked it and clicked Delete - result Blackjack is now gone ! A further scan with Adwcleaner showed no infection by PUP.Optional.Legacy - it has GONE ! Blackjack was the offender.

But the scan time is ridiculous, the total time is only 40 - 45 seconds ! A scan of my 295,000 files by all my other scanners, including Malwarebytes, takes 10 - 15 minutes, sometimes more. What can Adwcleaner possibly scan in 40 seconds ?

I have 295,000 files on my PC but Awdcleaner only shows 35,000 files after a scan. Where have the other 260,000 files gone ?

Avast Driver Updater is one big NO-NO to me.

To follow that excellent post by exile360, I have an HP desktop PC and HP Support Assistant. HP supplied the set and I accept and install all the updates they provide, including drivers. I would not accept driver update recommendations from any other source.

Note - I have posted this unpleasant incident on the Avast Driver Updater Forum. Out of 50 views so far, nobody has made a comment.

For general information concerning these two Pup's, it was Avast Driver Updater that implanted them in my system. Since uninstalling the program, AdwCleaner has been run many times and they are now gone ! My advice - steer clear of Avast Driver Updater.

LATEST I uninstalled Avast Driver Updater using Revo Uninstaller for a clean deletion and following a new scan with AdwCleaner and reboot, these two Pup's are now gone. Thanks for your help. Problem solved.

@ exile360 Thank you for that comprehensive reply. I have looked at my installed programs and Slimware Utilities or anything like it does not exist on my programs installed list.

Only AdwCleaner is picking these two PUP's up as being "threats". None of my other AV/Malware programs list them - SuperAntiSpyware, Emsisoft Emergency Kit, Hitman Pro, Avast or Malwarebytes all disregard them.

If I follow the registry path = PUP.Optional.Legacy = C:\Windows\System32\drivers\swdumon.sys I can delete the driver. A scan after that and PUP Legacy is gone ! But on restart it comes back. I cannot find the other PUP file.

Here is the latest log file - # ------------------------------- # Malwarebytes AdwCleaner 7.4.0.0 # ------------------------------- # Build: 07-23-2019 # Database: 2019-07-22.1 (Cloud) # Support: https://www.malwarebytes.com/support # # ------------------------------- # Mode: Scan # ------------------------------- # Start: 08-02-2019 # Duration: 00:00:28 # OS: Windows 10 Home # Scanned: 35810 # Detected: 34 ***** [ Services ] ***** No malicious services found. ***** [ Folders ] ***** No malicious folders found. ***** [ Files ] ***** PUP.Optional.AuslogicsDiskDefrag C:\Users\Username\Desktop\Auslogics Disk Defrag.lnk <--- IGNORE THIS PUP.Optional.Legacy C:\Windows\System32\drivers\swdumon.sys ***** [ DLL ] ***** No malicious DLLs found. ***** [ WMI ] ***** No malicious WMI found. ***** [ Shortcuts ] ***** No malicious shortcuts found. ***** [ Tasks ] ***** No malicious tasks found. ***** [ Registry ] ***** PUP.Optional.SlimCleanerPlus HKLM\Software\Wow6432Node\SlimWare Utilities Inc ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries found. ***** [ Chromium URLs ] ***** No malicious Chromium URLs found. ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries found. ***** [ Firefox URLs ] ***** No malicious Firefox URLs found. ***** [ Preinstalled Software ] ***** Preinstalled.HPAudioSwitch Preinstalled.HPJumpStartApps Preinstalled.HPJumpStartBridge Preinstalled.HPJumpStartLaunch Preinstalled.HPRegistrationService Preinstalled.HPSupportAssistant Preinstalled.HPSureConnect AdwCleaner[S00].txt - [1479 octets] - [13/04/2019 19:06:53] AdwCleaner[S01].txt - [1540 octets] - [13/04/2019 19:16:07] AdwCleaner[C01].txt - [1574 octets] - [13/04/2019 19:21:16] AdwCleaner[S02].txt - [1585 octets] - [14/04/2019 14:26:43] AdwCleaner[C02].txt - [1666 octets] - [14/04/2019 14:27:31] AdwCleaner[S03].txt - [1697 octets] - [14/04/2019 14:31:27] AdwCleaner[S04].txt - [1768 octets] - [14/04/2019 14:43:59] AdwCleaner[C04].txt - [2047 octets] - [14/04/2019 14:44:29] AdwCleaner[S05].txt - [1825 octets] - [14/04/2019 14:50:27] AdwCleaner[C05].txt - [1971 octets] - [14/04/2019 14:51:00] AdwCleaner[S06].txt - [1937 octets] - [14/04/2019 14:54:42] AdwCleaner[S07].txt - [2073 octets] - [14/04/2019 15:13:05] AdwCleaner[C07].txt - [2154 octets] - [14/04/2019 15:14:47] AdwCleaner[S08].txt - [2185 octets] - [14/04/2019 15:24:03] AdwCleaner[C08].txt - [2286 octets] - [14/04/2019 15:24:29] AdwCleaner[S09].txt - [2307 octets] - [14/04/2019 15:29:38] AdwCleaner[S10].txt - [2378 octets] - [14/04/2019 15:49:17] AdwCleaner[C10].txt - [2459 octets] - [14/04/2019 15:49:37] AdwCleaner[S11].txt - [2490 octets] - [14/04/2019 15:56:16] AdwCleaner[S12].txt - [2561 octets] - [14/04/2019 16:07:46] AdwCleaner[S13].txt - [2622 octets] - [14/04/2019 17:36:39] AdwCleaner[S14].txt - [2606 octets] - [14/04/2019 17:51:23] AdwCleaner[S15].txt - [2667 octets] - [14/04/2019 18:12:10] AdwCleaner[S16].txt - [2728 octets] - [14/04/2019 18:36:02] AdwCleaner[C16].txt - [2829 octets] - [14/04/2019 18:36:45] AdwCleaner[S17].txt - [2850 octets] - [14/04/2019 18:47:34] AdwCleaner[C17].txt - [2951 octets] - [14/04/2019 18:48:10] AdwCleaner[S18].txt - [2962 octets] - [14/04/2019 19:40:50] AdwCleaner[S19].txt - [3063 octets] - [14/04/2019 19:41:36] AdwCleaner[S20].txt - [3094 octets] - [14/04/2019 19:45:41] AdwCleaner[S21].txt - [3155 octets] - [14/04/2019 20:23:46] AdwCleaner[S22].txt - [3305 octets] - [14/04/2019 22:35:33] AdwCleaner[S23].txt - [3277 octets] - [15/04/2019 01:00:12] AdwCleaner[S24].txt - [3338 octets] - [15/04/2019 01:08:38] AdwCleaner[C24].txt - [3439 octets] - [15/04/2019 01:08:59] AdwCleaner[S25].txt - [3450 octets] - [15/04/2019 01:15:10] AdwCleaner[S26].txt - [3521 octets] - [15/04/2019 01:19:07] AdwCleaner[S27].txt - [3582 octets] - [15/04/2019 02:26:55] AdwCleaner[C27].txt - [3683 octets] - [15/04/2019 02:27:26] AdwCleaner[S28].txt - [3694 octets] - [15/04/2019 02:33:42] AdwCleaner[S29].txt - [3755 octets] - [15/04/2019 02:36:14] AdwCleaner[S30].txt - [3816 octets] - [15/04/2019 02:41:20] AdwCleaner[S31].txt - [3877 octets] - [15/04/2019 02:42:36] AdwCleaner[S32].txt - [3948 octets] - [15/04/2019 03:01:55] AdwCleaner[S33].txt - [4009 octets] - [15/04/2019 17:07:30] AdwCleaner[C33].txt - [4110 octets] - [15/04/2019 17:07:59] AdwCleaner[S34].txt - [4131 octets] - [15/04/2019 17:17:22] AdwCleaner[S35].txt - [4192 octets] - [15/04/2019 19:02:56] AdwCleaner[C35].txt - [4293 octets] - [15/04/2019 19:03:17] AdwCleaner[S36].txt - [4304 octets] - [15/04/2019 19:08:41] AdwCleaner[S37].txt - [4365 octets] - [15/04/2019 19:10:30] AdwCleaner[S38].txt - [4426 octets] - [15/04/2019 19:14:57] AdwCleaner[S39].txt - [4487 octets] - [15/04/2019 19:19:56] AdwCleaner[S40].txt - [4548 octets] - [15/04/2019 20:59:26] AdwCleaner[S41].txt - [4609 octets] - [16/04/2019 11:59:32] AdwCleaner[S42].txt - [4670 octets] - [18/04/2019 00:39:43] AdwCleaner[S43].txt - [4731 octets] - [19/04/2019 14:20:25] AdwCleaner[S44].txt - [4792 octets] - [21/04/2019 23:52:30] AdwCleaner[S45].txt - [4853 octets] - [22/04/2019 23:46:06] AdwCleaner[S46].txt - [4914 octets] - [24/04/2019 12:37:56] AdwCleaner[S47].txt - [4975 octets] - [02/05/2019 15:26:30] AdwCleaner[S48].txt - [5036 octets] - [06/05/2019 19:53:23] AdwCleaner[S49].txt - [5097 octets] - [10/05/2019 20:37:46] AdwCleaner[S50].txt - [5158 octets] - [17/05/2019 11:43:15] AdwCleaner[S51].txt - [5219 octets] - [21/05/2019 20:41:22] AdwCleaner[S52].txt - [5280 octets] - [30/05/2019 21:11:34] AdwCleaner[S53].txt - [5341 octets] - [10/06/2019 19:03:01] AdwCleaner[S54].txt - [5402 octets] - [20/06/2019 19:05:07] AdwCleaner[S55].txt - [5463 octets] - [26/06/2019 23:00:40] AdwCleaner[S56].txt - [5524 octets] - [09/07/2019 20:56:27] AdwCleaner[S57].txt - [5585 octets] - [23/07/2019 19:57:36] AdwCleaner[S58].txt - [5931 octets] - [26/07/2019 16:03:42] AdwCleaner[S59].txt - [5992 octets] - [26/07/2019 16:06:44] AdwCleaner[S60].txt - [6222 octets] - [01/08/2019 11:41:55] AdwCleaner[S61].txt - [6283 octets] - [01/08/2019 12:36:48] AdwCleaner[C61].txt - [6110 octets] - [01/08/2019 12:38:05] AdwCleaner[S62].txt - [6236 octets] - [01/08/2019 12:41:30] AdwCleaner[S63].txt - [6297 octets] - [01/08/2019 12:42:37] AdwCleaner[S64].txt - [6358 octets] - [01/08/2019 13:09:38] AdwCleaner[S65].txt - [6536 octets] - [01/08/2019 13:34:23] AdwCleaner[C65].txt - [6383 octets] - [01/08/2019 13:35:19] AdwCleaner[S66].txt - [6658 octets] - [01/08/2019 13:39:58] AdwCleaner[S67].txt - [6719 octets] - [01/08/2019 13:41:33] AdwCleaner[S68].txt - [6780 octets] - [01/08/2019 14:41:07] AdwCleaner[C68].txt - [6627 octets] - [01/08/2019 14:41:28] AdwCleaner[S69].txt - [6902 octets] - [01/08/2019 14:45:40] AdwCleaner[S70].txt - [6963 octets] - [01/08/2019 14:52:33] AdwCleaner[C70].txt - [7037 octets] - [01/08/2019 14:53:21] AdwCleaner[S71].txt - [6993 octets] - [01/08/2019 14:58:30] AdwCleaner[C71].txt - [6932 octets] - [01/08/2019 14:58:54] AdwCleaner[S72].txt - [7115 octets] - [01/08/2019 15:02:57] AdwCleaner[S73].txt - [7176 octets] - [01/08/2019 15:08:46] AdwCleaner[C73].txt - [7115 octets] - [01/08/2019 15:09:04] AdwCleaner[S74].txt - [7298 octets] - [01/08/2019 15:12:19] AdwCleaner[S75].txt - [7359 octets] - [01/08/2019 15:24:25] AdwCleaner[C75].txt - [7298 octets] - [01/08/2019 15:24:40] AdwCleaner[S76].txt - [7481 octets] - [01/08/2019 15:30:21] AdwCleaner[S77].txt - [7634 octets] - [01/08/2019 16:38:14] AdwCleaner[S78].txt - [7695 octets] - [02/08/2019 11:20:29] AdwCleaner[C78].txt - [7542 octets] - [02/08/2019 11:22:41] AdwCleaner[S79].txt - [7817 octets] - [02/08/2019 11:26:57] ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S80].txt ##########

Please ignore the Auslogics PUP, it is the other two that are the subject of this post.

Two stubborn PUP's refuse to be deleted. Cleaner procedure followed exactly including reboot. On resumption a panel shows that the PUP's have been deleted, but on running the cleaner again, the two PUP's are still detected. This means the two PUP's are installed at start-up. How can I possibly get rid of them when AdwCleaner cannot do it ? A normal Malwarebytes scan using the normal program does NOT detect these PUP's. See -