Unable to remove PUP.Optional.Crossrider

[jonlu69]

Hi Guys

 

I have been unable to remove the above PUP for about a week now. I have premium Malwarebytes installed. It runs the scan, alerts of 2 instances of PUP.Optional.Crossrider and asks me to restart. I do this then they come back in the next scan, rinse and repeat.

I have run Farbar and have attached the 2 files.

Any help greatly appreciated.

FRST.txt

Addition.txt

[TwinHeadedEagle]

Hello and

Can you export MalwareBytes report that shows this detection?

[jonlu69]

Thanks, I have just run the scan again and its now come up with no threats. I will upload the report if it comes back (Its been there for over a week !)

[jonlu69]

Spoke too soon its back. Here is the report

report.txt

[TwinHeadedEagle]

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  autoclean;
  emptyclsid;
  emptyalltemp;
  chrdefaults:
  ipconfig /flushdns >>"%temp%\log.txt";b

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

[jonlu69]

Results of scan attached

zoek-results.log

[TwinHeadedEagle]

How is the situation now?

[jonlu69]

Just scanned again and they are still there. Also after zoek ran last night I can no longer print office documents (everything else prints fine), may be a coincidence !

[TwinHeadedEagle]

I don't think printing problem is Zoek related. One command wasn't executed properly, let's try again:

Fix with ZOEK

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:

  createsrpoint;
  chrdefaults;

   

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

Edited July 27, 2016 by TwinHeadedEagle

[jonlu69]

Thanks mate, ran zoek with supplied script, attached results. Re ran Malawarebytes, still has 2 X PUP.Ptional.CrissRider files.

zoek-results.log

[jonlu69]

I let Malwarebytes run again and before rebooting I manually deleted the 2 files. I then rebooted and the files have not returned and i am now showing 0 threats. I will see how it goes. Thanks.

[TwinHeadedEagle]

Okay, keep me updated.

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!