PUP Removal Guide

Several sites show guides that re-set the browsers first, but without removing the Registry Entries that these PUP’s(Potentially unwanted Programs) create,  the browser will just revert back.

Steps that should be done before using ANY malware/adware removal tool

  • Done in case a mistake is made.  You have a point in time for back-up & registry settings prior to starting removal.

No.1 Create a New Restore point

 

No.2  Run a scan with Junkware Removal Tool.   

JRT will do a Backup of the Registry for you


Please download   Junkware Removal Tool

Double-click to run the tool. For Windows Vista or 7 users, right-click the file and select Run as Administrator
The tool will open and start scanning your system
Please be patient as this can take a while to complete depending on your system’s specifications
On completion, a log (JRT.txt) will be saved to your desktop and will automatically open

JRT 2

No.3  Run a scan with AdwCleaner

Download AdwCleaner

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Scan and wait for the results.   View the results to see if there is anything you might want to keep, otherwise click Clean

AdwCleaner-v3.

Your computer will be rebooted automatically. A text file will open after the restart.

No.4  Optional  

How to re-set your browser(s)How to Disable Extensions in Google Chrome – How to Uninstall Extensions in Google Chrome
How to Disable Extensions and Plugins in Firefox – How to Remove Extensions/Uninstall Plugins in Firefox
How to Disable Extensions in Internet Explorer
How to Disable Add-ons/Extensions in Internet Explorer, Firefox and Google Chrome
How to Disable all add-ons in Firefox, Internet Explorer2. Create a new browser user profile.* How to Create a new browser user profile in Google Chrome
How to Create a new browser user profile in Firefox
How to Create a new browser user profile in Opera, Internet Explorer, Firefox, Chrome

No.5  Optional

Do a dns cache Flush  ( Compliments of Yard Dog )Click Start>>All Programs>>Accessories>>Command Prompt(Vista & Win 7 users, right click and choose Run as Administrator )Type in ipconfig /flushdns    ( Space inbetween ipconfig and / ). Then hit Enter

No.6 Run a scan with Malwarebytes Anti-Malware

  Use Malwarebytes’ Antimalware to check for any nasty’s and to remove any PUP’s left

NOTE: Decline the Free Trial of Malwarebytes Pro for now. Not needed for detection nor removal.
They do that for Free.  You may try it at a later date if you so wish

NOTE: To have Malwarebytes check for PUP’s:
Open the program>>Settings Tab>>Detection & Protection
On ” Non-Malware Protection
Click the arrow and change to “Treat Detection’s as Malware“

Selecting all PUPs

Launch Malwarebytes’ Anti-Malware
Go to Dashboard and select Update Now. If an update is found, it will download and install the latest version.
Click the Scan tab and select (1)Threat Scan, then click (2)Scan now

Mbam Scan

 

The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart

 

No.7

Use SUPERAntiSpyware to remove more PUP”s (Free Edition)

DOWNLOAD

 

  • Once downloaded, close all programs and Windows on your computer, including this one.
  • Double-click the icon on your desktop named SUPERAntiSpyware.exe. This will start the installation. Keep following the prompts in order to continue with the installation process.
  • Please select your language you want the program to use and then press the OK
  • You will now be prompted to update the SUPERAntiSpyware definitions. Please press the Yes button to allow the program to download and install the latest updates
  • After the definitions are updated, the welcome screen for SUPERAntiSpyware will appear.
  • When you get to the screen asking if you would like to send the diagnostics, you can choose to allow it to or not. Either choice will have no affect on the effectiveness of its malware scan. When you get to the last screen, click on the Finish button.
  • You will now be prompted if you would like SAS to protect your home page. If you select the Protect Home page option, SUPERAntiSpyware will alert you if another program is trying to change your browser’s home page. Click Yes
  • Then you will be at the main screen for SUPERAntiSpyware. Click the Preferences button, then Scanning Control tab, and put a checkmark in the following options
    • Close browsers before scanning.
    • Scan for tracking cookies.
  • Now press the Close button to go back to the main screen.
  • Click on the Scan This  Computer… button to begin the scanning process. You should select the Complete Scan option to begin the Scan.

SAS Complete Scan

If Any PUP’s are Detected, SAS will have you deal with those First

  • When the scan is finished a screen will appear showing the summary of what was detected. You should click on the OK button to close the summary screen box and continue with the removal process.
  • You should now click on the Next button to remove all the listed malware. If it displays a message stating that it needs to reboot, please press theYesbutton to allow it to do so. VERY IMPORTANT to DO
  • Click the Repair Tab after the restart if any issues still remain and SAS will atempt to fix them.

Tutorials and Troubleshooting

 

Alternative Scanners that can also be used:

Advertisements

One thought on “PUP Removal Guide

  1. Thank you so much for this post
    Very thorough. I don’t have a computer virus now but will have to download Malwarebytes. Read a lot of good things about it. I have a blog on Internet, security and privacy, so I am particularly interested in internet security topics.

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s