This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

virus detected on windows defender

25 min read

This thread's last reply is from May 5, 2024, 2:43 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

jwdo
April 23, 2024, 9:33 PM UTC
Addition.txtFRST.txtI have a windows 10 operating system and my windows defender detected a virus I can't delete. It is called PUADIManager:Win32/OfferCore. I am uploading the two files you suggested,
pgmigg Admin/Teacher
April 24, 2024, 12:22 AM UTC
Hello jwdo,

Welcome to the forum! :)

I am pgmigg and I'll be helping you with any malware problems.

Before we begin, please read and follow these important guidelines, so things will proceed smoothly.
  1. The instructions being given are for YOUR computer and system only!
    Using these instructions on a different computer can cause damage to that computer and possibly render it inoperable!
  2. You must have Administrator rights, permissions for this computer.
  3. DO NOT run any other fix or removal tools unless instructed to do so!
  4. DO NOT install any other software (or hardware) during the cleaning process until we are done as well as
    DO NOT Remove, or Scan with anything on your system unless I ask. This adds more items to be researched.
    Extra Additions and Removals of files make the analysis more difficult.
  5. Only post your problem at (1) one help site. Applying fixes from multiple help sites can cause problems.
  6. Print each set of instructions if possible - your Internet connection will not be available during some fix processes.
  7. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
  8. Only reply to this thread, do not start another one. Please, continue responding, until I give you the "All Clean!" :cheers:
    Absence of symptoms does not mean that everything is clear.


I am currently reviewing your logs and will return, as soon as possible, with additional instructions. In the meantime...

Note: If you haven't done so already, please read this topic ALL USERS OF THIS FORUM MUST READ THIS FIRST where the conditions for receiving help here are explained.

Please read all instructions carefully before executing and perform the steps, in the order given.
lf you have any questions or problems executing these instructions, <<STOP>> do not proceed, post back with the question or problem.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start


Failure to post replies within 72 hours will result in this thread being closed
jwdo
April 24, 2024, 3:28 PM UTC
OK, I've read your post and have backed up my files. So what do you suggest I do?
pgmigg Admin/Teacher
April 24, 2024, 4:32 PM UTC
Hello jwdo,

Step 1.
Run CKScanner
  1. Please download CKScanner from here
  2. Important: - Save it to your Desktop.
  3. Double-click CKScanner.exe and click Search For Files.
  4. After a very short time, when the cursor hourglass disappears, click Save List To File.
  5. A message box will verify the file saved.
  6. Double-click the CKFiles.txt icon on your Desktop and copy/paste the contents in your next reply.


Then:
Please tell me is this computer used for business or educational purposes and/or connected to a business or educational network?
I need to know it - so I can provide the proper instructions.

Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections...

Don't post anything as attachments unless I will ask you about it specifically!

Please include in your next reply:
  1. Do you have any problems executing the instructions?
  2. Contents of CKFiles.txt log file
  3. Answer to my question related to type of using of your computer


Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed
jwdo
April 24, 2024, 11:18 PM UTC
Initially when I try to download CKScanner my windows defender blocks the file. When I finally force it to accept the file, after putting it on my desktop, the program will not open. It says (not responding). Should I try to download CKScanner from the internet website rather from you? see my attachment. I'm not sure I've attached my file correctlyCKScanner.pdf
jwdo
April 24, 2024, 11:45 PM UTC
ckfiles.txtI finally got CKScanner to produce a .txt file. I'm not sure if I'm uploading files correctly.
pgmigg Admin/Teacher
April 25, 2024, 1:07 AM UTC
Hello jwdo,

You have attached files correctly and the described behavior of CKScanner is possible. From time to time it shows "Not responding" but after a while it returns to normal operation. It takes some time to finish.
Finally I got the CKScanner log file - thank you!

Please answer to my question related to type of using of your computer.

Thanks,
pgmigg
jwdo
April 25, 2024, 7:19 PM UTC
What do you want to do now. I don't understand your question "Please answer to my question related to type of using of your commputer."
pgmigg Admin/Teacher
April 25, 2024, 8:27 PM UTC
Hello jwdo,

"jwdo" wrote:What do you want to do now. I don't understand your question "Please answer to my question related to type of using of your commputer."


In my first set of instructions was this question:

"pgmigg" wrote:Then:
Please tell me is this computer used for business or educational purposes and/or connected to a business or educational network?
I need to know it - so I can provide the proper instructions.


Please answer it. After that I will continue...

Thank you,
pgmigg
jwdo
April 26, 2024, 1:03 AM UTC
Oh, okay. It is used for home use.
pgmigg Admin/Teacher
April 26, 2024, 2:23 AM UTC
Thank you, jwdo, very good!

Please do the following:

Step 1.
Remove Programs
  1. Please press the Windows Key + R.
  2. Enter appwiz.cpl into the text box and click OK.
  3. Locate the following programs:
    CPUID CPU-Z
    NirSoft ProduKey
  4. Click on the Change/Remove button to uninstall it, then repeat it for every entry in this list.
  5. When the programs have been uninstalled, please close Control Panel
  6. Reboot (restart) your computer.


Step 2.
FRST Fix
  1. Close all your programs.
  2. You should still have FRST64.exe on your Desktop. If not please download it HERE and save it on your Desktop.
  3. Hit your Windows Key + R to open a Run window
  4. Type Notepad then click OK
  5. This will open an empty Notepad document
  6. Copy/Paste the following into it (Don't include Code: Select All ) .....

CreateRestorePoint:



AlternateShell:  <==== ATTENTION

GroupPolicy: Restriction - Chrome <==== ATTENTION

Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION

HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION

Task: {442AF1B9-5B62-4ECC-89BF-CFB5A29F89B3} - \Microsoft\Windows\Setup\EOSNotify2 -> No File <==== ATTENTION

Task: {E9B86E8B-2754-4D10-9DE1-6BF143295F05} - \Microsoft\Windows\Setup\EOSNotify -> No File <==== ATTENTION

S3 cpuz149; \??\C:\WINDOWS\temp\cpuz149\cpuz149_x64.sys [X] <==== ATTENTION

S3 cpuz153; \??\C:\WINDOWS\temp\cpuz153\cpuz153_x64.sys [X] <==== ATTENTION

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [274]

AlternateDataStreams: C:\Users\Dave\Desktop\Back-up Programs:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Bible Programs:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Browsers:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Cleaner:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Cloud Drives:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Computer Analyzers:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Delete Programs:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\File_Folder Size:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Hot Illustrations:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Printers:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Proctor folder.lnk:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Readers:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Video_Audio Programs:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Virus and Spyware:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Desktop\Windows Sysinternals:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Annuity Companies:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Anti-Keyloggers:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Apple:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Apps:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Avery Labels:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Backup and Cloud Software:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\backupwindowskey:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Bibles:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Blue Screen Of Death:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Browsers:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\CD-DVD:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Codecs:com.dropbox.attrs [52]

AlternateDataStreams: C:\Users\Dave\Downloads\Computer Analyzers:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\CPU Check:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Defraggers (Disk):com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\DesktopOK (arranges icons):com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Dictionaries:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Downloading using Torrents and Filezilla:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Drive Icon Changer:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Drivers:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Drives (Hard Disk):com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Dropbox:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Enable Greyed Out Buttons:com.dropbox.attrs [52]

AlternateDataStreams: C:\Users\Dave\Downloads\Favorites:com.dropbox.attrs [52]

AlternateDataStreams: C:\Users\Dave\Downloads\Faxing:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Fidelity:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Files -Folders:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Firewalls:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\FixWindows Media Player:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\FlashBench_USB Test:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Google Drive:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Hebrew:com.dropbox.attrs [52]

AlternateDataStreams: C:\Users\Dave\Downloads\HiddenToggle:com.dropbox.attrs [52]

AlternateDataStreams: C:\Users\Dave\Downloads\install:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Internet:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\iPad, iPhone, iCloud:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\jruler:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Kerux illustration database:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Memory:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Monitors:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Mouse:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Music-Video-Text files:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Net Framework Setup Verifier:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Network Test Tool:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\OCR Software:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Online Storage and Syncing:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Paint Programs:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Password Protection:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Portable Programs on USB:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Printers:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Product key Finders:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Readers:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Registry(+) Cleaners:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Remote Access Computer:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Repair Windows:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Screen capture & recording programs:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Search for Files, Folders, Words, Phrases:com.dropbox.attrs [52]

AlternateDataStreams: C:\Users\Dave\Downloads\Shell Extensions:com.dropbox.attrs [52]

AlternateDataStreams: C:\Users\Dave\Downloads\Silverlight:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Software analyzer_Updater:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Software-Programs:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Spyware Warrior Files:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Startup Programs:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Stocks:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Sysnative Files:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\System Cleaners:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Theocratic Items:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Uninstallers:com.dropbox.attrs [52]

AlternateDataStreams: C:\Users\Dave\Downloads\unzipped:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Update Checker:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\USB Drives and Analyzer:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Video Memory:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Virtual Disk Drive:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Virus and Spyware Removal Tools:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\WhatsApp:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Windows:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Windows Sysinternals:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Windows Sysinternals Suite:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Word Processers:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Youtube:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Z - Miscellaneous:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Zip Programs:com.dropbox.attrs [54]

AlternateDataStreams: C:\Users\Dave\Downloads\Zoom:com.dropbox.attrs [54]

C:\WINDOWS\temp\cpuz149\cpuz149_x64.sys

C:\WINDOWS\temp\cpuz153\cpuz153_x64.sys



EmptyTemp:

Hosts:

CMD: ipconfig /flushdns

  • Save it as fixlist.txt to the same location as FRST (must be in this location)
  • NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
  • Now press the Fix button once and wait.
  • FRST will process fixlist.txt
  • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
  • Please post me the log


Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections...

Don't post anything as attachments unless I will ask you about it specifically!

Please include in your next reply:
  1. Do you have any problems executing the instructions?
  2. Contents of the fixlog.txt log file
  3. Do you see any changes in computer behavior?


Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed
jwdo
April 26, 2024, 3:31 AM UTC
I executed your instructions and when I executed FRST it processed fixlist.txt and produced fixlog.txt, however when I restarted the computer fixlist.txt disappeared and I only have fixlog.txt. I don't see how I can post each log separately, as I only have fixlog.txt now. By the way, how do I post a log, I only know how to attach a file, how do you post something. And no I don't see any change in my computers behavior. I still see that Windows Defender says I still have the "PUIDIManager:Win32/OfferCore" virus.
pgmigg Admin/Teacher
April 26, 2024, 3:49 AM UTC
Hello jwdo,

"jwdo" wrote:I executed your instructions and when I executed FRST it processed fixlist.txt and produced fixlog.txt, however when I restarted the computer fixlist.txt disappeared and I only have fixlog.txt.
This is exactly what should have happened.

"jwdo" wrote:I don't see how I can post each log separately, as I only have fixlog.txt now. By the way, how do I post a log, I only know how to attach a file, how do you post something.
You need to open fixlog.txt by any text editor (Notepad, etc.) and Copy/Paste its contents here, in the body of your replay post - exactly the same way as you wrote all your previous posts.

Sorry if I confuse you a little by the request to post every log separately (it means one log - one post) when you need to post just one, but it was a part of my standard can designed to print the contents of numerous logs.

So, I am waiting for the contents of fixlog.txt ...

Thanks,
pgmigg
jwdo
April 26, 2024, 3:43 PM UTC
Ok, I am sending the file fixlog.txt. By the way, when I send the file, do I first choose the file and then press upload, or do I have to press Add the file first and then press upload. Then do I press place inline. Sending a file is very confusing to me on this website.Fixlog.txt
pgmigg Admin/Teacher
April 26, 2024, 4:21 PM UTC
Before we move on, I want to focus on the problem of the content of the posts and figure out what exactly confuses you and what is not clear.

When we write sentences in a post and type it letter by letter, the text appears in the body of the post and this is clear and obvious, right?

This happens until we decide that what we have written is correct using the Preview button to see how our post will look like, then we finish editing and click the Submit button, which sends the post to the site. Agree?

Sometimes, we want to insert a quote from another post into our text and copy it from there using three steps:
  1. Select - by mouse if we need a part of the text or by Ctrl+A if we would like to select all (as should be done for the contents of fixlog.txt)
  2. Copy - to copy selected stuff to the system buffer
  3. Paste - to insert the selected stuff from the system buffer to the destination place by our choice

In this case, it does not matter where exactly the piece of text was copied from - from another post or from a file, for example. Right?

If you agree with my reasoning and explanations, please tell me what exactly remained unclear for you and what prevented you from copying the technical notes from the file fixlog.txt and placing it as a quote in your post instead of attachment as you did.

Please don't hesitate to ask any additional questions!

Thank you,
pgmigg