[SpaghettiOs]

It says....

 

"Detected: PUA:Win32/uTorrent

Status: Active

Affected Items: file: C:\Users\Moi\AppData\Roaming\BitTorrent\BitTorrent.exe"

 

I uninstalled BitTorrent from my pc and security still detects the PUP. I'm lost as to what to do now. Idk what I downloaded to get it. I do sometimes download PDF from google search. Maybe from there? There's nothing I downloaded recently that I can recall other than mobo/gpu updates, some things off Microsoft store, some twitch extensions for chrome, and the occasional pdf off google search. How do I get rid of this? 

 

Thanks.

[Advertisements]

Hi, SpaghettiOS.
 
Welcome to GTG Forums.
 
You say "security still detects it". What is the security software you use? Isn't there an option to send the detected file to quarantine? 
 
If you want us to check your computer for malware, please do the following:

Download Farbar Recovery Scan Tool and save it to your desktop. 

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

>>>> If your antivirus software detects the tool as malicious, it’s safe to allow FRST to run. It is a false-positive detection.

>>>> If English is not your primary language, right click on FRST.exe/FRST64.exe and rename to FRSTEnglish.exe/FRST64English.exe

• Double-click the FRST icon to run the tool. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach the content of these two logs in your next reply.

(To attach the files, click on the More Reply Options at the bottom right of the reply area, and then choose Attach File)

[DR M]

Hi, SpaghettiOS.
 
Welcome to GTG Forums.
 
You say "security still detects it". What is the security software you use? Isn't there an option to send the detected file to quarantine? 
 
If you want us to check your computer for malware, please do the following:

Download Farbar Recovery Scan Tool and save it to your desktop. 

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

>>>> If your antivirus software detects the tool as malicious, it’s safe to allow FRST to run. It is a false-positive detection.

>>>> If English is not your primary language, right click on FRST.exe/FRST64.exe and rename to FRSTEnglish.exe/FRST64English.exe

• Double-click the FRST icon to run the tool. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach the content of these two logs in your next reply.

(To attach the files, click on the More Reply Options at the bottom right of the reply area, and then choose Attach File)

[SpaghettiOs]

I just use windows security and occasionally scan my pc with Malwarebytes. That's it as far as security goes because I heard that was good enough. Yesterday decided to install Unchecky but idk if that's any good.

I did send it to quarantine but scan after scan it says the same thing about it being active. 

Is there anything you recommend for security purposes?

______

Edited by SpaghettiOs, 16 December 2021 - 09:21 PM.

[SpaghettiOs]

Here are the logs, attached files.

Attached Files

•  Addition_16-12-2021 16.19.30.txt   79.65KB   169 downloads
•  FRST_16-12-2021 16.19.30.txt   109.77KB   164 downloads

[DR M]

Hello.

Thanks for waiting.

Please, adhere to the guidelines below, and then carefully follow, with the same order, all the instructions after:

1. Always ask before acting. Do not continue if you are not sure, or if something unexpected happens!

2. Do not run any tools unless instructed to do so. Also, do not uninstall or install any software during the procedure, unless I ask you to do so.

3. If your computer seems to start working normally, don't abandon the topic. Even if your system is behaving normally, there may still be some malware remnants left over. Additionally, malware can re-infect the computer if some remnants are left. Therefore, please complete all requested steps to make sure any malware is successfully eradicated from your PC.

4. You have to reply to my posts within 3 days. If you need some additional time, just let me know. Otherwise, I will leave the topic due to lack of feedback. If you are able, I would request you to check this thread at least once per day so that we can resolve your issues effectively and efficiently.

5. Logs from malware diagnostic or removal programs can take some time to get analyzed. Also, have in mind that all the experts here are volunteers and may not be available to assist when you post. Please, be patient, while I analyze your logs.
 
 
=========================================
 
1. Move FRST
 
Please move FRST onto your Desktop as instructed before. 
 
 
2. Question
 
Are the following entries known/trusted to you? 
 
109.94.209.70      fitgirlrepacks.co               # Fake FitGirl site
109.94.209.70      fitgirl-repacks.cc              # Fake FitGirl site
109.94.209.70      fitgirl-repack.com              # Fake FitGirl site
109.94.209.70      fitgirl-repacks.website         # Fake FitGirl site
109.94.209.70      www.fitgirlrepacks.co           # Fake FitGirl site
109.94.209.70      www.fitgirl-repacks.cc          # Fake FitGirl site
109.94.209.70      www.fitgirl-repack.com          # Fake FitGirl site
109.94.209.70      www.fitgirl-repacks.website     # Fake FitGirl site
109.94.209.70      ww9.fitgirl-repacks.xyz         # Fake FitGirl site
109.94.209.70      *.fitgirl-repacks.xyz           # Fake FitGirl site
109.94.209.70      fitgirl-repack.net              # Fake FitGirl site
 
 
3. FRST fix

Please do the following to run a FRST fix.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Download the attached fixlist and save it on your Desktop, next to the FRST tool.
• Right-click on FRST on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your Desktop.
• Please attach the log in your next reply.

 

 

[DR M]

Hi, SpaghettiOs.

 

I have to apologize here! Just saw that I forgot to attach the fixlist, so you can't run it! The worst, is that I deleted it. 

 

Since it's a lot of work, I need to know if you are still there. As soon as I have your response, I'll prepare the fix for you immediately! 

[SpaghettiOs]

Idk whether it's a site I personally trust but Fit-Girl is a (I think Russian) site for cracked games. I uninstalled all of the games I downloaded from that site a few months ago and don't download cracked games anymore so I'm not sure why the "#fake site" thing is around or what it means.... But it does seem a bit sketchy I guess. The last time I downloaded any games from that site was a year or two ago (earliest is early last year maybe), some time around there, but I never got any malware detection until recently. The date for the PUP says 8/23/2021.

 

 

I followed the instructions but when I press 'fix' it says: 

"No fixlist.txt found. The fixlist.txt should be in the same folder/directory the tool is located."

Am I doing something wrong?

[SpaghettiOs]

oops double post

Edited by SpaghettiOs, 19 December 2021 - 07:09 PM.

[DR M]

Hi, SpaghettiOs.

Thank you for replying.

I will prepare a fix for you tonight, my time.

[DR M]

Hello.
 
I wonder if I can call you something else instead of ... Spaghetti. Is there another name here? 
 
I prepared a fixlist for you to download.

• Download the attached fixlist and save it on your Desktop, next to the FRST tool.
• Right-click on FRST on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your Desktop.
• Please attach the log in your next reply.

Now, you will be able to run the fix correctly. 

Attached Files

•  fixlist.txt   63.81KB   166 downloads

[DR M]

Do you still need assistance? 

[SpaghettiOs]

You can call me Lasagna instead

lol jkjk

 

Call me DJ

 

So I downloaded the Fixlist.txt and put the shortcut next to the frst on the desktop then ran as admin, clicked fix but it says "no fixlist.txt found..." again. 

Any idea what could be happening?

[SpaghettiOs]

.

Edited by SpaghettiOs, 24 December 2021 - 01:10 AM.

[DR M]

Hi.
 
Above I asked you this:
 

4. You have to reply to my posts within 3 days. If you need some additional time, just let me know. Otherwise, I will leave the topic due to lack of feedback. If you are able, I would request you to check this thread at least once per day so that we can resolve your issues effectively and efficiently.

 

Please, if you really need help consider that. 

 

FRST fix probably didn't run, because you didn't move the FRST tool on the Desktop from D: 

 

Move FRST tool on the Desktop and then run the fix again. 

 

Thank you.

[SpaghettiOs]

Sorry about that, with Christmas around the corner I haven't been able to check in as regularly but I'll be more diligent about checking in from now on. I appreciate your patience.

Oh you're right. I was saving it directly from my download list instead of from the drive so now it's working.

 

 

 

Attached Files

•  Fixlog.txt   195.91KB   152 downloads