Wednesday, April 16, 2014

How to Remove - PUP.Optional.PCPerformer.A Found








PUP.Optional.PCPerformer.A Found


PUP.Optional.PCPerformer.A is flagged by installed anti-virus program with the location: c:/windows/system32/roboot64.exe. At the sight of the detected item, victims would think of PC Performer, the application that has been widely considered to be rogue anti-virus program due to its malicious deeds.



PUP.Optional.PCPerformer.A Concerns


Is PUP.Optional.PCPerformer.A indicating that the computer has PC Performer?

Not necessarily. PUP.Optional.PCPerformer.A is a PUP (Potentially Unwanted Program) that helps intercept traffic for product promotion. Thus it would cooperate with other promotional tools including browser hijacker, other PUPs, adware and toolbars. Well, PUP.Optional.PCPerformer.A can be brought in by PCPerformer to redirect people to registration web site.

What PUP.Optional.PCPerformer.A would do to me?
As a PUP (not technically virus), PUP.Optional.PCPerformer.A may pop up ads, trigger some browser redirector or hijacker and even help install tool bar to get as much traffic as it can so as to help promote the products made by its creator. In other word, mass on browser will definitely be incurred.



Potential Dangers from PUP.Optional.PCPerformer.A Should be Noticed 


Though PUP.Optional.PCPerformer.A itself is not dangerous (it works simply like a device driver to empower other applications), it could be the blasting fuse that would trigger additional infiltration by virus.

As a machine to intercept as much traffic as possible, the PUP application would build unrestrained co-operations with other promotional tools and the sites owning huge traffic; there’s no filtering work to rule out some spam sites since there are numerous promotional tools to replace PUP.Optional.PCPerformer.A once it is punished or widely deleted by PC users. One should know that bugs can be detected on spam sites and it is the commonly utilized item by virus to start penetration.

As an application to help push products effectively, PUP.Optional.PCPerformer.A would collect victims’ online whereabouts so that its creator would get to know where to put ads after the application uploading such information through its backdoor program. Being one of the numerous promotional tools, PUP.Optional.PCPerformer.A is not strictly built and so is its backdoor program, which leaves fat chance for infections in the wild to exploit the backdoor and wage infiltration.

Below is the instruction to show how to remove PUP.Optional.PCPerformer.A. Since it is not virus, manual removal method is recommended for a complete removal. Follow up and help yourself. Any help request will be answered if you contact Global PC Support Center and start a live chat here.
live chat to get expert help in removing PUP.Optional.PCPerformer.A




How to Remove PUP.Optional.PCPerformer.A Completely?



1. Run full scan with reputable anti-virus program again, try to remove any possible items.



2. Show hidden files and folders.

Windows 8
Start screen > open any folder > open Windows Explorer > select View tab > Tick ‘File name extensions’ and ‘Hidden items’ options > mainly navigate to C:\windows\winstart.bat, C:\windows\wininit.ini and C:\windows\Autoexec.bat to find and delete every files and folders created on the day when PUP.Optional.PCPerformer.A was firstly detected.

Windows 7/XP/VistaClick open ‘Control Panel’ > search for ‘Folder Options’ > tap View tab > tick ‘Show hidden files and folders' and non-tick 'Hide protected operating system files (Recommended)’ > press ‘OK’ > mainly navigate to C:\windows\winstart.bat, C:\windows\wininit.ini and C:\windows\Autoexec.bat to find and delete every files and folders created on the day when PUP.Optional.PCPerformer.A was firstly detected.


When done, access the following directories and remove the given items.
  1. C:\Users\Daryn\AppData\Local\Temp\
  2. C:\Users\darynspilsbury\AppData\Local\Temp\
  3. C:\Users\Daryn\AppData\Local\Temp\ct2504091[or other folders with unreasonable combination of letters and numbers]\
  4. C:\Users\darynspilsbury\AppData\Local\Temp\ct2504091[or other folders with unreasonable combination of letters and numbers]\
  5. c:/windows/system32/roboot64.exe 
  6. c:\users\[username]\appdata\locallow\the item triggered by PUP.Optional.PCPerformer.A.




3. Go to Regedit and manage database there.

Windows 8
Move your mouse over lower right screen to get charms bar and type ‘regedit’/‘regedit.exe’, then hit Enter key.

Windows 7/XP/Vista
Access Start menu to select Run; then type ‘regedit’ and hit Enter key.

navigate to the following entries respectively and find and remove suspicious key value started with “Run” and delete accordingly.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curren Version
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Startup="C:\windows\start menu\programs\startup




4. Search for and remove the items related to PUP.Optional.PCPerformer.A.

Click open random folder and hit on Search icon, type "PUP.Optional.PCPerformer.A" in all the search blanks and hit Enter button so as to remove all the detection.




Though it has been made clear that PUP.Optional.PCPerformer.A is not literally a virus, it could bring in additional infections due to its loose structure. There have been many more aggressive promotions nowadays and it is not strange to detect this one. On the occurrence of extra virus, one should remove virus before taking down PUP.Optional.PCPerformer.A as the PUP will be kept being utilized by virus. Thus the PUP will not be removed if other infections are alive. Victims should also be informed that there’s no “all-in-one” to get rid of PUP.Optional.PCPerformer.A as some path could vary from OS, BIOS and structure. Should you encounter difficulty in removing PUP.Optional.PCPerformer.A, you may want to get exclusive help according to your concrete situation.  
get expert help in removing PUP.Optional.PCPerformer.A


Reference:

PUP (Potentially Unwanted Program) – Wikipedia




No comments: