@ wrote:

I hve been hit with malware   Browser Champion   It is detected and program says removed but keeps popping its head up again    Have gone thru removal process a number of times   no luck in being perminent

 

any suggestions

Hello nosinrub.

 

Welcome to the Community!

 

Please follow the instructions below!

 

 

What you are seeing and describing sounds like it may be what we on the Community refer to as a PUA. (Potentially Unwanted Application) These are very annoying at best in that they cause pop-us, redirect your browser home page, and other behavior that may slow down the computer and direct ads your way, but they are not actually doing anything bad like damaging files or stealing information. Often they are installed intentionally by you the user as browser add-ons for various tasks such as quick search tools.. but they also come with the result of added annoying pop-ups and ads. Other times they 'piggy back' with other software that you installed, or try to 'sneak' onto your system entirely.

 

WSA does detect and remove many PUA's, and more are being added, but WSA does not detect all of them. A simple browser add-on with PUA behavior that is easy to identify and easy to remove is not likely to be detected and removed by WSA. Those that are intentionally difficult to locate and remove are. Please see THIS LINK for more information regarding Webroot's stance on these annoying programs.

 

For those that are not detected by WSA, please see this KB Article. It has some easy to follow directions on locating and removing PUA's. You may also want to submit a Trouble Ticket, especially if you cannot remove it easily from the directions in the KB Article.

 

For those that ARE detected by WSA, but cannot be removed automatically, you can submit a Trouble Ticket.  Webroot Support will help you get these annoying 'crapware' off your computer at no extra charge, and the additional examples may help to better automatic removal of that particular PUA for all users in the future.

 

To make sure that your WSA is checking for PUA's with the best proficiently, it sometimes helps to reset the PUA detection within WSA's settings. For PUA's that had previously been scanned and determined to be OK, but have since been added to detection/removal, you may want to complete the following steps:

 

• Open Webroot SecureAnywhere
  
• Click on ‘Advanced Settings’ from the top right
  
• Select ‘Scan Settings’ from the left side
  
• Unselect the option “Detect Potentially Unwanted Applications”
  
• Click on the Save button (you may have to enter in a CAPTCHA)
  
• Reselect the option to “Detect Potentially Unwanted Applications”
  
• Click on the Save button
  
• Run another scan with Webroot and remove any items that get detected.

To help avoid PUA's in the future, remember to read all of the information when installing or updating software (Adobe downloads often have those "extra special offers"attached... PUA'S!: often the PUA included will be mentioned, and you can opt out of installing it.  Those check boxes you see? Usually only one of them is for the User Agreement of the software you want, the others are for the junk you don't.

 

 I hope this helps you both understand, and resolve the problem and if not please let us know!

 

 

 

NOTE: As noted above, PUA's that:

 

• Come in with other downloads
  
• Have a clear opt out ability prior to install

 

are often NOT detected and removed.  This is partly for legal reasons: the source of the download can complain about it's extra software being blocked automatically by Webroot.  There may be to allow WSA to recognize and block a LOT more PUA's than it currently can.  Please see THIS IDEA for more information, and give a KUDO if you agree.  User Idea requests are noted by the Webroot Team, and the more Kudo's on an Idea the more likely we may see dev time devoted to it.

 

 

 

Thanks!

 

---

Hi nosinrub

 

Not sure if this is of any assistance further to that provided by Sherry, but as you have not posted back to advise as to your status re. this I thought I would for completeness.

 

It does look like this particular piece of malware has some 30 odd Registry entires related to it; either amendments or additions, and given this I would recommend that you use the Support Ticket option included in Sherry's post rather than trying any removal yourself, especially if you are not particularly confindent tweaking the Registry.

 

Do post back and let us know what the position is re. this issue for you...we always like to know/hear back as and when possible.

 

Regards, Baldrick

---

Thank you I will be trying the trouble ticket tomorrow     I will let you know how this works to solve my issue

 

 

---

did the trouble ticket approach   followed all directions     did the deep scan  found nothing    on reboot   browser champion was there again    even had note that it was serving as proxy protection mode

 

not sure where to go now

---

Back to the Support Ticket again and tell them it didn't work and do a remote session if need be!

 

Thanks,

 

Daniel 😉

---

had tech support do on line remote help     problem has been  eliminated    everything is working great   Thanks to all who gave assistance

 

bob

---

Bob, 

 

Excellent, glad to hear things are up and going!  Thank you for the reply and letting us know!

---

Great to hear nosinrub!



Thanks for getting back to us! 🙂

---