PUP.Optional.PCOptimizerPro

Short bio

PUP.Optional.PCOptimizerPro is Malwarebytes’ detection name for a system optimizer for Windows systems and was released by XportSoft Technologies.

GUI PUP.Optional.PCOptimizerPro

Symptoms

On affected systems users may notice this entry in their list of installed Programs and Features:

PUP.Optional.PCOptimizerPro is installed

and a host of Scheduled Tasks simialr to these:

PUP.Optional.PCOptimizerPro Scheduled Tasks

Scheduled Tasks PUP.Optional.PCOptimizerPro

these icons on their desktop, in their taskbar, their startmenu and in their right-click menu:

PUP.Optional.PCOptimizerPro icons

Type and source of the infection

PUP.Optional.PCOptimizerPro identifies “problems” on the affected system that it promises to remove with the paid version.

PUP.Optional.PCOptimizerPro only the paid version fixes

PUP.Optional.PCOptimizerPro is installed by users as a result of aggressive advertising.

Protection

Malwarebytes protects users from PUP.Optional.PCOptimizerPro by using real-time protection.

Malwarebytes blocks PUP.Optional.PCOptimizerPro

and by blocking their domain:

Malwarebytes blocks pcoptimizerpro.com

Remediation

Malwarebytes can detect and remove PUP.Optional.PCOptimizerPro without further user interaction.

Please download Malwarebytes to your desktop.
Double-click MBSetup.exe and follow the prompts to install the program.
When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
Click on the Get started button.
Click Scan to start a Threat Scan.
Click Quarantine to remove the found threats.
Reboot the system if prompted to complete the removal process.

Malwarebytes removal log

A Malwarebytes log of removal will look similar to this:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 5/30/18
Scan Time: 10:34 AM
Log File: 54d13cad-63e4-11e8-bf52-080027235d76.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.5302
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 240721
Threats Detected: 61
Threats Quarantined: 61
Time Elapsed: 2 min, 42 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 1
PUP.Optional.PCOptimizerPro, C:\PROGRAM FILES\PC OPTIMIZER PRO\PCOPTIMIZERPRO.EXE, Quarantined, [1261], [392397],1.0.5302

Module: 2
PUP.Optional.PCOptimizerPro, C:\PROGRAM FILES\PC OPTIMIZER PRO\PCOPTPROCTXMENU.DLL, Quarantined, [1261], [333184],1.0.5302
PUP.Optional.PCOptimizerPro, C:\PROGRAM FILES\PC OPTIMIZER PRO\PCOPTIMIZERPRO.EXE, Quarantined, [1261], [392397],1.0.5302

Registry Key: 23
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\PC Optimizer Pro64 Scan, Quarantined, [1261], [325246],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{40C0E937-E245-4E4D-AFA0-ADF8A091AB63}, Quarantined, [1261], [325246],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\PLAIN\{40C0E937-E245-4E4D-AFA0-ADF8A091AB63}, Quarantined, [1261], [325246],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\PC Optimizer Pro64 startups, Quarantined, [1261], [325246],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C5B23C4D-31C2-446E-B432-247FDD101532}, Quarantined, [1261], [325246],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{C5B23C4D-31C2-446E-B432-247FDD101532}, Quarantined, [1261], [325246],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\PC Optimizer Pro Idle, Quarantined, [1261], [260291],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{B74B0B8F-207E-4606-A368-EB857B144DC9}, Quarantined, [1261], [260291],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\PLAIN\{B74B0B8F-207E-4606-A368-EB857B144DC9}, Quarantined, [1261], [260291],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\PC Optimizer Pro Updates, Quarantined, [1261], [260291],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{D564F511-6242-41BA-975D-6AD0875B8DF0}, Quarantined, [1261], [260291],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\PLAIN\{D564F511-6242-41BA-975D-6AD0875B8DF0}, Quarantined, [1261], [260291],1.0.5302
PUP.Optional.PCOptimizerPro, HKCU\SOFTWARE\PC OPTIMIZER PRO, Quarantined, [1261], [260294],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\PC OPTIMIZER PRO, Quarantined, [1261], [260298],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\PC Optimizer Pro, Quarantined, [1261], [333185],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\CLASSES\INTERFACE\{12AB121E-44C6-488B-8773-B0AE25E662E1}, Quarantined, [1261], [333184],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{12AB121E-44C6-488B-8773-B0AE25E662E1}, Quarantined, [1261], [333184],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{12AB121E-44C6-488B-8773-B0AE25E662E1}, Quarantined, [1261], [333184],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\CLASSES\TYPELIB\{003B9C22-6FE0-4BCA-A73F-9AA99B9BBDAA}, Quarantined, [1261], [333184],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{003B9C22-6FE0-4BCA-A73F-9AA99B9BBDAA}, Quarantined, [1261], [333184],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\CLASSES\CLSID\{203ABD21-41F1-4F1B-BAE3-D6A89A90D239}, Quarantined, [1261], [333184],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\CLASSES\CLSID\{203ABD21-41F1-4F1B-BAE3-D6A89A90D239}\InprocServer32, Quarantined, [1261], [333184],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{003B9C22-6FE0-4BCA-A73F-9AA99B9BBDAA}, Quarantined, [1261], [333184],1.0.5302

Registry Value: 12
PUP.Optional.PCOptimizerPro, HKCU\SOFTWARE\PC OPTIMIZER PRO|ISAINS, Quarantined, [1261], [260294],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES|PC OPTIMIZER PRO64 STARTUPS.JOB, Quarantined, [1261], [411376],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES|PC OPTIMIZER PRO64 STARTUPS.JOB.FP, Quarantined, [1261], [411376],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES|PC OPTIMIZER PRO UPDATES.JOB, Quarantined, [1261], [411376],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES|PC OPTIMIZER PRO UPDATES.JOB.FP, Quarantined, [1261], [411376],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES|PC OPTIMIZER PRO IDLE.JOB, Quarantined, [1261], [411376],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES|PC OPTIMIZER PRO IDLE.JOB.FP, Quarantined, [1261], [411376],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES|PC OPTIMIZER PRO64 SCAN.JOB, Quarantined, [1261], [411376],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES|PC OPTIMIZER PRO64 SCAN.JOB.FP, Quarantined, [1261], [411376],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\PC OPTIMIZER PRO|PUBLISHER, Quarantined, [1261], [260298],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{40C0E937-E245-4E4D-AFA0-ADF8A091AB63}|PATH, Quarantined, [1261], [325241],1.0.5302
PUP.Optional.PCOptimizerPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C5B23C4D-31C2-446E-B432-247FDD101532}|PATH, Quarantined, [1261], [325241],1.0.5302

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.PCOptimizerPro, C:\ProgramData\PC Optimizer Pro\LOGS, Quarantined, [1261], [182300],1.0.5302
PUP.Optional.PCOptimizerPro, C:\PROGRAMDATA\PC OPTIMIZER PRO, Quarantined, [1261], [182300],1.0.5302
PUP.Optional.PCOptimizerPro, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\PC OPTIMIZER PRO, Quarantined, [1261], [182301],1.0.5302

File: 20
PUP.Optional.PCOptimizerPro, C:\USERS\PUBLIC\DESKTOP\PC OPTIMIZER PRO.LNK, Quarantined, [1261], [260289],1.0.5302
PUP.Optional.PCOptimizerPro, C:\USERS\{username}\APPDATA\ROAMING\MICROSOFT\INTERNET EXPLORER\QUICK LAUNCH\PC OPTIMIZER PRO.LNK, Quarantined, [1261], [260312],1.0.5302
PUP.Optional.PCOptimizerPro, C:\WINDOWS\SYSTEM32\TASKS\PC Optimizer Pro64 Scan, Quarantined, [1261], [325246],1.0.5302
PUP.Optional.PCOptimizerPro, C:\WINDOWS\SYSTEM32\TASKS\PC Optimizer Pro64 startups, Quarantined, [1261], [325246],1.0.5302
PUP.Optional.PCOptimizerPro, C:\WINDOWS\SYSTEM32\TASKS\PC Optimizer Pro Idle, Quarantined, [1261], [260291],1.0.5302
PUP.Optional.PCOptimizerPro, C:\WINDOWS\SYSTEM32\TASKS\PC Optimizer Pro Updates, Quarantined, [1261], [260291],1.0.5302
PUP.Optional.PCOptimizerPro, C:\WINDOWS\TASKS\PC Optimizer Pro64 Scan.job, Quarantined, [1261], [325247],1.0.5302
PUP.Optional.PCOptimizerPro, C:\WINDOWS\TASKS\PC Optimizer Pro64 startups.job, Quarantined, [1261], [325247],1.0.5302
PUP.Optional.PCOptimizerPro, C:\WINDOWS\TASKS\PC Optimizer Pro Idle.job, Quarantined, [1261], [260292],1.0.5302
PUP.Optional.PCOptimizerPro, C:\WINDOWS\TASKS\PC Optimizer Pro Updates.job, Quarantined, [1261], [260292],1.0.5302
PUP.Optional.PCOptimizerPro, C:\ProgramData\PC Optimizer Pro\LOGS\REG_LOGS_05_30_2018_10_26_41_AM.log, Quarantined, [1261], [182300],1.0.5302
PUP.Optional.PCOptimizerPro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Optimizer Pro\Live Support.url, Quarantined, [1261], [182301],1.0.5302
PUP.Optional.PCOptimizerPro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Optimizer Pro\PC Optimizer Pro.lnk, Quarantined, [1261], [182301],1.0.5302
PUP.Optional.PCOptimizerPro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Optimizer Pro\Uninstallation Guide.url, Quarantined, [1261], [182301],1.0.5302
PUP.Optional.PCOptimizerPro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Optimizer Pro\Visit Website.url, Quarantined, [1261], [182301],1.0.5302
PUP.Optional.PCOptimizerPro, C:\PROGRAM FILES\PC OPTIMIZER PRO\PCOPTPROCTXMENU.DLL, Quarantined, [1261], [333184],1.0.5302
PUP.Optional.PCOptimizerPro, C:\PROGRAM FILES\PC OPTIMIZER PRO\PCOPTIMIZERPRO.EXE, Quarantined, [1261], [392397],1.0.5302
PUP.Optional.PCOptimizerPro, C:\USERS\{username}\DESKTOP\PCOPTIMIZERPROINSTALLER.EXE, Quarantined, [1261], [392397],1.0.5302
PUP.Optional.PCOptimizerPro, C:\PROGRAM FILES\PC OPTIMIZER PRO\PCOPTPROTRAYS.EXE, Quarantined, [1261], [115333],1.0.5302
PUP.Optional.PCOptimizerPro, C:\PROGRAM FILES\PC OPTIMIZER PRO\UNINST.EXE, Quarantined, [1261], [392397],1.0.5302

Physical Sector: 0
(No malicious items detected)


(end)

Add an exclusion

Should users wish to keep this program and exclude it from being detected in future scans, they can add the program to the exclusions list. Here’s how to do it.

Open Malwarebytes for Windows.
Click the Detection History
Click the Allow List
To add an item to the Allow List, click Add.
Select the exclusion type Allow a file or folder and use the Select a folder button to select the main folder for the software that you wish to keep.
Repeat this for any secondary files or folder(s) that belong to the software.

If you want to allow the program to connect to the Internet, for example to fetch updates, also add an exclusion of the type Allow an application to connect to the internet and use the Browse button to select the file you wish to grant access.

Traces/IOCs

You may see these entries in FRST logs:

(Xportsoft Technologies) C:\Program Files\PC Optimizer Pro\PCOptimizerPro.exe
C:\Windows\System32\Tasks\PC Optimizer Pro Updates
C:\Windows\System32\Tasks\PC Optimizer Pro64 Scan
C:\Windows\System32\Tasks\PC Optimizer Pro Idle
C:\Windows\System32\Tasks\PC Optimizer Pro64 startups
C:\Users\Public\Desktop\PC Optimizer Pro.lnk
C:\Windows\Tasks\PC Optimizer Pro Updates.job
C:\Windows\Tasks\PC Optimizer Pro Idle.job
C:\Windows\Tasks\PC Optimizer Pro64 startups.job
C:\Windows\Tasks\PC Optimizer Pro64 Scan.job
C:\ProgramData\PC Optimizer Pro
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Optimizer Pro
C:\Program Files\PC Optimizer Pro

PC Optimizer Pro (HKLM\...\PC Optimizer Pro) (Version: 8.1.1.3 - Xportsoft Technologies) <==== ATTENTION
Task: {40C0E937-E245-4E4D-AFA0-ADF8A091AB63} - System32\Tasks\PC Optimizer Pro64 Scan => C:\Program Files\PC Optimizer Pro\StartApps.exe [2018-05-14] (Xportsoft Technologies) <==== ATTENTION
Task: {B74B0B8F-207E-4606-A368-EB857B144DC9} - System32\Tasks\PC Optimizer Pro Idle => C:\Program Files\PC Optimizer Pro\StartApps.exe [2018-05-14] (Xportsoft Technologies) <==== ATTENTION
Task: {C5B23C4D-31C2-446E-B432-247FDD101532} - System32\Tasks\PC Optimizer Pro64 startups => C:\Program Files\PC Optimizer Pro\StartApps.exe [2018-05-14] (Xportsoft Technologies) <==== ATTENTION
Task: {D564F511-6242-41BA-975D-6AD0875B8DF0} - System32\Tasks\PC Optimizer Pro Updates => C:\Program Files\PC Optimizer Pro\StartApps.exe [2018-05-14] (Xportsoft Technologies) <==== ATTENTION
Task: C:\Windows\Tasks\PC Optimizer Pro Idle.job => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
Task: C:\Windows\Tasks\PC Optimizer Pro Updates.job => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
Task: C:\Windows\Tasks\PC Optimizer Pro64 Scan.job => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
Task: C:\Windows\Tasks\PC Optimizer Pro64 startups.job => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION