What allows for reinfection of the same PUP after quarantine and removal?

Question

I use an antimalware program- the scan finds a PUP (Potentially Unwanted Program), which is quarantined and removed. It comes back! I am guessing it is stored somehow to resurface after normal shut down and reboot. Where can this be hiding out? Someone suggested Google Drive? PUP's location in file says C User (my Wife) App Data Local Google Chrome User Data Default Extension then a string of random letters. It found this same instance 40 times of the same PUP on recent scan, but I thought this was taken care of when I first found this along time ago. I can find the same string of letters if I search verbatim in Google search. Google Forum said: I'd recommend running a scan on your computer with a trusted anti-virus software. If the scan detects any suspicious programs or applications, remove them immediately. Which is what I have done over and over..

Answer 1

Related question: Can Chrome sync be infected?

It sounds like the user is signed in to Chrome sync, which by default syncs extensions. Having an unwanted extension keep installing itself via the browser's Sync feature has happened to me and my users several times.

When your antivirus program removes the extension, Chrome Sync only sees that the extension isn't installed on that device, but it's still in your list of extensions in the cloud, so Sync re-installs the extension.

This might be difficult to fix, depending on the number of machines where the user has signed in to Chrome sync.

The fix:

1. On every machine where the user has Chrome Sync turned on, go to chrome://settings/syncSetup and click "Turn off".
   • This is the hardest step. If you miss a machine, the next time that machine is turned on, Chrome Sync will sync that machine's extensions list to the cloud, and install all of them on your other synced machines.
     
2. On every machine where the user had Chrome Sync turned on, go to chrome://extensions/ and remove the extension.
   • If you're not sure which one it is, I recommend removing all the extensions, just to be safe.
   • If you really don't want to remove all of them, enter chrome://extensions/?id=EXTENSIONID in the address bar, where EXTENSIONID is the ID from the %localappdata%\Google\Chrome\User Data\Default\Extensions folder you mentioned. That will bring up the specific extension, if it's still installed.
     
3. Go to https://chrome.google.com/sync, scroll to the bottom, and click "Clear data."
   • This will only delete the copy of the synced data stored in the cloud, not the copy stored on your machines, so you don't have to worry about losing saved passwords or bookmarks. This is also why it is so important to remove the extension from every machine with sync turned on.
4. If desired, sign back in to Chrome sync.

Answer 2

If the program is in Google Chrome's User App Data folder, it is probably being downloaded as a temporary internet file. Every Time a user browses a website, the page is downloaded to that folder. So either your wife has downloaded multiple versions of a malicious file, or she keeps going to the same page to download the PUP. To eliminate the possibility there are just a lot of instances of the file, try deleting Google's entire folder in App Data and restarting the browser.

Other more advanced techniques could include a root kit, or a malicious version of chrome, but these are less likely.

Answer 3

You need to find the infector file. You might have installed a shady desktop application or a chrome plugin.