Users of affected systems may have seen these warnings during install:
and they may see this entry in their list of installed Programs and Features:
and these services in their list of services running under Windows:
Malwarebytes can detect and remove PUP.Optional.Segurazo, but recent variants require this to be done in Safe Mode.
Please follow these instructions:
Run Malwarebytes from Safe Mode with Networking:
Step 1:
Boot into Safe Mode with Networking:
A Malwarebytes log of removal will look similar to this:
Malwarebytes www.malwarebytes.com-Log Details- Scan Date: 7/19/19 Scan Time: 11:36 AM Log File: c06d0aca-aa08-11e9-929a-00ffdcc6fdfc.json
-Software Information- Version: 3.7.1.2839 Components Version: 1.0.586 Update Package Version: 1.0.11626 License: Premium
-System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: METALLICA-PC\Metallica
-Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 236547 Threats Detected: 96 Threats Quarantined: 96 Time Elapsed: 7 min, 26 sec
-Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect
-Scan Details- Process: 3 PUP.Optional.Segurazo, C:\PROGRAMDATA\SEGURAZO\SEGURAZOIC.EXE, Quarantined, [1510], [709536],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\SegurazoService.exe, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\ProgramData\Segurazo\SegurazoWD.exe, Quarantined, [1510], [709093],1.0.11626
Module: 5 PUP.Optional.Segurazo, C:\PROGRAMDATA\SEGURAZO\SEGURAZOIC.EXE, Quarantined, [1510], [709536],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\SegurazoEngine.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\SegurazoService.exe, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\ProgramData\Segurazo\SegurazoEngine.dll, Quarantined, [1510], [709093],1.0.11626 PUP.Optional.Segurazo, C:\ProgramData\Segurazo\SegurazoWD.exe, Quarantined, [1510], [709093],1.0.11626
Registry Key: 29 PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\Segurazo, Quarantined, [1510], [709100],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\CLSID\{BFD98515-CD74-48A4-98E2-13D209E3EE4F}, Quarantined, [1510], [709095],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BFD98515-CD74-48A4-98E2-13D209E3EE4F}\InprocServer32, Quarantined, [1510], [709095],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{BFD98515-CD74-48A4-98E2-13D209E3EE4F}, Quarantined, [1510], [709095],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{BFD98515-CD74-48A4-98E2-13D209E3EE4F}\InprocServer32, Quarantined, [1510], [709095],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\CLSID\{BFD98515-CD74-48A4-98E2-13D209E3EE4F}\InprocServer32, Quarantined, [1510], [709095],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BFD98515-CD74-48A4-98E2-13D209E3EE4F}, Quarantined, [1510], [709095],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\SegurazoAntivirus, Quarantined, [1510], [709101],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\Segurazo, Quarantined, [1510], [709100],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\TRACING\segurazoclient_RASAPI32, Quarantined, [1510], [709099],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\.LNK\SHELLEX\CONTEXTMENUHANDLERS\SegurazoShellExtension.FileContextMenuExt, Quarantined, [1510], [709528],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\SegurazoShellExtension.FileContextMenuExt, Quarantined, [1510], [709528],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\SegurazoShellExtension.FileContextMenuExt, Quarantined, [1510], [709097],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\TRACING\segurazoclient_RASMANCS, Quarantined, [1510], [709099],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\SegurazoShellExtension.FileContextMenuExt, Quarantined, [1510], [709098],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\SegurazoShellExtension.FileContextMenuExt, Quarantined, [1510], [709096],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\TRACING\SegurazoService_RASAPI32, Quarantined, [1510], [709099],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\*\SHELLEX\CONTEXTMENUHANDLERS\SegurazoShellExtension.FileContextMenuExt, Quarantined, [1510], [709530],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\TRACING\SegurazoService_RASMANCS, Quarantined, [1510], [709099],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\SegurazoShellExtension.FileContextMenuExt, Quarantined, [1510], [709530],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.LNK\SHELLEX\CONTEXTMENUHANDLERS\SegurazoShellExtension.FileContextMenuExt, Quarantined, [1510], [709530],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\TRACING\SegurazoWD_RASAPI32, Quarantined, [1510], [709099],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\TRACING\SegurazoWD_RASMANCS, Quarantined, [1510], [709099],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\SegurazoShellExtension.FileContextMenuExt, Quarantined, [1510], [709530],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\SegurazoShellExtension.FileContextMenuExt, Quarantined, [1510], [709530],1.0.11626 PUP.Optional.Segurazo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SegurazoIC, Quarantined, [1510], [709536],1.0.11626 PUP.Optional.Segurazo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SegurazoSvc, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Segurazo, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SegurazoWD, Quarantined, [1510], [709093],1.0.11626
Registry Value: 3 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BFD98515-CD74-48A4-98E2-13D209E3EE4F}|, Quarantined, [1510], [709095],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\CLSID\{BFD98515-CD74-48A4-98E2-13D209E3EE4F}|, Quarantined, [1510], [709095],1.0.11626 PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{BFD98515-CD74-48A4-98E2-13D209E3EE4F}|, Quarantined, [1510], [709095],1.0.11626
Registry Data: 0 (No malicious items detected)
Data Stream: 0 (No malicious items detected)
Folder: 8 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\amd64, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\Cache, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x64, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x86, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\SEGURAZO, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\SEGURAZO, Quarantined, [1510], [709092],1.0.11626 PUP.Optional.Segurazo, C:\PROGRAMDATA\SEGURAZO, Quarantined, [1510], [709093],1.0.11626 PUP.Optional.Segurazo, C:\USERS\METALLICA\APPDATA\ROAMING\SEGURAZOCLIENT, Quarantined, [1510], [709094],1.0.11626
File: 48 PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\SEGURAZO\SEGURAZOSHELL64_V1069.DLL, Quarantined, [1510], [709095],1.0.11626 PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\SEGURAZO\SEGURAZOSHELL86_V1069.DLL, Quarantined, [1510], [709095],1.0.11626 PUP.Optional.Segurazo, C:\PROGRAMDATA\SEGURAZO\SEGURAZOIC.EXE, Quarantined, [1510], [709536],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\amd64\KernelTraceControl.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\amd64\msdia140.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x64\7z64.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x64\ext_x64.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x64\lz4_x64.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x64\rsEngineFW_x64.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x64\rsEnginePM_x64.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x64\rsLggrServer_x64.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x64\System.Data.SQLite.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x86\7z86.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x86\ext_x86.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x86\KernelTraceControl.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x86\lz4_x86.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x86\msdia140.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x86\rsEngineFW_x86.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x86\rsEnginePM_x86.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x86\rsLggrServer_x86.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\x86\System.Data.SQLite.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\SegurazoService.exe.config, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\Errors.dat, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\ExclusionsList.dat, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\Microsoft.Diagnostics.Tracing.TraceEvent.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\Microsoft.Win32.TaskScheduler.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\rsEngine.config, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\rsEngine.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\rsEngineHelper.exe, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\rsEngineHelper.exe.config, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\rsEngineSDK.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\SegurazoClient.exe, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\SegurazoClient.exe.config, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\SegurazoEngine.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\SegurazoService.config, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\SegurazoService.exe, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\SegurazoTools.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\SegurazoUninstaller.exe, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\SegurazoUninstaller.exe.config, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\System.Threading.dll, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\Program Files (x86)\Segurazo\uninstaller.ico, Quarantined, [1510], [709091],1.0.11626 PUP.Optional.Segurazo, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Segurazo\Segurazo Antivirus.lnk, Quarantined, [1510], [709092],1.0.11626 PUP.Optional.Segurazo, C:\ProgramData\Segurazo\SegurazoEngine.dll, Quarantined, [1510], [709093],1.0.11626 PUP.Optional.Segurazo, C:\ProgramData\Segurazo\SegurazoWD.config, Quarantined, [1510], [709093],1.0.11626 PUP.Optional.Segurazo, C:\ProgramData\Segurazo\SegurazoWD.exe, Quarantined, [1510], [709093],1.0.11626 PUP.Optional.Segurazo, C:\ProgramData\Segurazo\SegurazoWD.exe.config, Quarantined, [1510], [709093],1.0.11626 PUP.Optional.Segurazo, C:\Users\Metallica\AppData\Roaming\segurazoclient\segurazoclientConfig.xml, Quarantined, [1510], [709094],1.0.11626 PUP.Optional.Segurazo, C:\USERS\METALLICA\DESKTOP\SEGURAZOSETUP.EXE, Quarantined, [1510], [709102],1.0.11626
Physical Sector: 0 (No malicious items detected)
WMI: 0 (No malicious items detected)
(end)
Should users wish to keep this program and exclude it from being detected in future scans, they can add the program to the exclusions list. Here’s how to do it.
You may see these entries in FRST logs:
Select your language