Stubborn PUA:Win32/InstallCore

Over three years of PC use and my first stubborn virus. Luckily this is on my disposable TV PC which I use to stream stuff... which is probably how I got this virus. Still I'm having no luck getting rid of this.

I get this --



Remove and Quarantine do nothing. Offline scanning via Microsoft tool doesn't fix it. Defender is up to date. Malwarebytes doesn't see it. Am I manually supposed to go to those locations in affected items and remove them. I don't see them, asked to see hidden files, still didn't seem them.

Update --

Defender sees it can't remove or quarantine
Malwarebytes doesn't see it
Norton Power Eraser doesn't see it -- and my research indicates it should
Cleared Caches of all browsers

False positive? Remnants of something?

Go to the Downloads folder and upload the .EXE file to VirusTotal.com for a second opinion.

OldNavyGuy said:

Go to the Downloads folder and upload the .EXE file to VirusTotal.com for a second opinion.

Thanks for reply ONG.

That's the thing -- I can't even SEE the file. Even if I asked Explore to 'show hidden files'. So Defender sees it but Malwarebytes and Norton Power Eraser do not.

The Pool Man said:

Thanks for reply ONG.

That's the thing -- I can't even SEE the file. Even if I asked Explore to 'show hidden files'. So Defender sees it but Malwarebytes and Norton Power Eraser do not.

Check this thread.

Windows Defender finds PUA:Win32/Keygen but can't remove it.

Callender said:

Quote from second link in Post #5

   Note

Since the implementation of W10 V2004, Windows Defender has now been defaulted to identify
PUPS as a threat. As a result, many are now made aware of their presence. And they are "remediated",
on the spot, to prevent them from causing any mischief.
The problem occurs on the subsequent scans with Windows Defender. It identifies the same PUP again, and again.

It has been determined that this is caused by the presence of the PUP in Protection History.
It appears that the default remediation that Windows Defender applies to PUPs is to Block them, then leave
them in Protection History .


Windows Defender is defaulted to scan its own "Scans/History". Resulting in the discovery of the PUP over and

over again. Even though, other scanners see no evidence of the PUP on the PC.

Thank you.

And a big thanks to everyone else. I had a feeling it was a false positive.

ok so last night I download an app was going to install it I got notify this from pua windows defender in 2004 that is block it saids that low status removed so I did delete app so i'm good right?


should I just let it sit in protection history and it will removed itself in 30 days or go ahead removed it?

I have one that seems to still be listed and not go away either. I'm also curious how to resolve this.