Share via

Can't seem to get rid of PUA:Win32/NetFilter

Anonymous
2021-08-10T17:28:51+00:00

Hi!

So I've been for 2 whole days now, scanning the PC with MSERT, Windows Defender and Malwarebytes. The prior and the latter present a clean result, however Windows Defender, after a full scan, always ends up showing up the PUA linked below. Whenever I click to remove it though, it just endlessly loads and does nothing.

I've cleaned the Windows Defender history and repeated the scanning process, and yet again, it's still showing me the same PUA.

What should I do

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Rob Koch 25,885 Reputation points Volunteer Moderator
2021-08-11T20:45:05+00:00

Note that it may or may not truly be a false positive, since some of the games bundled with various OEM computers have been known to perform less reputable operations like adware or even minor data collection, but in either case its detection as a PUP assigns it a lower concern even without the fact this particular item is inactive inside the Recovery partition .ppkg file.

It's this confusion that you're most likely to find in many of those other threads, since very few consumers understand any of this and so the FUD relating to them in these and other forums are rampant.

The difference in my case is a 40-year computing and security career, along with the willingness to actually read and understand not only the Microsoft articles describing these, 2 of which I linked in my first response above, as well as simply carefully examining the details you provided that called out exactly which compressed files, Recovery folder and other items were involved in the detection.

Few take the time to actually review this information and instead jump to conclusions regarding their removal. Since that's clearly impossible when contained in a compressed .ppkg file located on a Recovery partition, that's the only information you really need to understand as to why removal is failing and doesn't truly matter either.

Rob

Was this answer helpful?

7 people found this answer helpful.
0 comments

12 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rob Koch 25,885 Reputation points Volunteer Moderator
    2021-08-11T13:52:05+00:00

    Stop doing full scans with the MSERT or in fact most any scanner unless you've already recently experienced a confirmed malware detection by your installed antivirus or highly suspect that malware exists for another reason.

    I say this exactly because of situations like this one, since all full scans by any scanner are notoriously likely to display false positive detections, because they're performed out of context with where active malware is known to operate.

    This can often result in the detection of either "dead" malware remnants in cache, other temporary folders or embedded within Window IMage (WIM), Provisioning package (.ppkg) or other compressed files where they clearly can't be active.

    As you've seen in this thread and will find in multiple others in these and other forums relating to both that specific ASUS game and other .ppkg files within Recovery partitions, the Windows filing system is able to scan within these, so it's possible for any of their scanners to do this as well, often leading to situations like this where people who don't recognize compressed or packaged Recovery partition files end up sending unsuspecting people like yourself through lots of wasted effort and concern.

    With all of this common knowledge about Windows, Full scans, Recovery partitions containing WIM, .ppkg and other installation files and the obvious file name of that ASUS - ROG Game First III itself, it should now be relatively obvious why this was never anything to be worried about.

    So just ignore it and as I recommended, stop doing full scans, they almost never provide a useful result and in most cases simply convince people their primary antivirus scanner isn't "good enough" or they've got malware they can't get rid of, just like in this case.

    As an aside, PUA (Potentially Unwanted Application) detections are also notorious as being false positive (e,g, incorrect) detections, so always take these with a grain of salt unless they clearly match the name or known action of their detection.

    Rob

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  2. David-M 115.2K Reputation points Independent Advisor
    2021-08-10T19:16:20+00:00

    Sorry, I hadn't recognized the acronym. I don't usually refer to Microsoft Safety Scanner with this acronym.

    But if MSERT isn't finding this threat, it probably won't find it in safe mode either. But it never hurts to try.

    This file that Windows Defender is referring to is in the directory provided?

    Was this answer helpful?

    0 comments
  3. Anonymous
    2021-08-10T19:06:18+00:00

    Ey! Thanks for helping out!

    Actually what I refered as "MSERT" is the Microsoft Safety Scanner so I've already ran a full scan like 2/3 times and got nothing (it detected infected files but the scan finished okay). However, I'll try to run it again in safe mode.

    I did not know about ADWCleaner so I installed it and... It found nothing. It only found the pre installed software.

    I'm not so sure of what to do now.

    Was this answer helpful?

    0 comments
  4. David-M 115.2K Reputation points Independent Advisor
    2021-08-10T18:13:51+00:00

    Hi ValenRM,

    I'm David, and I'm happy to help you.

    Some PUAs can be persistent.

    I suggest you run AdwCleaner. It usually removes these persistent PUAs.

    Download through this link: https://malwarebytes.com/adwcleaner/

    IMPORTANT: AdwCleaner detects pre-installed software and allows you to remove all of its features to improve Windows performance. It may be software that you need, so ignore this option or uncheck the software in the list provided after scanning.

    ________________________________________________________

    Standard Disclaimer: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

    ________________________________________________________

    It's also a good idea to run the Microsoft Safety Scanner.

    https://docs.microsoft.com/en-us/windows/securi...

    If possible, run in safe mode with networking.

    https://support.microsoft.com/en-us/windows/sta...

    Feel free to ask back any questions.

    Was this answer helpful?

    0 comments