PUA:Win32/PiriformBundler flagged by Windows Security, but removing or quarantining doesn't cure it

Question

Hi, I'm getting the message "Potentially unwanted app found", and the program is PUA:Win32/PiriformBundler.

I don't want to install this potentially unwanted app, and I don't have cc cleaner (which I understand can be the culprit). Windows Security flags it as "severe" on browser and app control, and lets me delete it - but then the pop-up comes up again, literally every few seconds, and as soon as it's deleted it comes back again. I've tried deleting it over and over, and quarantining it - but to no avail. The only other option is to tell Windows Security it's OK to install it, but I'd really rather not, as I have no idea what it is.

I've disabled extensions in Chrome to see if that fixed it - but no, every day I get this over and over. Any ideas of how to get rid of it?

Thanks!

Answer 1

Hi Chris, if the file no longer exists, then it has been remediated. What you are seeing is a bug, where Windows Defender flags things because of their presence in detection history.

To resolve the issue either:

Boot into safe mode:

https://support.microsoft.com/en-us/windows/start-your-pc-in-safe-mode-in-windows-92c27cff-db89-8644-1ce4-b3e5e56fe234

Delete the DetectionHistory folder from:

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory

Restart your computer.

Note: To see the ProgramData folder and subfolders,  make sure you are showing hidden files and folders.

• Windows 10: In File Explorer, select the View tab > check (tick) Hidden items
• Windows 11: In File Explorer, select View > Show > check Hidden items

or if you don't want to mess about with safe mode, use the tool I wrote to specifically remove DetectionHistory:

https://1drv.ms/u/s!AqQnVFhmcB_wnVqq3Rf2gqpRFkf1?e=OPtn1U