HPSF_RASMANCS/RASAPI32

[Archon Prime]

So i have this client with EAM MAV installed on their computer. I'll see every other day or so, when Emsisoft runs scans, it keeps picking up these entries

Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\HPSF_TASKS_RASAPI32 Application.Win32.InstallExt (A) [270559]

Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\HPSF_TASKS_RASMANCS Application.Win32.InstallExt (A) [270560]

it removes them and then I'll see the damn thing come back later one with the same scan, removes, repeats.

I'm not finding a lot of informative information on the net in regards to this. i've run JRT, Adwcleaner, hitman, etc. I can't see what else is causing these entries. I'm thinking it's based on Microsoft's actual software/windows but not 100%.

Can anyone else assist with shedding some light on this. If it's a false-positive I'll teach EAM to treat it as such. the rest of the computer is clean as a whistle.

 

[GTP]

I get these picked up all the time, but once removed they don't usually reappear. AFAIK know they are related to PuP adware activity.
When you do a manual scan are you setting the scan parameters to "Quarantine?" Don't ask me why but for some reason the default manual scan parameters in Emsisoft are set to "Report Only??"
Do a "Custom" scan, click the "On Scan Completion" button and select "Quarantine" from the list.
You'll have to do this everytime you do a manual scan because it defaults back to "Report Only"
Also, on your AV Dashboard have you set the scan parameters (both entries) to "Quarantine w/ Notification?"

 

[GTP]

Hey @McFarland IT
I got one today that found these same bugs. She tried to install iMeshV11, with the iLivid Media Player (both known malware) and Emsisoft canned the install.

 

[Umbra]

@McFarland IT @Barcelona You should report this our Customer Support Team in the Emsisoft Support Forum.

 

[Archon Prime]

Thanks guys. This computer is bear bone haha. I did a full maintenance on it about 5 months ago. It's clean as a whistle. I purged all temp files in case it was something in there as well. But Emsisoft was set to full scan on C:/ and nadda.

 

[GTP]

@McFarland IT @Barcelona You should report this our Customer Support Team in the Emsisoft Support Forum.

Which ends up getting a ridiculous answer from someone that clearly has no clue!
I've done this before, only to end up going round in circles!
Sorry, but IMO, Emsisoft support sucks!

 

[Umbra]

Which ends up getting a ridiculous answer from someone that clearly has no clue!
I've done this before, only to end up going round in circles!
Sorry, but IMO, Emsisoft support sucks!

Really, as far as i know, many users are praising our support; what happened in your case?

 

[Archon Prime]

Welp. Already got the run around on the forums there. Let's see how long this lasts....

 

[Umbra]

@McFarland IT A reply suggest you to create a thread at the malware removal section, so a specialist can dig deeper into your issue and give you proper infos.