item found in Malwarebytes (from udemy.com?)

[HAVOC]

I did a scan with Malwarebytes.
It found one item and I think it's related to udemy.com. I use google chrome to view courses and it happens to be in the google folder.

I removed it once before but it shows up again.

AdwCleaner also finds it.

 

[MoxieMomma]

Hi:

Re: the MBAM detection -- please be sure MBAM is properly configured to both detect AND remove PUPs.
(Dashboard > "settings" > "detection and protection" > "non-malware protection" > "PUP" > "Treat detections as malware")

If you have removed it and it reappears on subsequent scans, then most likely you are reacquiring it via visiting the same website, or via something on your system carrying the PUP as a "freebie", or it may be reappearing from Google sync (seems likely if you are using Chrome).

In the latter case, you may need to clean out all of your sync'd settings and perhaps reset (or even reinstall) Chrome.
If that doesn't resolve the issue, then you might need a deeper look at the system to clean out whatever is respawning this PUP.

OTOH If you think that the PUP might be a false positive detection by MBAM, then you may want to start by reading the pinned topic HERE and then submitting at least a scan log (for starters) in the MBAM file F/P forum HERE. The Research team will evaluate the data to determine if the detection may (or may not) be a F/P.

HTH,

MM

 

[HAVOC]

I'm going to do a couple scans with MWB and see when it actually reappears.

 

[MoxieMomma]

Hi:

If it's reappearing in both MBAM and AdwCleaner scans, then the most likely explanations are that something on your system is regenerating it (perhaps the application with which it came bundled in the first place) or it is respawning from your sync'd Google data.

If it's the former, then a bit of deeper work might be needed for complete removal (PUPs can be pesky).
If it's the latter, then you'll need (at a minimum) to clear out your sync'd Google/Chrome data and probably reset Chrome; additional work might be needed.

Start by disabling Sync
How To Delete Your Google Chrome Browser Sync Data
Chrome - Reset browser settings
Reset Chrome sync

If that fails then you might want to Uninstall Google Chrome and do not reinstall until sure the system is clean.

Let us know how it goes,
MM

 

[xxxdannyxxx]

I have a feeling its a F/P. I have been getting the same for a few days now, delete it and it reappears and never visited the site mentioned above. Also using chrome.
Full Path - C:\Users\Username\AppData\Local\Google\Chrome\User Data\Default\Preferences

Danny

 

[MoxieMomma]

Hi:

PUP classifications change from day to day, based on the criteria to which programs are assigned to that category. A change to a program's behavior can result in its being newly classified. More info HERE.

I have a feeling its a F/P. I have been getting the same for a few days now, delete it and it reappears and never visited the site mentioned above. Also using chrome.
Full Path - C:\Users\Username\AppData\Local\Google\Chrome\User Data\Default\Preferences

Danny

To be safe, especially since the OP reports that AdwCleaner is also detecting it....

OTOH If you think that the PUP might be a false positive detection by MBAM, then you may want to start by reading the pinned topic HERE and then submitting at least a scan log (for starters) in the MBAM file F/P forum HERE. The Research team will evaluate the data to determine if the detection may (or may not) be a F/P.

But it's certainly up to you.

Cheers,

 

[DavidE]

I would upload and scan the file at https://www.virustotal.com/
I've seen where the same file gets different results when scanning locally vs. virus total for the same scanner.
I've also seen where the same file gets reported differently depending on the type of local scan used.
None of the security programs are perfect.

 

[MoxieMomma]

I would upload and scan the file at https://www.virustotal.com/

Excellent idea.

I've seen where the same file gets different results when scanning locally vs. virus total for the same scanner.
I've also seen where the same file gets reported differently depending on the type of local scan used.
None of the security programs are perfect.

VT and jotti and other sites are a good way to get a broader view.

One just needs to be aware that "legal" PUPs are not true malware in the strict sense.
Most have EULAs or require some sort of user behavior (especially failing to opt-out of installation) for their installation.
Many scanners do not even target them.
(But I certainly don't want any of that junk on my system -- sooner or later, they tend to lead to more serious problems.)

This particular "hit" may or may not be a F/P.
But the only way to know for sure and to have a particular file removed from a particular scanner's database as a F/P is to submit the necessary data to the software vendor.

One can -- in most scanners, including MBAM -- set an "exclusion" for a given PUP.
But doing so without first checking with the security software vendor is not particularly safe.


Cheers,
MM

 

[HAVOC]

I ran malwarebytes again after opening chrome and going to udemy.com. The PUP is no longer there. I'll use chrome for a bit and see what site the PUP might be associated with. I thought it was related to udemy because of the ability to comment on videos that you watch.

 

[DavidE]

At VT you can scan a URL such as www.udemy.com.
Here are the VT scan results for that site (it scans clean)
https://www.virustotal.com/en/url/8...157cb1de653096be0b82488d58c7c4c1de2/analysis/

 

[MoxieMomma]

Thanks for the updates.

I mean no disrespect, but I think we might be veering a bit off-topic?

@Havoc originally reported the same PUP file detection on both MBAM and AdwCleaner scans.
As I mentioned, a VT scan of the file may or may not be entirely insightful, as some of the VT scanners do not target PUPs.
In order to determine if that PUP detection may or may not be a F/P for those 2 scanners, MBAM and AdwCleaner, one would need to follow the steps I already suggested to submit at least an MBAM scan log (or, preferably, the zipped file itself) in the F/P forum section at Malwarebytes forum.
(There is a similar process for AdwCleaner HERE.)

AFAIK, @Havoc reported a file detection, NOT an IP/website block, from MBAM for udemy.com.
There's no harm submitting that URL to VT or another site for analysis, of course.
But even if the site scans clean at VT, there still might be PUPs associated with the software available at that site. Checking the site, rather than the software itself, will yield different results.
If the vendor bundles their software with PUPs, then the site may well be clean, even if the software is not.

If, in fact, it is a legitimate PUP detection, and if it is being regenerated from your sync'd Chrome data, then getting rid of it will likely entail the steps I already mentioned. If it's coming from something on your system, then a bit of junkware/adware/malware cleanup may be needed.

In order to reduce the guesswork and to have a bit of real data with which to work, @Havoc, perhaps you might please ATTACH to your next reply here in this thread both the MBAM scan log and the AdwCleaner scan logs. (Let us know if you need help finding and exporting those logs.)

Just a suggestion,
MM

 

[DavidE]

I was just replying to "I thought it was related to udemy because of the ability to comment on videos that you watch"
so the OP knows a URL can be scanned at VT.

I'll drop off and watch.

 

[HAVOC]

I followed the directions in post #4 for resetting Chrome. I'm going to do some more browsing with Chrome tonight and see if the PUP returns. I'm able to find the logs and upload them if need be.

I ran a full scan with MSE, and a scan with Malwarebytes and AdwCleaner, all three found nothing so far.

 

[MoxieMomma]

Hi, @Havoc:

OK, sounds good.
If it returns, seeing some scan logs and a bit of deeper digging may be needed.

Cheers,
MM

{P.S. @DavidE: no offense intended. VT suggestions were excellent. Was just trying to keep the thread on-topic re: PUP file detection in MBAM and AdwCleaner scans, the most definitive means of ruling out a possible F/P, and likely explanations for the reappearance of the detection in multiple scans.}

 

[HAVOC]

I ran Malwarebytes and it isn't finding anything. I ran AdwCleaner and it found a couple items related to google.

 

[MoxieMomma]

Hi, @Havoc:

I lack the official training to guide you through malware removal. That is best left to someone with more formal expertise in the matter. And I do not personally use Chrome, so I lack first-hand knowledge of the program.

Unless you disabled Chrome sync before you reset it, you may be getting reinfected.

However, the AdwCleaner detections you show seem to be different from the one originally reported in your original post about the PUP in MBAM. And AdwCleaner can have false positives.
But it's hard to say for sure what is going on without seeing the LOGS, rather than a screenshot snippet.

Until someone more expert comes along here at sevenforums, I suggest the following:

• You may wish to report the AdwCleaner findings HERE. They will help you to determine if the AdwCleaner detections might be a false positive -- if they are not, they will direct you to the proper sub-forum for some guided malware cleanup.
• Or, you may wish to post directly in one of several, reputable, dedicated computer disinfection fora (G2G, bleepingcomputer, Malwarebytes, etc.) and likewise get some guided help with cleanup. The expert help there is free. They will walk you through the proper scans in the correct sequence in order to find and remove malware and to help harden your defenses to prevent reinfections.

Please let us know how it goes, so that we can all learn.


Thank you,
MM

 

[ThrashZone]

Hi,
Yep you did pick up some extra search engines
They should show up as extensions I believe.
Also review you're uninstall a program section for the listings.

 

[HAVOC]

Nothing in my add/remove programs for anything shown in the previous post.

The computer isn't doing anything weird. I just did a scan last Sunday and that's when I saw the items in Malwarebytes, they haven't returned but I found these in AdwCleaner.

 

[ThrashZone]

Hi,
Go to Chrome settings and on the left column go to extensions see what is in there.

 

[HAVOC]

Just the default ones that come with Chrome.