Solved Malwarebytes problem

[PSCO2007]

I use Malwarebytes (also SAS and WOT) and always run a scan on any program that I am going to download.

I downloaded Gmail Notifier Pro yesterday ( after having a problem with the previous download) but inadvertently clicked a different site.

I was a little leery when WOT didn't give me the green light, but Malwarebytes said it was free of any viruses.

Before logging off last night, I ran a Malwarebytes scan and it said that program had a Trojan Agent and I quarantined it.

Why didn't it notify me before I downloaded it?

 

[Tookeri]

What do you mean with "always run a scan on any program that I am going to download"?
URL scan?

 

[PSCO2007]

After I have clicked the URL, but before downloading it as in pic.

 

[Tookeri]

You mean why didn't MBAM block the IP?

 

[PSCO2007]

Normally, if it is an dangerous download, Mbam will warn me.

So, yes that is my question.

 

[Tookeri]

Don't know, but as a general advice you shouldn't trust URL/IP scans. Dynamic web sites and pages like asp and php are sometimes used by the bad guys to only present clean code when accessed by a known scanner(by checking the IP range of the computer accessing the page). But when accessed by anyone else(you and me) we'll receive different web page content that includes the bad stuff.

Personally I download the program and then check it on VirusTotal and HerdProtect before running it. If the file is unknown on these services I go manually to virustotal.com and upload the file to have it checked. I've put together a quick and easy way here using right-click on the downloaded file:
http://www.sevenforums.com/tutorials/346474-virustotal-herdprotect-check-files-simultaneously.html

It could also be a good idea to scan the file manually with your AV and MBAM as sometimes additional methods are used for manual scans, for example heuristics. These options are generally also available by right-clicking the file in explorer.

 

[PSCO2007]

Thanks for your advice!

Paul

 

[Layback Bear]

PSCO2007 do you use any IObit's products?

 

[PSCO2007]

I used to use the program uninstaller.

Why do you ask?

 

[Callender]

Gmail Notifier Pro

I was intrigued so downloaded and installed Gmail Notifier Pro.

Scan prior to download with multiple AV's shows clean:



Scan with multiple AV's before install shows clean:



VirusTotal scan of installer shows clean:



Scan after install with MBAM - clean and nothing detected. Not sure where you downloaded the file from. Here's the official developer's website:

Gmail Notifier Pro - Download for Windows

 

[PSCO2007]

Hi,

This is where I downloaded from, and only because I couldn't get it to work previously.

https://www.google.com/search?q=gma...#q=gmail+notifier+pro+keygen&revid=1192827192

Top one.

I did use your link originally, but it would not give alerts after working before.

 

[Callender]

Download link

Hi,

This is where I downloaded from, and only because I couldn't get it to work previously.

https://www.google.com/search?q=gma...#q=gmail+notifier+pro+keygen&revid=1192827192

Top one.

Yes. That's the one I just used to download it from. Nothing dodgy shows up on my machine. Scanned before and after install. Also scanned with Zemana Cloud Scan, Comodo AV, HerdProtect, CrystalXSecurity.



Nothing detected by any scan. Not sure why you're seeing an MBAM detection. MBAM scan shows clean for me!

 

[Callender]

Google search results.

The top link I get in your search link when I click on it is this one:

Gmail Notifier Pro - Professional Gmail notifier for Windows

Your search results might be different - if that's the case let us know the download link.

 

[PSCO2007]

I don't know - all I saw was Trojan when I ran my nighttime scan.

This program also changed my home page and search engine, even though I always click Custom and decline all that crap.

Thanks again Chris,

Paul

The reason I got to that download is because I was looking for a different version - thought that might solve my problem- just made it worse.

 

[Callender]

Sounds like a PUP

I don't know - all I saw was Trojan when I ran my nighttime scan.

This program also changed my home page and search engine, even though I always click Custom and decline all that crap.

Thanks again Chris,

Paul

Sound like you got an installer that came bundled with a PUP or toolbar. Can't check it without knowing the link. I could suggest installing this software:

http://www.sevenforums.com/2932674-post21.html

Link to download No AV version: https://secureaplus.secureage.com/Main/what_is_the_difference.php#oav

When an installer (setup file) runs it alerts you on any untrusted or unsigned process that attempts to run and blocks stuff like Open Candy and other unwanted toolbars.

There's no need to install this software but if you want to try it be aware that the initial scan to whitelist files that are on your machine will probably take a long time - up to a couple of hours if you've got lots of files.

 

[PSCO2007]

Can't check it without knowing the link

Chris,

The link is in post 7 - top one.

 

[derekimo]

Hi,

This is where I downloaded from, and only because I couldn't get it to work previously.

https://www.google.com/search?q=gma...#q=gmail+notifier+pro+keygen&revid=1192827192

Top one.

I did use your link originally, but it would not give alerts after working before.

Interesting how different the search results are from this link, this is what pops up when I click on that,

 

[Callender]

Can't check it without knowing the link

Chris,

The link is in post 7 - top one.

Post#7 - can't see it!

 

[PSCO2007]

Sorry- it's in post 11.

 

[PSCO2007]

Hi,

This is where I downloaded from, and only because I couldn't get it to work previously.

https://www.google.com/search?q=gma...#q=gmail+notifier+pro+keygen&revid=1192827192

Top one.

I did use your link originally, but it would not give alerts after working before.

Interesting how different the search results are from this link, this is what pops up when I click on that,

The Keygen one in your reply is the one I downloaded.

And you can see that WOT has a green circle to tell me it is safe.