Solved PUP detections from MalwareBytes

[LevelBest]

Hi

I regularly scan with MalwareBytes (alongside my existing AV). MW usually reports back as no issues but today it reported 5 PUPs namely Optional Optimizer Elite Max (screenshots below). I'm struggling to think how I could have picked these up. Yesterday, I installed an update for Adobe Flash but am always mindful to de-select any optionals.

Any ideas as to how I could have picked these up? I got MW to delete them all and re-ran the programme and it reports all clear.

LevelBest

 

[Callender]

It comes bundled with other software that you must have installed. Review installed software sorted by install date using:

GeekUninstaller​

Also see:

https://www.malwarebytes.com/pup/

 

[HAVOC]

Have you installed any "free" programs recently? Did you restart your computer after removal of the PUP's and do another scan with Malwarebytes?

 

[Callender]

RE: FlashPlayer. I always get the clean downloads as it's often bundled with unwanted extras:

For Internet Explorer :
http://fpdownload.macromedia.com/pub/flashplayer/latest/help/install_flash_player_ax.exe

For Mozilla Firefox & Chrome :
http://fpdownload.macromedia.com/pub/flashplayer/latest/help/install_flash_player.exe

Plus I always do a clean install of flashplayer each time it is updated. (Fully remove old version first)

 

[LevelBest]

https://www.malwarebytes.com/pup/[/URL]

That info is interesting. I was on a couple of websites this morning where I had to click the 'x' to close down. I haven't installed any programmes of late, nothing new shows in programmes. The most recent update was the Adobe Flash yesterday. My feeling is it was the closing down of pop ups with the 'x' - I must remember to use Alt, Control and Delete which I usually do (too much of the falling down water last night, I reckon ).

Yes, I did another scan with MalwareBytes and no problem this time and I also did a full scan with my usual AV - again no issues.

I'm pretty confident all is well I was just surprised as MW normally reports back with no issues.

LevelBest

 

[Callender]

The date on your screenshot would appear to indicate that Optimizer Elite Max installed on 17 July at 13.10 so check if you installed anything else at that time.

RE: MBAM. It will render the Optimizer Elite Max program ineffective but will not remove it.

 

[MoxieMomma]

RE: MBAM. It will render the Optimizer Elite Max program ineffective but will not remove it.

Are you sure about that?
Normally, if MBAM detects the PUP, it more than likely can and will remove it, IF the user's settings are properly configured.

@LevelBest, please open the MBAM GUI > Settings > Detection and Protection > Non-Malware Protection and make sure that both PUPs and PUMs are set to "Treat Detections as Malware".
You may need to rescan and then reboot for full removal.

Having said that, some PUPs can be tricky to fully remove (requiring a custom script by a trained expert).
Others can respawn e.g. from Google sync or other places, and/or the user may inadvertently reinstall the PUP by failing to opt out during installation of wanted, legitimate software (#1 way that PUPs get on to the system).

If there is any question, @LevelBest, it would help if you could please attach the latest MBAM SCAN log as a *.txt file to your next reply here. Let us know if you need help locating, exporting or attaching it.

Thanks,
MM

 

[Callender]

I'm not entirely sure but it will not stop any Optimizer Elite Max running processes and Optimizer Elite Max scheduled tasks before running the uninstaller. Maybe MBAM deletes everything on boot?

I'm just going on past experience as I don't have MBAM installed currently so can't test.

 

[MoxieMomma]

I'm not entirely sure but it will not stop any Optimizer Elite Max running processes and Optimizer Elite Max scheduled tasks before running the uninstaller. Maybe MBAM deletes everything on boot?

I'm just going on past experience as I don't have MBAM installed currently so can't test.

The PUP database changes -- new PUPs are added, and others may be removed. So your past experience may not reflect the current status.

If you have a potential PUP sample that may not be detected by MBAM, I'm sure that the Research Team would welcome the sample for analysis.
They have a rigorous process for evaluating such files for inclusion in the database.
But if the file is coming up in scans (as shown by the GUI snippet provided by the OP), then, chances are, it *will* remove it.
But, yes, some PUPs and malware need a reboot for full removal.
And some malware and even PUPs require the use of multiple tools and/or custom scripts for complete removal.

Until then, it would greatly help at least to see @LevelBest's MBAM scan log -- without it, we are only speculating.
@LevelBest, this tutorial HERE shows how to locate, export to a *******.txt******* (not *.xml) file; you can then please ATTACH it to your next reply here in this thread.

We can go from there.

Cheers,
MM

 

[LevelBest]

Hi All

I was downloading Youtube videos yesterday at 1 pm ish, so that's where the malware came from. I did have Adblock for IE11 installed but due to having a few issues with IE11, I had disabled it. I have enabled it again but I have a shrewd suspicion that adblock keeps the comments from being show. I know this is the case with Chrome where I have adblock (which is why I was viewing via IE11).

I've attached the files. All is well with the computer. MW gave me the option to delete the malware and then asked me to re-start to complete the process. I've since run 2 MW scans and my usual AV and all is well.

LevelBest

 

[Callender]

That log looks good. You might check here though:

C:\Program Files\Optimizer Elite Max\

 

[MoxieMomma]

Yep, the MBAM log looks OK.

Most PUPs get on to the system with some sort of user action (albeit inadvertent), e.g. by not opting out of "freebies" bundled with a legit program. Moral of story: be careful not to just blindly click your way through a setup wizard without reading the EULA.

Also, if you had MBAM Premium -- with real-time protection -- you might have been able to stop this thing before it got onto your system. The Free version, as you know, can only clean up AFTER.

There are also real-time anti-exploit products out there, to help prevent infection with more serious malware via browser-based exploits.

Cheers,
MM

 

[LevelBest]

Hi MoxieMomma

I have often thought of buying the full version of MB. However, I don't use my computer for internet banking or buying stuff as I just don't think it's safe. So can I buy MW from PCWorld or somewhere offline?

LevelBest

 

[MoxieMomma]

Hi MoxieMomma

I have often thought of buying the full version of MB. However, I don't use my computer for internet banking or buying stuff as I just don't think it's safe. So can I buy MW from PCWorld or somewhere offline?

LevelBest

I do not work for Malwarebytes and have no financial interest in the company or their products. But I am quite sure their online store is quite safe for credit card or PayPal purchase.

I'm not sure about the UK, but in the U.S. there are many brick-and-mortar stores that sell security software on boxed CDs. Normally, the price will be higher than for online purchase.
But I recently saw a boxed CD at a local computer/tech store with both MBAM Premium and MBAE Premium for up to 3 PCs for 1 year subscription for $35. That is a great deal.

NOTE: There are no legitimate "lifetime" 1-PC licenses available (sale of this sort of license ended in 2014). And there NEVER was a multi-PC, lifetime license. So do not buy either of those, if you should see them.

Cheers,
MM

 

[Barman58]

The staff here on Sevenforums, (and the other Designer Media sites), all use MalwareBytes Premium on our personal systems.

This was due to an incident a few years ago when the site was directly attacked and MalwareBytes Premium warned and protected us from the attack,

Whilst all other anti malware totally missed the attack, Malware Bytes saw it for what it was and stopped it before it could do any damage.

We are not sponsored by Malware bytes at all and purchase our own licences

 

[Layback Bear]

I'm just a normal home user. No banking or any thing to do with money is ever done on my computers.
I have been using Malwarebytes Anti Malware Pro now called Premium for years.
I wouldn't leave home without it.

I also don't work for Malwarebytes and have no financial interest in the company or their products.

I just buy it, use it and trust it.

Jack

 

[LevelBest]

I'm just a normal home user. No banking or any thing to do with money is ever done on my computers.
I have been using Malwarebytes Anti Malware Pro now called Premium for years.
I wouldn't leave home without it.

I also don't work for Malwarebytes and have no financial interest in the company or their products.

I just buy it, use it and trust it.

Jack

Hi Jack

So if like me, you don't bank or use your computer for purchasing stuff, how did you purchase the premium version of MalwareBytes?

LevelBest

 

[Layback Bear]

I sent them a check.

 

[turnercj]

I use Malwarebytes (Free) version and recently found 6 Pups. I use McAfee Security-shouldn't McAfee have detected these pups?

 

[goodlad]

I use Malwarebytes (Free) version and recently found 6 Pups. I use McAfee Security-shouldn't McAfee have detected these pups?

Does your McAfee come up with Malware/Adware protection included ? I haven't used McAfee in ages so I can't comment on that but based on my experience (few years back) with Avast/Avira is that, malwarebytes tends to find pups more often than the other 2, may be because I was using free version of AV, it could be possible they didn't include malware protection in them. At times malwarebytes tends to find false positives as well, I have had this issue in the past but since they weren't important files, I let malwarebytes delete them instead of popping these up in every scan.