PUP's in flash scan at Malwarebytes

[petrox]

Hi Forum members, a question please. I have Malware bytes pro one option is to scan memory and start up items. Today it found 98 items in those locations. They are PUP seach ui in files as well as in registry. I am wondering why Microsoft Security essentials lets them through as well as the Windows firewall and Windows defender. Any ideas? If I need another security tool please tell me and I will install whichever one is appropriate. Regards Peter

 

[Callender]

PUP's

Hi,

A PUP is a Potentially Unwanted Program. That could be a toolbar or something similar. MSE and other security programs don't block them unless they're malicious. Some users even want to use these toolbars.

Some security products might have the option to alert on PUP's if you look for it in the settings.

Malwarebytes detects these PUP's as they might have been installed without the user's knowledge.

https://helpdesk.malwarebytes.org/e...-are-they-threats-and-should-they-be-deleted-

Malwarebytes classifies the following as PUP's.

Malwarebytes : PUP Reconsideration Information

 

[Lady Fitzgerald]

MSE is one of the worst AVs you can be using.

 

[petrox]

Thank you Callender for your reply. Also Lady Fitzgerald.I do understand it better now. I will search for a better Anti Virus. Some people think MSE is not that bad. Regards Peter

 

[UsernameIssues]

MSE is one of the worst AVs you can be using.

Please do not take this the wrong way. The info presented below is as much for your benefit as it is for the OP. I agree that MSE could be a lot better. You have probably seen my rants about MSE's lack of heuristics. That said, in the context of preventing PUPs from installing on a computer, AVAST might be just as bad as MSE. AVAST happily allowed the Conduit toolbar (and the apps that its installer offered) to be installed. Other antivirus tools flagged these apps.






Using Process Explorer...




Picking two of the worst offenders:

https://www.virustotal.com/en/file/...27c0f473520a66aa5acc9cd6/analysis/1391980609/



https://www.virustotal.com/en/file/...1b109070470ed66ffb4f8e8d/analysis/1391980611/

You might notice that there are ten findings, but the initial screenshot showed 9 findings. That is because the initial report was based on data that was 6 days old. I resubmitted the EXE for evaluation.

I know that you rely on Malwarebytes Pro to keep these PUPs off of your computer(s), but again, in the context of this thread, moving away from MSE is not going to help the OP to stay free of PUPs (unless the OP picks an antivirus tool that does a better job than AVAST).

I wonder why more antivirus tools don't add more PUPs to the list of things that they watch for?

 

[UsernameIssues]

petrox,
You can see this post of how to get/setup Process Explorer:
http://www.sevenforums.com/system-security/320426-process-explorer-16-a.html#post2681060

 

[Callender]

[/QUOTE]I wonder why more antivirus tools don't add more PUPs to the list of things that they watch for?[/QUOTE]

I'd say that the answer here is probably about right:

Why isn't a program malware if it installs additional, unwanted software? | PCWorld

Except that some software bundles PUP's with no chance for the user to opt out of installation!

I keep looking for a current list of executable file names for the installers or setup files for these programs but so far I've never come across a full list that is kept up to date!

If there were such a list it would be very useful to me as I block installation of this stuff by detecting the installer process running and then when that happens I've set up a method of automatically launching another safe file to run in it's place.

 

[UsernameIssues]

I don't think that I was clear. I was not suggesting that installers that offer other apps should be classified as malware. The installer for AVAST and CCleaner would fit into that category. I was saying that apps like Conduit, Search Protect and the like should be highlighted to the user as a PUP by MSE, AVAST and the like. There is no reason to have AV tools look for one level of malware and Malwarebytes looks for another level of malware.

I'm well aware of the need for layered protection and that no one tool catches all forms of malware - but my question stands: why do so many AV tools set the bar so low when it comes to PUPs? Many AV tools simply ignore that entire class of software. I realize that putting software into the PUP category is a subjective decision; but come on, Conduit!

Trovi bought Conduit and here is what you agree to during the install:

Information Trovi Collects and Receives. There are several types of data being collected from you as detailed herein.

AVAST thinks the Conduit toolbar and website is just fine:




I could not even get to the Malwarebytes website without being blessed with an endless offer scam from the adware that AVAST allowed.




Most of those 293 items shown below are just snake oil*. They are harmless registry entries. Should they be cleaned? Yes. But they should not be listed in big bold red letters. Those bold red letters should be reserved for items that can cause something to actually happen on your computer.



*The more items found, the better the user feels about Malwarebytes. The same can be said about UniBlue's registry tool. It will find more things "wrong" with the registry than the conservative CCleaner tool will.


Don't get me wrong, Malwarebytes is an excellent tool...
...but it still uses the same tactics (perhaps unintentionally) used by Uniblue.

 

[Layback Bear]

Malwarebytes Anti Malware finds lot of PUP's for me and I don't really care what color they use to indicate them.
To me no PUP is a good PUP. If I wanted it downloaded I would of ask for it up front.
Many anti virus let PUP through because they are not considered virus at this time in the anti virus world, and they are not. For what ever reason some people like some of the little free goodies that slip in. I consider them malware and Malwarebytes does to.
Eset Free Online Scanner will also find PUP's along with viruses ect.
If PUP's were nice to have then send they to me through the front door and not the backdoor of my system.

Many wiser that me have posted: Their is no one program that does it all and I do agree.

 

[UsernameIssues]

Malwarebytes Anti Malware finds lot of PUP's for me and I don't really care what color they use to indicate them.
To me no PUP is a good PUP. If I wanted it downloaded I would of ask for it up front.
~~~
If PUP's were nice to have then send they to me through the front door and not the backdoor of my system.

I asked for these installs "up front". The paid version of Malwarebytes Anti Malware might have stopped most of the installs; but Malwarebytes Anti Malware cannot clean what was installed for this tiny test of mine.

....Many anti virus let PUP through because they are not considered virus at this time in the anti virus world, and they are not....

You are correct about these apps not being a virus. I was lamenting/questioning the decision of some antivirus tools not to include PUPs.

...Eset Free Online Scanner will also find PUP's along with viruses ect.
~~~
Many wiser that me have posted: Their is no one program that does it all and I do agree.

I mentioned the multiple program concept too; unfortunately, the concept can mean:
1) use one tool to look for viruses and use another tool to look for PUPs
or
2) use more than one tool to look for all classes of malware and PUPs.
Lots of people here operate under option 1.
(which is better than just using MSE


Not to beat a dead horse, but since I spent the time playing with the Conduit toolbar and the other things that I intentionally did not opt out of - I'll report that none of the tools listed in Lady Fitzgerald's system spec [AVAST!, MBAM, SAS, Spybot S&D (all but MBAM free] have managed to rid the virtual machine of the stuff that was installed. Also, ESET seems to have changed their online scanner to be a one time use.



That is why I wanted the antivirus app to do what it can against PUPs and malwarebytes to do what it can against PUPs and any other tool that I throw against the problem. Then maybe - just maybe - if they all do what they can, the PUP can be eradicated from the computer.

Or maybe I'm just looking at the virus/malware/PUP issue all wrong.
I've been known to do that :-(

 

[Layback Bear]

UsernameIssues you are doing a fine experiment.
You have to download Eset Free Scan every time you use it. I don't take but a couple of minutes.
I also recommend when your done with Eset you uninstall it.

I wish Malwarebytes made a AIO. Anti virus, anti malware plus PUP and anti spyware. I would buy it.

 

[Lady Fitzgerald]

...Not to beat a dead horse, but since I spent the time playing with the Conduit toolbar and the other things that I intentionally did not opt out of - I'll report that none of the tools listed in Lady Fitzgerald's system spec [AVAST!, MBAM, SAS, Spybot S&D (all but MBAM free] have managed to rid the virtual machine of the stuff that was installed...(

And yet I have no unwanted programs installed on my system (I check every now and then just to make sure nothing "snuck" by). A good dose of common sense and just paying attention, such as reading the boring EULAs, before pushing a key also goes a long ways toward preventing PUPs from being installed. Keep in mind, if you allow a program to be installed, even if it was due to carelessness (or a test or experiment), technically, it's not a PUP anymore. The PUPs that MBAM detects are program installation files that have sneakware that doesn't give one the option to not install, or installers, such as Open Candy, that can install PUPs.

Then there is the ultimate way to get rid of anything, no matter how persistent it may be: restore to an earlier image. I make a fresh image before I install anything or make any other changes. If something goes pear shaped, I can always go back to where I was before I made the change. I also make one image a week, right after running all my full scans and keep all of them for a month. After that, I keep only the first image of each month. Image restoration is far more reliable than System Restore; in fact, I've turned off System Restore.

 

[UsernameIssues]

UsernameIssues you are doing a fine experiment.
You have to download Eset Free Scan every time you use it. I don't take but a couple of minutes.
I also recommend when your done with Eset you uninstall it.

I wish Malwarebytes made a AIO. Anti virus, anti malware plus PUP and anti spyware. I would buy it.

I've used it for years (http://www.sevenforums.com/system-security/230001-arp-cache-poisoning-attack.html#post1925007) I interpreted the website change wrong. I thought it meant one time use. It did not offer the download a second time. I had to clear IE's cookies to get the download offer to appear again.

~~~
And yet I have no unwanted programs installed on my system (I check every now and then just to make sure nothing "snuck" by).
~~~

I can only state that the apps that I scan with found nothing
Something unwanted could still be there :-(
Infections have gone undetected for years.

I do get to do my experimenting inside virtual machines

Images are a good thing
Images back up undetected infections too :-(

 

[Britton30]

MSE is one of the worst AVs you can be using.

Uh-yup.

 

[Lady Fitzgerald]

...

~~~
And yet I have no unwanted programs installed on my system (I check every now and then just to make sure nothing "snuck" by).
~~~

I can only state that the apps that I scan with found nothing
Something unwanted could still be there :-(
Infections have gone undetected for years...(

PUPs and toolbars aren't exactly infections so it would be unfair to expect antimalware programs to detect them. It's quick and easy to find them by manually checking in browsers and in Programs and Features. I very rarely find any because I'm pretty careful to not let the little buggers in.

...Images are a good thing
Images back up undetected infections too :-(

True that. That is why I keep so many old images. I can go back however far I need to get rid of an infection. So far, I haven't had to do that on this machine. I also keep the installation files of all my programs, including older versions, so if I have to go back very far, I can restore any programs I lose.

No one antivirus or anti-malware program is going to catch everything. Nor will they always catch them at first. That's why I have multiple programs and run daily quick scans and weekly full scans. I very rarely find anything (maybe once or twice in the past year) other than occasional tracking super cookies that are most likely harmless but are still intruders none the less.

MBAM will hit on the installation file for FreeFileSync because it contains Open Candy, a PUP that runs only when installing the program who's installation file it is hitchhiking on and will install various other PUPs, such as the delightful Ask toolbar, Chrome browser, Google toolbar, etc. (it varies). Open Candy doesn't get installed and the PUPs it tries to install are easily defeated by deselecting them during program installation (granted, you do have to pay close attention). I just added .disable to FreeFileSync's installation file's filename to temporarily disable the file so MBAM won't keep hitting on that one file without disabling MBAM's ability to pick up on any other intrusions of Open Candy.

 

[Britton30]

This may be more helpful with PUPs and other annoying crap.
The PC Decrapifier Wipes Unwanted Junk | The PC Decrapifier

 

[ThrashZone]

This may be more helpful with PUPs and other annoying crap.
The PC Decrapifier Wipes Unwanted Junk | The PC Decrapifier

Interestingly which comes with Free zip

People are very persistent when they want to download something,
If it fails in one browser they'll try with another one and so on,
So it's impossible to find a utility to save a person from themselves

 

[Britton30]

If one of the annoyingly big green download buttons is clicked that is for some "zip opener" crap.
Click the d/l button here,



and this page opens with a big blue d/l button. I got a clean download.
Download | The PC Decrapifier

 

[ThrashZone]

Yes you confirm the importance of reading the entire page and just not the sponsored adds
Catchy name I have to admit