Another PUP question

[rundwald]

I have encountered a very similar situation to the OP of http://forums.malwarebytes.org/index.php?showtopic=106572&hl=bundleinstaller&fromsearch=1

I run paid Malwarebytes so expect to be fully protected. However a full scan made today has found two suspects PUP.Bundleinstaller and PUP.Adbunbler, that relate to 4_sync and English Word Builder .exes respectively.

Both programs appear also to be digitally signed : 4_sync by New IT Limited; English word Builder by Solimba Aplicaciones.

As neither one has been reported before, can it be confirmed whether or not my computer is infected, and that false postive(s) have not been thrown up?

Please advice any steps more than standard removal by Malwarebytes is required.

[Fatdcuk]

Hello runwald,

PUP classification stands for Potentially Unwanted Program.

The Bundle installer classification is given to installer(s) where a bundle(collection) of applications will be installed from that stand alone installer.

The individuals applications that are installed in mosts cases will be safe but owing to the nature of application bundles or how they are marketed in most cases both our Corporate customers and savvy home users would find them potentially undersirable which is why we detect them as PUP.

If there is anything suspect(PUP/Adware) installed by the initial bundle installer then we would detect that also

[rundwald]

So in short I should be concerned but not panic-worried?!

[Fatdcuk]

PUP detections should never be a cause for concern as PUP's are not malicious in action.

[CDA]

I beg to differ - I have been blessed with a version of PUM.Hijack.Startmenu which unfortunately MalwareBytes finds, Identifies, quarantines, and will remove but it keeps showing up, as of 5 days ago with the appearance of black backgnd, false warning windows (stacked 20 sum deep) overheat warnings, cpu overspeed warnings and a benign looking window with a recomendation and a "convinient' button to download "file checker" or somesuch for Only $29.95 . Through a safe mode start up and "Combofix" I delt it a blow - enough to get my desk top back but my old 1, 2 with MBAM dosn't quite do the trick, as with re-boot it will reappear. Presently with blank desktop running in Admin mode and using desktop button off taskbar to get to my icons... any assistance would be appreciated; thanks; CDA

[Fatdcuk]

Hello CDA and welcome to the Malwarebytes forums

PUM classification is actually different to PUP's

PUM means Potentially Unwanted Modification.

Unfortunetly system mods can be performed by malware(as is your case) and in other scenarios by end users or system admins who set policies/modifications because of their individual requirements.

MBAM has no way of knowing whether a modification was done by malware or intentionally by the end user so in that scanario we can only warn as to a potentially unwanted modification.

Ok lets try to get your computer fixed however we don't work on malware removal n this part of the forums.

Please read and follow the directions here, skipping any steps you are unable to complete. Then create a NEW topic here.

One of the expert helpers there will give you one on one assistance when one becomes available.

Please note that it may take 48 hours or more for you to receive a response in the malware removal forum, as it is often busy at times. Please do not reply to your own post asking for help unless its been more than 48 hours since you originally posted, as this can make it appear as though you are being helped and take longer for you to get help.

If you are unable to do all or any of the steps in the link to the directions above, just post your problem into the forum I gave you a link to anyway and someone will be able to assist you.

If you prefer to be assisted via email you may contact support@malwarebytes.org and one of our support staff members will assist you directly.

If you are a reseller, affiliate, technician, corporate, business, educational, government or non-profit customer then please contact corporate-support@malwarebytes.org and include full contact details along with your Reference # when you do to ensure that you receive prompt assistance.