Can mbamapi.exe be used to remove PUPs?

[creeves]

Hi! I'm new to the forums but have been using Malwarebytes for some time now.

 

I have a powershell script that I use to run automated scans of remote machines. It also has the ability to remove whatever it finds.

I'm using MBAMAPI.EXE at the core of the script. Now this may be a long shot, but are there any switches that I can use with MBAMAPI that will allow me to remove PUPs as well?

 

I know there has been a change (probably not so recent at this point) and Malwarebytes as a whole is taking a more agressive stance against PUPs, which I'm on board for. I just can't seem to find a way to remotely remove them, which means things just keep coming back. Asking my end users to do this themselves is pretty much out of the question (Unix to Windows users here, GUI is new and foreign).

 

If there isn't a way to have MBAMAPI.EXE do this, is there possibly another approach or has anyone else tackled this same issue?

 

 

Thanks in advance for any help/insight!

 

C.Reeves

 

[AdvancedSetup]

Running any type of remote scan (meaning you've mapped the drive) is not going to be an effective means of scanning the system and your antivirus would be much better at flat file scanning.

 

I've been doing Server and Systems support myself now for over 20 years and personally I see doing remote actions as a waste of time in this case as the program already fully supports scheduled silent automatic updates and scanning.  As a Systems Admin the less work and remote scripts needed the better so that I can focus my attention on larger issues and projects.

 

You can set the clients to all remove PUPs as well - this can be modified on the fly by changing a registry value.

 

There are no switches that I'm aware of to do what you're wanting to do, but again personally I would set it and forget it for the clients. 

[creeves]

20 years, you young whipper snapper!   

Well, each machine is running the Malwarebytes client. I'm definitely not using one install to scan 1000s of machines. So the powershell script actually opens up a cmd instance on the remote machine itself and calls the commands locally. Any yes, these machines have a scheduled task, but it still fails to remove PUPs (it logs them however which is why this script is written).

Where in the registry can I modify Malwarebytes to automatically remove PUP items found during a scan?

[AdvancedSetup]

What are the 'PUP' detections, are they threats, and should they be deleted?

 

Command line for Windows x86

 

Do not show in results list

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes' Anti-Malware" /v "detectpup" /t REG_DWORD /d 0 /f

Show in results list and check for removal

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes' Anti-Malware" /v "detectpup" /t REG_DWORD /d 1 /f

Show in results list and do not check for removal

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes' Anti-Malware" /v "detectpup" /t REG_DWORD /d 2 /f

Command line for Windows x64

Do not show in results list

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Malwarebytes' Anti-Malware" /v "detectpup" /t REG_DWORD /d 0 /f

Show in results list and check for removal

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Malwarebytes' Anti-Malware" /v "detectpup" /t REG_DWORD /d 1 /f

Show in results list and do not check for removal

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Malwarebytes' Anti-Malware" /v "detectpup" /t REG_DWORD /d 2 /f

[creeves]

Setting to 1 did the trick. Thank you sir!

[AdvancedSetup]

You're quite welcome. 

 

If you're interested in some scripting I'm the Admin over here on the KiXtart forums

 

[jbbjshlws]

Hello everyone!

Great stuff here so far, I was hoping I could get a hold of that powershell script, we are using the pro version of MBAM through Kaseya and we end up with many MANY PuP's that are not removed automatically. How did you manage to script the removal and preferably as the system user so the end user doesn't get any window pop. 

 

cheers,

Joshua

[Firefox]

Hello and Welcome jbbjshlws
 
Normally it is frowned upon to reply to very old topics, its always better to start your own. That being said, looks like this is a business type question and is better suited to be asked in the Business Section of the forum HERE