Adware.InstallBrain vs PUP.InstallBrain

[Phil0001]

Ok, So I am a little confused here.

 

This week I discovered on my machine via MalwareBytes that I had an Application called "BestCodecsPackSetup.exe" in my C:\%USER%\Downloads Folder. My AVG had not discovered it during a Full Scan done just before but MalwareBytes did report it and stated it was "Adware.InstallBrain."

 

Now I went off to do some additional reading to find out how much damage had been done...and this is where the confusion is. MalwareBytes has both "PUP.InstallBrain" and "Adware.InstallBrain" as possible alerts (as far as I can see, there seems to be no place were these Definitions are held for me to view the difference or indeed to understand what "Adware.InstallBrain" means.)

 

Having a look online has not helped. Some sites says its likely it was just a browserhyjacker and/or a advertisement generator. Similar named files seem to belong to a company called "Performersoft" who are know for making such PUP software, especially "PC Performers" which slow the computer down and try to get you to pay for them to speed up.

 

However others say it could have stolen private information...they seems to be real confusion (made worse by companies probably scaing me to use their (possible less than white) uninstall software.

 

Also different posts say the file is different variants of InstallBrain and of course different anti virus software's give different suggestions of the possible damage of that variant.

 

So...MalwareBytes.

 

Is there a different between PUP.InstallBrain and Adware.InstallBrain...if so what is it and what is likely the damage?

 

[Fatdcuk]

So...MalwareBytes.

 

Is there a different between PUP.InstallBrain and Adware.InstallBrain...if so what is it and what is likely the damage?

 

Hi Phil0001

 

Yes the difference is back in July we widened our criteria for PUP listing.

http://blog.malwarebytes.org/news/2013/07/malwarebytes-adopts-aggressive-pup-policy/

 

 

Adware type softwares with a EULA we once detected as Adware that pre date that change.

 

Where as new detections have the PUP.Optional vendor name if a EULA came with the software.

 

To be honest a lot of sites will overplay or mislead in their description of what something is or does to further their own needs etc

 

If InstallBrain was malicious then we would detect it as such but it is not malicious or perform any illegal activity which would allow us to detect it as malware.

 

I hope this puts your mind at rest.

[Phil0001]

Hi, Thanks for the speedy feedback

 

So, PUP.InstallBrain and Adware.InstallBrain are the same but as it has an End User Licensing Agreement within it it changed from Adware to PUP last July, is that correct?

[Fatdcuk]

Yes they are the same just depends on when the signatures was created for its detection.

 

These softwares are constantly updating and needing new signatures to detect newer versions.

[Phil0001]

But it is unlikely to have become more malicious in newer versions?

[Phil0001]

Or does the "Adware." mean "non malicious"

[Fatdcuk]

No, it is not malicious nor is Adware.

[Phil0001]

Excellent, Thanks for the quick and indepth answer