Blaming the Disease, not the Doctor?

[StewScot]

My company are using Crossrider to develop a browser plugin.  We're at the testing stage and, when using it on my home laptop (protected by Malwarebytes) I'm getting a PUP error on Crossrider and our dlls built upon it.

 

We are not using this for any form of monetisation, nor user tracking, nor anything nefarious.

 

I understand why products such as Ask are flagged as PUP, but to flag a whole toolkit, and therefore perfectly innocent apps is a bit much.

 

We performed searches against Crossrider prior to deciding to use it and only found one reference to hackers using it in 2012.  Now I find that we'll probably have to rewrite the whole damn thing, at considerable expense.

 

Is it not possible to focus on specific uses of a toolkit rather than tarring all uses with the same brush?

[shadowwar]

Can you please provide a scan log so we have some examples so we can evaluate this?

 

Thanks.

[StewScot]

Here's the MBAM log.

 

thanks

Stewart

plugin - crossrider.txt

[shadowwar]

By the way:

 

http://crossrider.com/

 

POWERING THE NEXT GENERATION OF ONLINE ADVERTISING

Crossrider specialises in monetising desktop and mobile media through the use of Big Data

 

And

 

http://crossrider.com/developers

 

MONETISE

We've made monetising a simple click of the button. Choose how and where to monetise your app and start earning from day one.

 

 

This is the reason we detect most of them because they fit the PUP classification by using their toolkit.

 

PUP= Potentially Unwanted Program.

 

 

IF your app doesnt use this part it would be a first for us and we can evaluate from there.

 

 

[StewScot]

Yes, we noticed that, but the development environment is actually pretty sweet, targets the 4 main browsers and you don't get the monetization options by default.

 

Anyway, we haven't fully finished our plugin, but here's the Chrome version.  It won't install directly as is because we aren't putting it on the store until it's finalised, but you can extract the contents as it's just a zip file.  (I've renamed the file, I couldn't upload a .crx)

 

 

[David H. Lipman]

It isn't a ZIP file.  ZIP file's 1^st two characters are "PK".  This file is "Cr24"
 

TrID - File Identifier (Definitions: 5357)
100.0%  (CRX)          Google Chrome Extension

EDIT:
https://www.virustotal.com/en/file/5bad41e8a824d731808d856fa2552e1c9f52a441e51844b52622691fa574beff/analysis/1407522406/
 

[shadowwar]

Its a renamed crx extension. Please include the full installer in a pm please so this can be properly evaluated. A Chrome extenision alone is not enough.