Malwarebytes pro did not block "My PC Backup" PUP

[smipx013]

Hi,

 

I have my MBAM pro set to treat PUP's as malware.  I today tested my Malwarebytes Pro to see if it would block on the infamous "My PC Backup" malware and it simply let it install and run.  Most disappointed is putting it very mildly.  I tested it because I have a friend who was infected and she also used MBAM.  I wanted to see if her MBAM install was bad of if it was consistently being missed.

 

Its the latter and now im wondering why I bothered to pay good money for it?

 

Thanks

Paul

 

 

[daledoc1]

Hi:
 
Without seeing some diagnostic logs and scan logs, it's impossible to say for sure.
These pinned topics explain PUPs, as well as the complexities of preventing, detecting and removing malware:

What are the 'PUP' detections, are they threats, and should they be deleted?
The complexity of finding, preventing, and cleanup from malware
 
If you'd like some free, expert help checking the system to be sure it's clean, I suggest that you please follow the advice in this pinned topic: Available Assistance For Possibly Infected Computers.
It explains the options for free, expert help >>AND<< the preliminary steps to expedite the process.
A malware analyst will guide you through the scanning and cleanup process.

Thanks,

[exile360]

It's possible that there's a reason our Research team hasn't classified that software as PUP, however if you have a link to the software and/or the installer for it, you may post them in a new topic here for our Research team to review it and determine whether or not we should be detecting it.

[smipx013]

Hi,  I don't need any expert help on Malware and PUP removal but thanks for the offer.  It's what I do for my job :-)

 

This piece of software is quite well known in the computer repair industry of being "potentially" unwanted.  The company behind the software will tell you that they do noting illegal but the key here is the word "potentially".  Every customer I have come across has told me that they want rid of it as it's messing their machine up and the sales tactics employed by the company sail very close to the wind if you follow my meaning.  

 

Here are some independant reviews:  http://www.backupreview.com/mypcbackup-justcloud-zipcloud/

http://malwaretips.com/blogs/mypc-backup-virus-removal/ 

https://forums.malwarebytes.org/index.php?/topic/140477-mypcbackup-virus-removal-help/

 

I think that MBAM used to remove it and now they don't?

Were there legal threats from the company concerned?

 

You can't have posts on your forum about how to get rid of this "malware" on one hand and then on the other not detect it and remove it on the other surely?

 

Cheers,

Paul

[smipx013]

OK,  So I logged this with support and they have confirmed that they, Malwarebytes, feel this is a "legit program" and not "Potentially Unwanted" or PUP.  This goes against the grain of thought for most folk out there who detect and remove malware for a living and I think its a real shame that MBAM has diluted its offering. I am sad to say that I will not longet be recommending MBAM to my customers going forward because of this.  I will instead direct them to a product that does detect it and remove it (such as Emsisoft or Hitman Pro).

 

Lost revenue for MBAM im afraid.  I used to (up until today) recommend Free Avast + Paid for MBAM as the best line of defense.  Now it will be either Emsisoft or "Avast Free + Hitman Pro" (even though Hitman Pro is not realtime).

[smipx013]

You need only look at:  https://www.mywot.com/en/scorecard/mypcbackup.com?utm_source=addon&utm_content=warn-viewsc and the links above to know that it is PUP and something smells very fishy indeed here that MBMA let it pass.

[LDTate]

Samuel,

 

From Support Ticket

 

https://www.virustotal.com/en/file/6faf0ee307903290e31e2097dae91d0439aa112ba2e53a53f9f23ef5798e1a82/analysis/

 

SHA256: 6faf0ee307903290e31e2097dae91d0439aa112ba2e53a53f9f23ef5798e1a82 File name: MyPCBackup_Setup.exe

[Porthos]

I have to add my .02 worth. I also see this program on 95% of the computers that come in for service. It seems to be bundled with the junk that malwarebytes DOES get but this is over looked. It nags at every boot to purchase and I end up having to remove it every single time. If the program is legit they need to stop the aggressive bundling with other software for distribution and marketing. Its ONLY good thing that it will uninstall cleanly from its own uninstaller.

[smipx013]

They also phone up people who install it and act aggressively and threaten them with scare tactics when they refuse to purchase it.

[Hardhead]

Hello smipx013,

 

Why don't you just use an host file block like Hostsman and that will surely take care of the problem. Then you don't ever have to worry about your clients going there at all. There IP is 184.154.150.157.

 

 

[KenW]

Be happy MB removes the "hard" stuff and not a PUP that is easy to uninstall.

 

Per

Porthos  post.

[Porthos]

Why don't you just use an host file block like Hostsman and that will surely take care of the problem. Then you don't ever have to worry about your clients going there at all. There IP is 184.154.150.157.

 

Clients don't intentionally install this program. It is bundled with other programs. Of course it can be avoided most of the time by reading all install windows during any install but the install windows are worded to entice/trick users just to keep clicking next or use standard or recommended install options on the installer.

 

As for a host file it would not help this instance one bit. I'm sorry but, A host file is not for the average computer user to master. I wont link to posts to avoid calling out any one but there is a discussion where host file use and Maintenance has been explained in many ways to the average user and has been on going with not much success for about 2 months.

[smipx013]

Exactly.  I need a product I can put on a customers computer that protects them from all the crap and something that is easy for me to maintain and reliable.  If MBAM is missing this product then it opens up the fear in my mind that it is likely to miss others too because of their policy on PUP.

 

Remember that the computer ability of the people I install this for is very basic.

[KenW]

There is only one thing that will protect from everything. It is called the power button on the front of the computer.