OlderPUP undetected

[Emc1Studios]

I know that MBAM has a request policy for PUP class removal, but this particular bugger has been around for a while. Packaged normally with download redirects (downloader software from file download links) and not particularly invasive but an entry point none the less. I can't imagine it is intentionally allowed so perhaps just a miss.

Our friend OAS.EXE Online ad Scanner, snuck its way into a client machine along with a few other class (StormWatch, Wajam, PastaQuotes)....they were actually "let in" but that is another discussion entirely.

Malwarebytes free 2.0.4.1028 did not catch the intrusion living as a full blown installed .exe viewable in programs and features running from User/***/appdata/roaming 

The intrusion and subsequent exploit had fully co-opted into IE on a 64 bit system with default search engine google becoming the primary redirect vehicle with Enhanced protected mode enabled running as a full 64 bit browser.

I have it as an installed prog on a lab machine and its primary parent is svc running from appdata/roaming and entry to start Hkey auto at windows boot. It inserts 2 rules into basic windows firewall for inbound for it's updater and the prog itself and captures data metrics and site hits thru various data entry files and logs. The prog has a analytics gatherer that shows hit counts for redirects to various sites and appends logs as such. The prog has full administrative rights and sets itself and its parent folder to be read only at the admin level.

Full scan does not detect it, advanced targeted scan at the resident folder does not detect.

Other normally used second wave post infection tools have missed it as well

Just thought you would want to know. Thanks for doing what you do





 





 

 

[Firefox]

Hello and

You may try submitting the files to the Research Center Here so that they can review the file/installer and add it if needed.

 

Thanks