Malwarebytes Acquires Junkware Removal Tool

[Pierre (aka Terdef)]

Hi Marcin,

 

MBAM makes good choices, as usual.

 

There is a certain timidity of decontamination business solutions about PUPs, Adwares, and so on...

I remember https://forums.malwarebytes.org/index.php?/topic/110784-false-positive-case-very-urgent/ or what Microsoft done, dealing with advocates, under the pretext of contract accepted by the end users, even if without their knowledge, after the acquisition of Giant AntiSpyware (December 16, 2004), an antispyware promised a bright future, killed by Microsoft.

May the choice of MBAM cause a noticeable brake on the practices of bundlewares, trapped downloaders, repack and sponsoring without the knowledge of the user, or without his informed consent.

May the choice of MBAM cause a noticeable brake on the forced promotion of poor softwares or totally useless, that have no other options to be sold that catching victims while raping their computers.

May the choice of MBAM put a considerable brake on the flowering of pseudo solutions, unnecessary, dangerous, proceeding on fear (scareware), or purely for extortion.


Thanks a lot for all.

[Staticguy]

Great great great awesome news. Congratulations MBAM team and to the JRT and also to Filipos Mouliatis. My best wishes to you all for further continuing to make MBAM product better and better every year. Looking forward to see Junkware Removal Tool be integrated into Malwarebytes Antimalware and it's functionality and making a better product as always  .

[quietman7]

Congratulations thisisu... another awesome addition to the Malwarebytes Team.

[noknojon]

Congratulation!

Do you(this includes thisisu) plan to discontinue JRT as a standalone tool in the future?

@ Valinorum :

JRT as it is now, is just a .bat file (batch file) that covers many known minor infections / hijackers. It can be used at any time "as is".

The plans are to get thisisu to help with development for future editions of MBAM.

 

Please see post #27 by AdvancedSetup for other details..

[Nesivos]

Now it is official

[Valinorum]

Thank you very much, noknojon.

[RubbeR DuckY]

1.75 will contain any definitions that we add, but obviously no technology enhancements (except for business users which are still on 1.75!)

[ElPiedra]

Great news to MBAM !!  and congrats to Filipos aka @thisisu

 

 

 

Salu2

[Dakeyras]

Very nice/congratulations all concerned(I will post about this in the JRT support topic over in GeekU).

[Aura]

It might look like a stupid question but, since JRT isn't getting integrated right away in Malwarebytes, will we see a section created here for JRT support so we can report bugs, FPs, issues, etc. with it? I guess it could help face future issues with the integration. I don't recall seeing any "official" support thread for JRT on any forums so it could have its own section here, since it has been acquired by Malwarebytes.

[Firefox]

I am guessing for now you would post in the section Other Tools

[Aura]

Makes sense. Maybe JRT could be added in the description if the support for it will be given there

[MartinPC]

You know what's weird? I ran the new "Malwarebytes-branded" version of Junkware Removal Tool yesterday. It deleted an Internet Explorer "SearchScopes" (?*) registry key, as well as some AppData and User Data that uninstalling Google Chrome had left behind, And when it was finished, my Lenovo ThinkPad TrackPoint scrolling didn't work any more. I rebooted and TrackPoint scrolling worked fine once again. I'm guessing JRT figured the TrackPoint utility was an application that needed to be shut down and that if I'd done a little digging, I could have figured out how to relaunch it without rebooting. Anyway, I hope this little idiosyncracy doesn't cause too many TrackPoint users to freak out!

 

*Aha. "SearchScopes" apparently has something to do with advertising. I deliberately keep Internet Explorer as plain-vanilla as possible, with no ad-blocking or security add-ons, so I'm not surprised something like that managed to get a handhold in it. (I only use IE when I run across a site that won't work in my better-secured browsers.)

[ShyWriter]

Not particularly fond of JRT as there are no user options, that is it does not give you any control on what it deletes. In my mind this is a not good as the user should have control over what any program deletes from their system. Hopefully the MBAM guys will remedy this and make it an even better tool.

 

Amen.. It did a great job on my whole system until it deleted my paid version of Wisdom-soft SCREENHUNTER 5.1 Pro (the program I use to screen clip photos for various reasons) Thankfully I still has a backed download of the original program, *Phew* ,big time.Perhaps the program can generate a list of the PUPs, allow the user to check/delete in a text file, then run the JRT which uses the now generated file to only delete those on the list.. Just a thought because I'll never use it again... as is..

 

Steve

[noknojon]

It might look like a stupid question but, since JRT isn't getting integrated right away in Malwarebytes, will we see a section created here for JRT support so we can report bugs, FPs, issues, etc. with it? I guess it could help face future issues with the integration. I don't recall seeing any "official" support thread for JRT on any forums so it could have its own section here, since it has been acquired by Malwarebytes.

 

It is more of a case where thisisu is being asked to help "develop" MBAM, rather than just add another tool directly (as I read it). There is a site that thisisu maintains for this work.

JRT will stay as an independent tool for your use (as linked earlier) while thisisu helps here (like sUBs  helps here but maintains ComboFix).

 

P.S. Agree Steve, and only use AdwCleaner (with care) at this time.... but there is a long list of the PUPs on thisisu's own site ..

http://thisisudax.org/

[Aura]

I know noknojon, hence why I'm talking about "integration" here as JRT's technology will be integrated in Malwarebytes I was just wondering if there will be a section here on Malwarebytes where we can post about JRT, or if we still have to PM thisisu directly. Now that JRT has been acquired by Malwarebytes and could be considered one of "their" product in a certain way, I guess it would be normal for it to have a dedicated section or at least be included in the "Other programs" one.

[AdvancedSetup]

Once integrated you can use the regular MBAM help forum for questions. We probably will not have a dedicated forum for it as it will be part of the main program at that time.

[thisisu]

 I'm guessing JRT figured the TrackPoint utility was an application that needed to be shut down and that if I'd done a little digging, I could have figured out how to relaunch it without rebooting. Anyway, I hope this little idiosyncracy doesn't cause too many TrackPoint users to freak out!

 

Sorry about that! I can make an exception to not shutdown that program / process if I know what the name of the .exe of it.

[thisisu]

Amen.. It did a great job on my whole system until it deleted my paid version of Wisdom-soft SCREENHUNTER 5.1 Pro (the program I use to screen clip photos for various reasons) Thankfully I still has a backed download of the original program, *Phew* ,big time.Perhaps the program can generate a list of the PUPs, allow the user to check/delete in a text file, then run the JRT which uses the now generated file to only delete those on the list.. Just a thought because I'll never use it again... as is..

 

Steve

 

Hi,

 

I'll look into it. Sorry for the inconvenience

[thisisu]

It might look like a stupid question but, since JRT isn't getting integrated right away in Malwarebytes, will we see a section created here for JRT support so we can report bugs, FPs, issues, etc. with it? I guess it could help face future issues with the integration. I don't recall seeing any "official" support thread for JRT on any forums so it could have its own section here, since it has been acquired by Malwarebytes.

 

Feel free to private message me your concerns. This applies to anyone else that may have a question about the tool.

 

Thanks

[Staticguy]

Hi folks! Get want to get all of your attention regarding about a false positive from Avast that it detects Junkware Removal Tool as Win32:Evo-gen (Susp). Few hours ago me (an avast user) along with other users reported this false positive to Avast via Support and in the forum. Few minutes ago, the VPS update for Avast has been updated and no longer detects JRT as a suspecious file and it corrected it.

 

So to those users who uses Avast, your avast vps will update to 150627-1 to correct this false positive. Thanks.

 

Also to the Malwarebytes Antimalware Team. A chinese antivirus company called Jiangmin still detects JRT as a threat via VirusTotal https://www.virustotal.com/en/file/5811fa2d10c25abb4c25b598301d61c480c32668b539d14aa049c52bdb5c9214/analysis/1435440074/

 

The threat name is Trojan/Generic.buxhs.

 

It also detected it via MetaScan online, but it has dropped the detection now

[thisisu]

Amen.. It did a great job on my whole system until it deleted my paid version of Wisdom-soft SCREENHUNTER 5.1 Pro (the program I use to screen clip photos for various reasons) Thankfully I still has a backed download of the original program, *Phew* ,big time.Perhaps the program can generate a list of the PUPs, allow the user to check/delete in a text file, then run the JRT which uses the now generated file to only delete those on the list.. Just a thought because I'll never use it again... as is..

 

Steve

 

Hi again,

Wisdom-soft Screenhunter pro / free won't be removed any more once the tool is updated to 7.2.0 (soon)

[deeprybka]

 

Filipos Mouliatis

Research Engineer

 

WOW! Congratulations my friend!

[DanoNH]

Hi folks! Get want to get all of your attention regarding about a false positive from Avast that it detects Junkware Removal Tool as Win32:Evo-gen (Susp). Few hours ago me (an avast user) along with other users reported this false positive to Avast via Support and in the forum. Few minutes ago, the VPS update for Avast has been updated and no longer detects JRT as a suspecious file and it corrected it.

 

So to those users who uses Avast, your avast vps will update to 150627-1 to correct this false positive. Thanks.

 

Also to the Malwarebytes Antimalware Team. A chinese antivirus company called Jiangmin still detects JRT as a threat via VirusTotal https://www.virustotal.com/en/file/5811fa2d10c25abb4c25b598301d61c480c32668b539d14aa049c52bdb5c9214/analysis/1435440074/

 

The threat name is Trojan/Generic.buxhs.

 

It also detected it via MetaScan online, but it has dropped the detection now

FYI we normally request that anti-virus programs be disabled when deploying JRT, so there shouldn't be anything interfering with running the tool.  I can see where an A/V might remove it when downloaded and before running though.

 

In that case we can request disabling A/V before download as a work-around.  Thanks for the info. 

[Ried]

Donetao - Since this is the 2nd time you've brought this up - I will state clearly for all that you did not get into trouble for your views on that feature and your issues with TSF have nothing to do with this forum nor this topic.

 

While you consider the build up of EventViewer logs on your machine to be a nuisance, please bear in mind that recent, past Event Viewer information is helpful to forum Helpers from a diagnostic standpoint - which is why thisisu changed JRT to no longer automatically clear them.

 

The tool still has the ability to clear EventViewer logs, you just have to trigger it to do so.  Also, as you mentioned, you have other programs at your disposal to clear them if you want them cleared. 

 

**edit**

 

This post was in response to a member whose post had since been deleted

Edited July 3, 2015 by Ried