bionic_barry Posted October 19, 2016 ID:1067280 Share Posted October 19, 2016 This is a weird one that I came across this morning. I have a client that runs Malwarebytes Pro and Advanced SystemCare 9.4. Both are paid versions. I'm well aware of the IOBit theft, but I can't convince this client to remove it since it was paid and annually renewed. They upgraded to version 9.4 yesterday, and have an automatic Malwarebytes scan scheduled daily for 3am. This morning, they called me in a panic because all of their systems shows malware scan results of 474 PUPs. When I reviewed, the log, the majority were PUP.Optional.AdvancedSystemCare and PUP.Optional.DriverBooster, but there were 3 entries found for PUP.Optional.Venis. I'm not sure if these are associated with Venis Ransomware or if these are something else. There are no symptoms of an infection and the entries point to Advanced System Care registry keys. Are all of these entries false flags? Are they safe to ignore? Were these additions to the database intentional due to an actual threat, or is it due to bad blood with IOBit? I'm trying to give a recommendation based on facts, so I thought I'd inquire. Thanks in advance! Link to post Share on other sites More sharing options...
Staff shadowwar Posted October 19, 2016 Staff ID:1067282 Share Posted October 19, 2016 This should explain here. Basically we have gotten more agressive on pups. Link to post Share on other sites More sharing options...
Aura Posted October 19, 2016 ID:1067283 Share Posted October 19, 2016 Hi bionic_barry The IObit detections were added following Malwarebytes' new and more agressive stance on PUPs. For more information, you can check out the thread below. https://forums.malwarebytes.org/topic/189093-new-criteria-for-detecting-potentially-unwanted-products-pups/ This being said, are you able to copy/paste the PUP.Optional.Venis entries here so we can check them? Since they are flagged as PUP.Optional, I doubt they are related to the Venis Ransomware (and I've never heard of a Ransomware dubbed Venis). Link to post Share on other sites More sharing options...
bionic_barry Posted October 19, 2016 Author ID:1067318 Share Posted October 19, 2016 Thanks for the replies. I've attached a window shot of one of the quarantine windows. I can't find a log that lists them since it is PUP. The scan log from last night shows 0 across the board. Is there a separate log for PUPs so that I can include that as well? Link to post Share on other sites More sharing options...
Aura Posted October 19, 2016 ID:1067319 Share Posted October 19, 2016 Looks like that detection is related to an AdvancedSystem Care key, so you could group it with the IObit detections. No idea as to why it have a different detection name though. Link to post Share on other sites More sharing options...
bionic_barry Posted October 19, 2016 Author ID:1067328 Share Posted October 19, 2016 Here's a slightly better one including the path. Link to post Share on other sites More sharing options...
bionic_barry Posted October 19, 2016 Author ID:1067329 Share Posted October 19, 2016 Thanks for looking into that. I'd never seen that PUP.Optional.Venis before, and couldn't find any resources on Google. The closest I could find was referencing a Venis Ransomware posted on 10/5/2016. In any case, I'll disregard these for now, but I'm really going to push them to remove all IOBit products and not to renew, but it seems like playing Donkey Kong. Thanks for the help. Link to post Share on other sites More sharing options...
Aura Posted October 19, 2016 ID:1067330 Share Posted October 19, 2016 This key adds an option in the context menu (right-click) for AdvancedSystem Care, so it should be flagged as PUP.Optional.$SOMETHING_IOBIT logically. No idea why it has being flagged as Venis. And no problem barry, you're welcome Link to post Share on other sites More sharing options...
Staff shadowwar Posted October 19, 2016 Staff ID:1067350 Share Posted October 19, 2016 I fixed the name for the next update. Thanks for letting us know. Link to post Share on other sites More sharing options...
Aura Posted October 19, 2016 ID:1067353 Share Posted October 19, 2016 30 minutes ago, shadowwar said: I fixed the name for the next update. Thanks for letting us know. Not that it matters most of the time but, if you flag something when an incorrect threat name, can we report it here so you guys can adjust it? Link to post Share on other sites More sharing options...
Staff shadowwar Posted October 19, 2016 Staff ID:1067355 Share Posted October 19, 2016 Hmm not sure where that would belong. One thing to consider though. Sometimes our defs overlap and hit multiple families. So i may not always be able to fix it. Link to post Share on other sites More sharing options...
PaidCustomer Posted October 19, 2016 ID:1067364 Share Posted October 19, 2016 Greetings - First time here, so don't want to be too grouchy, but this feud that you all are having with IObit is costing me time, and that's money. To pop up a notice telling me that it is "POTENTIALLY" unwanted software is fine I suppose - although if it shows up as registered, then you should know it is wanted, as I'm not in the habit of paying for things I don't want. But to quarantine the product and pop up dozens of "Non-malware Detected" notices - even after I have REPEATEDLY clicked the button - is unacceptable. Now the program will not start as a .dll file is missing. and other parts of it (like the registered Driver Booster) won't work properly. Indeed, your software has become the malware! Frankly, I don't see why you all didn't just do a license agreement to combine your virus definitions for the benefit of your respective customers - which often are the same people because they buy both programs - not for the different definitions, but for the different feature sets. It's all very unprofessional and amateurish. In any event, I must demand that a proper update to your software be issued immediately. This problem just began, so I know rolling it back should not be that difficult for you. Additionally, I would specific instructions on how to completely restore the functionality of my paid IObit applications. Please make every effort to respond to my demands in the most timely manner possible, as again, this is a complete waste of my time. ASN Link to post Share on other sites More sharing options...
Aura Posted October 19, 2016 ID:1067375 Share Posted October 19, 2016 Hi PaidCustomer You can set an exclusion in Malwarebytes to exclude IObit files and folders if you wish. This way, Malwarebytes won't target them anymore. https://www.malwarebytes.com/support/guides/mbam/MalwareExclusions.html You can also change the Malwarebytes settings to warn/not warn about PUP and/or PUM detections as well. As for the files that were quarantined by Malwarebytes, simply head to the History tab, followed by Quarantine, select the files you want to restore and click on the Restore button. This should restore your IObit programs functionnality. If not, let us know. Additionally, Malwarebytes started targetting some of IObit products following a change in their PUP policy so they can target more products that have been reported by numerous users worldwide as being annoying, not wanted, etc. https://forums.malwarebytes.org/topic/189093-new-criteria-for-detecting-potentially-unwanted-products-pups/ If you want more detailled instructions, let me know and I'll help you. Note: I am not a Malwarebytes employee, I'm simply a mere volunteer on their forums. Link to post Share on other sites More sharing options...
PaidCustomer Posted October 19, 2016 ID:1067379 Share Posted October 19, 2016 Not sure how it manifests itself on others boxes, but on mine, it has a popup for every single file that is in the IObits application. It's totally uncalled for. And no, I don't want to turn off PUP notifications, but I also don't want to be used as some pawn in a vendetta between two companies arguing over something that should have been handled in a more professional manner. If there was an IP violation it should have been pursued through legal channels and not turned into some social media battle and extended in such as way that it interrupts my work and requires me to spend time learning what actions I need to take to counteract Malwarebytes effort to undermine IObits. Either grow up or just give me a refund and I'll find a more professionally managed product. Link to post Share on other sites More sharing options...
Aura Posted October 19, 2016 ID:1067380 Share Posted October 19, 2016 In that case, you simply have to exclude IObit files and folders (I posted a link with the instructions in my previous post) so Malwarebytes won't detect them anymore. Simple as that. Also like I've said, I doubt this is a personal vendetta, Malwarebytes is only applying their revised PUP criteria on products that weren't targetted under the old criteria, but now are. You'll notice that other programs, such as SpyHunter are also being targetted, and Malwarebytes doesn't have a personal "vendetta" against them. Link to post Share on other sites More sharing options...
PaidCustomer Posted October 19, 2016 ID:1067385 Share Posted October 19, 2016 Whether it's Revengeware or Anticompetionware has the same negative effect on my workflow. I either want it fixed or I want a refund, so again, on this matter, you should let the company speak for itself. Link to post Share on other sites More sharing options...
Aura Posted October 19, 2016 ID:1067391 Share Posted October 19, 2016 I'm giving you a solution that has been proposed earlier by a Malwarebytes employee, so I thought this was a good solution. Also, I'm a volunteer here and I do my best to assist users that have issues with Malwarebytes and/or their programs. If you don't like my advice, you are free to ignore them. Link to post Share on other sites More sharing options...
Staff shadowwar Posted October 19, 2016 Staff ID:1067392 Share Posted October 19, 2016 Please follow Aura's instructions to exclude these from detection. I am closing this thread, If you would like assistance further with this please feel free to open a ticket with the helpdesk and they will assist you. https://www.malwarebytes.com/support/ Link to post Share on other sites More sharing options...
Staff screen317 Posted October 19, 2016 Staff ID:1067400 Share Posted October 19, 2016 FYI we have delisted this software and this will be reflected in our next DB update. Link to post Share on other sites More sharing options...
Recommended Posts